A plain-English guide to VPN protocols: how WireGuard, OpenVPN, IKEv2/IPsec and older options compare on security, speed and reliability, which to choose on different networks, and which to avoid.
A VPN protocol is the set of rules that decides how your device and the VPN server set up an encrypted tunnel and send data through it. Most VPN apps choose one automatically, but knowing the differences helps when a connection is slow or blocked.
WireGuard
WireGuard is a modern protocol designed to be simple, fast and secure. Its codebase is very small compared with older protocols, which makes it easier to review for security flaws. It uses a fixed set of modern cryptography rather than letting you pick from many options, reducing the chance of weak configurations.
- Strengths: usually the fastest option; quick to connect; efficient on mobile batteries; handles network changes well.
- Considerations: in its basic design, it associates users with fixed internal IP addresses on the server. Commercial VPNs add their own systems to address privacy concerns about this. NordVPN's NordLynx, for example, is built on WireGuard.
- Networks: uses UDP, which some restrictive networks block.
OpenVPN
OpenVPN is a long-established open-source protocol that uses TLS, the same technology that secures HTTPS websites. It's highly configurable and has been widely audited.
- Strengths: mature and well tested; works on almost any platform.
- UDP or TCP: UDP is usually faster. TCP is more reliable on poor connections and, on port 443, can look similar to normal HTTPS traffic, which helps on networks that block VPNs.
- Considerations: generally slower than WireGuard and heavier on battery.
IKEv2/IPsec
IKEv2, used with IPsec, is a standard supported natively by many operating systems, including iOS, macOS and Windows.
- Strengths: fast reconnection when switching between Wi-Fi and mobile data, thanks to a feature called MOBIKE; good for phones.
- Considerations: uses specific ports that some networks block. Security depends on correct implementation and settings.
Older protocols to avoid
- PPTP: one of the oldest protocols, with known serious weaknesses. Avoid it.
- L2TP/IPsec: more secure than PPTP but slower and easier to block, and largely superseded.
Proprietary protocols
Some providers have their own protocols or modified versions of open ones. Look for independent audits and technical documentation. "Built on WireGuard" is generally more reassuring than a completely closed design.
Which to choose?
| Situation | Try first | If that fails |
|---|---|---|
| Everyday use at home | WireGuard | OpenVPN UDP |
| Phone moving between networks | WireGuard or IKEv2 | OpenVPN UDP |
| Hotel or workplace Wi-Fi blocking VPNs | OpenVPN TCP 443 | Provider's obfuscation option |
| Older router | WireGuard if supported | OpenVPN |
Obfuscation
Some VPNs offer "obfuscated" or "stealth" servers that disguise VPN traffic to get past networks that block VPNs. They're usually slower, so only use them when needed. Respect workplace and institutional network rules.
How do you change protocol?
Most VPN apps hide protocol choice under Settings, often labelled "VPN protocol" or "Connection". Leave it on automatic unless you have a problem. If you switch, disconnect first, choose the new protocol, reconnect, then check your connection and run a leak test to confirm traffic is going through the tunnel.
Encryption terms you'll see
- AES-256: a widely used encryption standard, common in OpenVPN and IPsec.
- ChaCha20: a modern cipher used by WireGuard, efficient on devices without AES hardware acceleration.
- Perfect forward secrecy: new keys are created regularly so that one compromised key doesn't expose past sessions.
"Military-grade encryption" is a marketing phrase, usually meaning AES-256.
Frequently asked questions
Is WireGuard safe?
It's widely regarded as secure, uses modern cryptography and has been reviewed extensively.
Should I change the protocol from automatic?
Only if you have problems with speed or connection.
Sources and further reading
- WireGuard: Protocol and cryptography
- OpenVPN community documentation
- IETF RFC 7296: IKEv2
- NCSC: Virtual Private Networks
Facts checked on 20 October 2026. Spotted an error? Tell us and we will correct it.