tls-auth does prevent replays: note the "packet-id for replay protection" at http://openvpn.net/index.php/open-source/documentation/security-overview.html http:

tls-auth does prevent replays: note the "packet-id for replay protection" at http://openvpn.net/index.php/open-source/documentation/security-overview.html http://openvpn.net/index.php/open-source/documentation/secur.... OpenVPN does a pretty good job, as long as you choose a sane configuration (most importantly, use tls-auth and TLS key negotiation). It's definitely less vulnerable than other TLS stuff due to the tls-auth option. (Full disclosure: my company provides the hardened OpenVPN-NL, and I've done a little work on that.)