Antonio Quartulli

Linux kernel hacker, networking addict. Maintainer of ovpn in mainline Linux, hacks on @OpenVPN. CEO of Mandelbit. Speaks for himself.

[Antonio Quartulli @antoniobits]

Two years of work on the ovpn kernel module just landed in VyOS.

@OpenVPN 2.7 now runs its data channel in the kernel on @vyos_dev VyOS Rolling, using the ovpn module that's been part of mainline Linux since 6.16. 🧵

[VyOS Networks @vyos_dev]

🗒️ The VyOS Project September 2026 Update is live.

September brought changes to VPN performance, API authentication, routing, and operations, with around a third of the work contributed from outside the core team.

Here are some of the highlights:
⚙️ ...
https://t.co/tndU5hAqIa

[Antonio Quartulli @antoniobits]

@vyos_dev OpenVPN at full speed!

[Firas Shaari @FirasShaari]

I made it to NetDev 🙏.

https://t.co/ElBQfRaUzy

[Antonio Quartulli @antoniobits]

How hard the next device will be depends on how much support for it already exists in the open.

If you run OpenWiFi, which access point would you like supported next?

https://t.co/kJ6xtkasBN

[Antonio Quartulli @antoniobits]

How hard is it to bring a device that already runs OpenWrt into OpenWiFi? We tried it on a NETGEAR WAX610, and the port is now submitted upstream to the Telecom Infra Project. 🧵
#OpenWiFi #OpenWrt

[Antonio Quartulli @antoniobits]

The hardest part: the WAX610 has no partition for the certificates a device uses to authenticate to the OpenWiFi controller. They live in a firmware bank, every upgrade switches banks, and OpenWiFi has to find them again each time.

[Antonio Quartulli @antoniobits]

The integration was done by OpenWrt's own contributors, which says something about how little it takes to adopt.

Is your product waiting for a kernel upgrade to get a feature it could have today?

https://t.co/fg9xaPsOXP

[Antonio Quartulli @antoniobits]

If your product is pinned to an LTS kernel, you've probably accepted that new kernel features arrive with your next kernel upgrade. OpenWrt just showed that for OpenVPN, it doesn't have to work that way. 🧵
#OpenWrt #OpenVPN

[Antonio Quartulli @antoniobits]

The detail worth noticing: on its development branch, OpenWrt builds the backports package even for 6.18, a kernel that already includes ovpn. Backports lets it follow newer ovpn code than its kernel carries, on its own schedule.

[Antonio Quartulli @antoniobits]

It shipped as the first new feature in the OpenVPN 2.7 release notes.

If your product depends on an open-source project, upstream belongs in the plan from day one. Is there a patch you should have sent upstream years ago?

https://t.co/qlJ6zV89xO

[Antonio Quartulli @antoniobits]

A private fork feels like the fast option. Then every upstream release arrives with an invoice attached: another rebase, another round of conflicts, another security fix to port by hand. 🧵
#OpenSource #OpenVPN

[Antonio Quartulli @antoniobits]

The part nobody puts in a roadmap is trust. Multi-socket support in OpenVPN had been attempted and set aside more than once, until Gianmarco De Gregori on our team rebuilt its foundation and carried it through review.

[Antonio Quartulli @antoniobits]

The other delicate part: existing OpenVPN configs keep working after the upgrade to 2.7, and setups DCO can't handle are flagged at commit time, not at runtime.

All open-source work, now in VyOS Rolling: https://t.co/E7rwSwmONS

[Antonio Quartulli @antoniobits]

On VyOS, the tunnel interface belongs to VyOS, not to OpenVPN. That one design choice turned out to be the hardest part of bringing OpenVPN 2.7 and the in-kernel ovpn module to VyOS. 🧵
#VyOS #OpenVPN

[Antonio Quartulli @antoniobits]

The patch is still in upstream review, so we shipped it in VyOS ahead of the merge. Users get the fix today, and the package moves to the upstream version once it lands.