OpenVPN Review 2026: Free for 2 Connections, $7 Seats and a Year of Security Patches

What OpenVPN sells in 2026, and what it does not

OpenVPN Inc. lists exactly two commercial products: "Self-hosted Access Server" and "Cloud-delivered CloudConnexa". It calls itself "The #1 Business VPN Trusted by 20,000+ organizations for over two decades." CloudConnexa is the 2023 rename of OpenVPN Cloud.

Neither product is a consumer privacy VPN. The company's consumer service, Private Tunnel, ended on December 12, 2022, and the CloudConnexa FAQ is blunt: its points of presence "do not provide a default exit route to the internet. Unlike a consumer VPN service, connecting to the PoP provides access to the virtual overlay private network instead of the Internet."

That makes the right comparison set Tailscale, Cloudflare Zero Trust, GoodAccess and Perimeter 81, not consumer VPNs. Server counts and streaming unblocking do not apply here; what matters is licensing, identity integration, logging and patch cadence.

The company is still run by its founders: Francis Dinha is co-founder and CEO, James Yonan co-founder and Chief Technology Innovator. We found no acquisition or ownership change, and the Terms of Use are governed by California law.

Access Server: self-hosted, priced per connection

Access Server is software you run yourself, on your own hardware or as an image from "cloud marketplaces (AWS, GCP, Azure, IBM, DigitalOcean, Oracle, Vultr)". Licenses count "simultaneous, active connections", not named users, so 10 connections can cover a larger team whose members are rarely all online at once.

Plans

• Free: "Up to 2 connections", "Use it free forever", "Instant access to all features", no card required.
• Growth: $7 per connection per month on yearly billing in the default 10-connection view, "Total of $70 per month billed yearly". Scales up to 2,000 connections.
• Enterprise & IoT: custom pricing for packages of 2,000 connections and above, with no connection cap.

The billing toggle says yearly billing saves $240 on that 10-connection default. By our arithmetic, not the vendor's, that puts monthly billing near $1,080 a year, or roughly $9 per connection per month. OpenVPN does not state the monthly rate in text we could verify.

On AWS there are two routes: a bring-your-own-license (BYOL) image, or tiered instances sized for 5, 10, 25, 50, 100, 250 or 500 users. Tiered instances are billed by Amazon, which matters for refunds.

What changed in 2026

• Access Server 3.2.0 (April 28, 2026): "For new installations, TLS 1.3 is now the default for both the web interface and VPN connections."
• Access Server 3.2.3 (September 30, 2026): moved to OpenVPN 2.7.7as0, fixing "a security issue where remote unauthenticated attacks could trigger a denial of service" (CVE-2026-84732).
• Access Server Link (announced September 11, 2026): a variant self-hosted in AWS, Azure and Google Cloud only, with a "Custom openvpn.com domain name - no public static IP address needed".

CloudConnexa: the cloud-delivered option

CloudConnexa is the hosted version: OpenVPN runs the network, and users, sites and cloud VPCs connect to its points of presence. The datasheet (last updated February 2026) lists "more than 30 worldwide points of presence (PoPs) across 6 continents". Networks connect "using OpenVPN or IPsec"; WireGuard is not mentioned on the pricing page or the datasheet.

Billing is per seat, and "A seat represents either an activated user or a connector", so the connector that links an office or VPC uses a seat too. Every plan includes granular access policies, DNS filtering, IDS/IPS and the global private network.

Plans

• Starter: free, 5 seats, 1 device per user, 2 connectors, 7-day retention on every log type.
• Essential: $7 per seat per month billed yearly ($70 a month for the 10-seat default). Adds LDAP and SAML, IPsec, log streaming to a SIEM, the public API, application sharing between accounts and 24/7 priority support. 3 devices per user, 500 connectors.
• Premium: $9.50 per seat per month billed yearly ($95 a month for 10 seats). Adds SCIM, multiple authentication methods, longer log retention, a dedicated account manager and a 99.9% uptime SLA. 5 devices per user, 1,000 connectors.
• Enterprise & IoT: custom pricing, configurable usage thresholds, guided onboarding and a proof of concept.

OpenVPN says yearly plans carry a term discount ("save up to 20%") over monthly rates, but the monthly per-seat price did not appear in the page's static text, so we do not quote one.

Starter sign-ups get a 14-day trial of Premium with 100 seats and no card required; the account shows it as an $11,400-a-year subscription. You are charged after it ends "Only if you entered your payment method when starting the trial."

