Is providing a static TLS key during an OpenVPN handshake useless for commercial providers?

Question

When using OpenVPN, tls-auth and tls-crypt are widely adopted options, allowing a static key to be used in the initial handshake. This helps prevent against DoS attacks, as without the valid key a client will be disregarded almost instantly.

This makes sense for personal VPNs, however when it comes to commercial VPNs is this still the case? I've downloaded some OpenVPN configuration files from NordVPN and they have their static key listed in the tls-auth section of the config. Now since this key is available to anybody on the internet (even people who aren't using them- I was able to download these and I'm not even subscribed to their service) can this actually still protect their servers against DoS attacks?

If everybody on the internet has access to this key, then surely the client won't be instantly disregarded anymore and it defeats the purpose of the key? An attacker could use this key just like a legitimate client right? If this is the case, won't it make using such an option in a commercial setting useless?

Or am I missing something, and there are other ways this key helps to secure a connection?

Thanks.

Answer 1

I don't think it's useless. Think of pre-shared key as an extra layer of protection for the TLS channel, requiring that incoming connections are correctly HMAC signed by the PSK key.

This feature protects a VPN gateway from certain types of DoS attacks aimed at overloading device CPU, for example. It also defeats casual port scanning, preventing the service from quick fingerprinting. And it acts as second line of defense for SSL library vulnerabilities.

Not all threats or DDos bots will use a properly configured TLS auth PSK for it's attack connection. So for those types threats it is useful.