What is OpenConnect?

OpenConnect began as a client. Cisco's AnyConnect SSL VPN was widely deployed and its official client was awkward on Linux, so David Woodhouse wrote an open one that spoke the same protocol. It grew to support Juniper, Palo Alto, Fortinet and others, and a matching server, ocserv, followed.

The result is a family of SSL VPNs with one property that matters more than the rest: they look like HTTPS.

How it works

A connection starts as an ordinary TLS session to port 443. The client authenticates — certificate, password, or both, often with a second factor — and the server responds with a configuration: an address for the client, routes, DNS servers.

From then on, traffic is carried inside that TLS session. There is also a UDP fast path using DTLS, negotiated during setup, because carrying a tunnel inside TCP is slow. When DTLS is available traffic uses it; when it is blocked, everything falls back to the TLS connection and keeps working.

That fallback is the whole design. The tunnel degrades in performance rather than failing.

Why it gets through where others do not

To a network middlebox, the initial connection is a TLS handshake to port 443 with a normal-looking certificate. Blocking it means blocking a pattern that also describes every website.

Compare:

• WireGuard is UDP with a distinctive fixed-size handshake. Easy to block by port, and identifiable by shape.
• OpenVPN over UDP 1194 is blocked by closing one port.
• OpenVPN over TCP 443 is close to this, and it is why that mode exists.
• OpenConnect is HTTPS by construction, not by disguise, and its control traffic genuinely is HTTP over TLS.

For someone on a network that permits web browsing and nothing else, that difference decides whether a VPN works at all.

What it costs

Throughput. TLS framing adds overhead, and when DTLS is unavailable you are running a tunnel inside TCP, which stacks two congestion control loops. On a clean network with DTLS working, it is respectable. On a network that blocked UDP — the reason you chose it — it is not.

Complexity. The protocol carries a configuration exchange, session cookies and re-key logic, all of which is more moving parts than WireGuard has in total.

CPU. Userspace TLS processing per packet, rather than a kernel data path.

Where you will meet it

At work. If your employer's VPN is AnyConnect, GlobalProtect, Pulse or FortiClient, OpenConnect can very likely talk to it, which is useful on Linux where the vendor client may be poor or absent.

As a censorship-resistant option. Providers that operate in or for restrictive networks often run ocserv alongside their main protocol precisely for its blocking resistance.

As a fallback. Some consumer providers include it for the case where WireGuard and OpenVPN both fail.

VPNmine's backend can issue OpenConnect alongside WireGuard where a server has it enabled, which is the same fallback pattern: WireGuard first, something that looks like HTTPS when the network will not permit anything else.

Using the client

On Linux it is packaged everywhere:

sudo apt install openconnect
sudo openconnect --protocol=anyconnect vpn.example.com

NetworkManager has a plugin, so it can also be configured graphically and brought up like any other connection. The Linux guide covers where this fits alongside WireGuard.

How to choose

Situation	Protocol
Ordinary use on an open network	WireGuard
Network blocks UDP but permits TCP 443	OpenConnect or OpenVPN/TCP
Network fingerprints VPN handshakes	OpenConnect
Connecting to a corporate SSL VPN	OpenConnect
Best throughput	WireGuard

The honest summary is that OpenConnect is a specialist tool that happens to be the right one surprisingly often. Nobody picks it for speed. People pick it because it is the thing that connects when nothing else will, and the server list is only useful if you can reach one of them in the first place.

Authentication, and why it is more involved

OpenConnect servers usually sit in front of an organisation's identity system, so the login flow is richer than a key exchange. A session commonly involves a password, a certificate, and a one-time code, and the server can present a form the client renders.

That flexibility is why it fits corporate deployments and why a consumer setup feels heavyweight by comparison. WireGuard's entire notion of identity is a 32-byte public key; OpenConnect can require a smartcard.

Session cookies and reconnection

After authentication the server issues a session cookie, and the client uses it to re-establish the tunnel without a full login. That is what lets an OpenConnect session survive a brief network interruption or a laptop suspending.

It also means the cookie is a credential. A client that stores it insecurely gives anyone with filesystem access a working session, which is why the standard clients keep it in memory and do not write it out.

A note on the name

"OpenConnect" refers to three related things: the client, the ocserv server, and the protocol they speak between themselves. When a provider says it supports OpenConnect it usually means ocserv with the client's own protocol, rather than a Cisco-compatible mode. The distinction rarely matters in practice, because the client speaks both.