What a 10-person team pays

Using each pricing page's own default of 10 units on yearly billing:

• Access Server Growth, 10 simultaneous connections: $70 a month, $840 a year, plus the server or cloud instance you run it on.
• CloudConnexa Essential, 10 seats: $70 a month, $840 a year, hosting included.
• CloudConnexa Premium, 10 seats: $95 a month, $1,140 a year.

The headline numbers match, but the units do not. Access Server bills concurrency, so a 25-person team that never has more than 10 people connected fits in 10 connections. CloudConnexa bills every activated user and every connector, so the same team with one office connector needs 26 seats on Essential, or $182 a month.

Very small teams can stay free: 2 concurrent connections on Access Server, or 5 seats on CloudConnexa Starter with 7-day logs and 1 device per user.

Logging and privacy: what is kept and for how long

CloudConnexa is not a no-logs service, and it does not claim to be. It is an admin tool, and logs are part of the product. Retention depends on the plan:

• Session logs: 7 days (Starter), 30 days (Essential), 60 days (Premium), 90 days (Enterprise).
• Audit logs: 7, 90, 180 and 365 days on the same four plans.
• DNS logs: 7 days on Starter, 30 days on every paid plan.
• Access visibility logs: 7 days on Starter, 30 days on every paid plan.

The Status > Connections view records the user, network or host name, the device or connector, the region and the session start time, and the list can be exported as CSV by email.

OpenVPN's privacy policy covers only "information collected through our website", so it says nothing about CloudConnexa service data. On the website itself, it logs "source IP address, user-agent strings and destination URLs", and it warns that some disclosures "may be considered a 'sale' or a 'share' under applicable laws." The policy shows no last-updated date.

Access Server is different by design: it runs on your own server or cloud account, so its connection logs live on infrastructure you control.

Both pricing pages list SOC 2 Type 2, ISO 27001, GDPR and HIPAA. We could not find the auditor or certification dates, so treat these as vendor claims until your security team has seen the reports.

Security record: about 20 CVEs patched in 2026

OpenVPN 2.7.0, published February 11, 2026, was the biggest community release in years. It supports the new upstream ovpn Data Channel Offload (DCO) Linux kernel module, removes the wintun driver on Windows (win-dco is now the default, tap-windows6 the fallback), adds server mode to win-dco and introduces epoch data keys.

Since then the 2.7 line has shipped a steady run of fixes, according to the GitHub release notes:

• 2.7.2 (April 22): 2 CVEs, a TLS handshake race condition and a server ASSERT on a malformed packet.
• 2.7.5 (July 2): 7 CVEs.
• 2.7.6 (August 6): 2 CVEs.
• 2.7.7 (September 3): 7 CVEs.
• 2.7.8 (October 7): 3 CVEs, including refusing certificates with NULL bytes in their subjects.

The 2.6 branch got matching fixes (latest 2.6.23, September 23). We did not check severity scores, so we are not grading these. Read the list as evidence of active maintenance and a reason to stay current, not as proof the software is unsafe. One practical warning: 2.7.8 makes certificate validation stricter about NULL bytes, which "might break existing installations if such certificates exist and OpenSSL builds are used."

Vendor advisories

• CVE-2025-13086 (December 2025): remote denial of service in Access Server 2.11.0 through 3.0.1, fixed in 3.0.2.
• CVE-2025-2704 (April 2025): Access Server 2.11.0 through 2.14.2 with TLS Crypt v2, "which is the default configuration", fixed in 2.14.3.
• CVE-2024-8474 (January 2025): the OpenVPN Connect Android app before 3.5.0 could log the private key in clear text when debugged over Android Debug Bridge.
• OVPNX (May 2024): three Windows-specific CVEs reported by researcher Vladimir Tokarev, fixed in OpenVPN 2.6.10 and 2.5.10.

The only independent review OpenVPN names on its about page is a Veracode rating from 2010. That is too old to count for much in 2026.

OpenVPN Connect and the community software

OpenVPN Connect is the official client for both Access Server and CloudConnexa. The help center screenshot below shows version 3.8.0; we could not confirm whether that is the latest build. The app is simple: a profile list, a connect toggle and an exportable log file for support tickets.

The free community software is a separate project. The current releases are 2.7.8 (October 7, 2026) and 2.6.23 on the older branch. You can build your own server with it at no cost, but you give up the admin web UI, licensing, SAML and support that Access Server adds. OpenVPN's blog published a definitive guide to DCO in February 2026 for admins tuning performance.

Trials, cancellation and refunds

Refund terms sit in section 18 of the Terms of Use: OpenVPN refunds "the purchase price you paid for the product if you make your refund request to us within 30 days of the date of purchase." The catches:

• No refunds on renewed subscriptions, or after 30 days, unless OpenVPN decides the product is defective.
• Fixed license keys are refundable only if they "have not been activated on a server".
• Requests must go in writing to [email protected] with your OpenVPN account email, subscription ID or license key, invoice or order number, and the reason for cancelling.
• AWS Marketplace purchases are refunded through Amazon, within 30 days.

Cancelling is easy; getting money back is not automatic. An Access Server cancellation turns unused funds into account credit, and a cash refund needs an email to sales. A CloudConnexa cancellation or downgrade takes effect at the end of the current billing cycle. Set a reminder before an annual renewal, because renewals are excluded from the 30-day window.

Who OpenVPN suits, and who it does not

Pick Access Server if the VPN must run on your own infrastructure, for regulatory reasons, an isolated site or an IoT fleet, and your team can patch a Linux server. Concurrency licensing is good value for shift-based or part-time remote access.

Pick CloudConnexa if you want site-to-site and remote access without running a server, with SAML, SIEM streaming and IPsec from Essential up. Count connectors as seats when you budget.

Look elsewhere if you want a personal VPN for privacy or streaming (see our Mullvad and Proton VPN reviews), a WireGuard-based mesh network (our Tailscale review and WireGuard guide), or a broader zero-trust bundle (our Cloudflare Zero Trust, GoodAccess and Perimeter 81 reviews).

Verdict

OpenVPN remains the safe, unflashy choice for business remote access: two decades of protocol work, a real free tier on both products and list prices of $7 per connection or seat on annual billing. The weak spots are paperwork rather than code: refunds that exclude renewals, a trial page that contradicts itself about credit cards, compliance badges without published auditors and a security audit from 2010. The steady 2026 patch stream is a strength if you keep up with it and a liability if you do not.

Frequently asked questions

How much does OpenVPN cost in 2026?

It is free for up to 2 simultaneous connections on Access Server or 5 seats on CloudConnexa. Paid plans list at $7 per connection (Access Server Growth) or $7 per seat (CloudConnexa Essential) per month on yearly billing, with CloudConnexa Premium at $9.50 per seat. Enterprise plans are custom quotes.

Is OpenVPN free?

The open-source OpenVPN software is free. OpenVPN Inc.'s products have free tiers, Access Server for 2 connections forever and CloudConnexa Starter for 5 seats, and both offer 14-day trials of up to 100 connections or seats.

Can I use OpenVPN to hide my IP address or stream?

Not with OpenVPN Inc.'s products. CloudConnexa does not provide a default route to the internet, and the consumer service Private Tunnel closed in December 2022. Use a consumer VPN service instead.

Does CloudConnexa keep logs?

Yes. Session logs are kept for 7 to 90 days, audit logs for 7 to 365 days and DNS logs for up to 30 days, depending on plan. Connection records include the user, device or connector, region and session start time.

Does CloudConnexa support WireGuard?

Not according to OpenVPN's own pages. The datasheet lists OpenVPN and IPsec for connecting networks, and IPsec support starts on the Essential plan.

What is the difference between Access Server and CloudConnexa?

Access Server is software you host and license per simultaneous connection. CloudConnexa is a hosted service billed per activated user or connector, running on more than 30 points of presence.

Can I get a refund from OpenVPN?

Yes, within 30 days of purchase, by writing to [email protected]. Renewals are excluded unless the product is defective, fixed license keys must not have been activated, and AWS Marketplace purchases are refunded by Amazon.

Key takeaways

• OpenVPN Inc. sells business remote access, not a consumer VPN: Access Server (self-hosted) and CloudConnexa (cloud-delivered).
• Free tiers cover 2 concurrent connections on Access Server and 5 seats on CloudConnexa; paid plans list at $7 per connection or seat per month billed yearly.
• CloudConnexa keeps session logs for 7 to 90 days and audit logs for up to 365 days, depending on plan.
• Refunds run 30 days from purchase and exclude renewals; requests go in writing to [email protected].
• About 20 CVEs were fixed in the OpenVPN 2.7 line in 2026, so stay on the latest release.