crackthe.net
VPN protocols: WireGuard, OpenVPN, and what they change
What a VPN protocol is, how WireGuard, OpenVPN, and IKEv2 differ, whether TCP or UDP is better, and why you should avoid PPTP.
Key points
- A VPN protocol is the set of rules the app and the server use to build the encrypted tunnel.
- WireGuard is newer, small, and usually fast. OpenVPN is older, very widely supported, and can look like normal web traffic. IKEv2 is built into many phones and computers.
- For most people, the app’s default choice is fine. Change it only if a network blocks the VPN or the connection is unstable.
Where the protocol works
- VPN appspeaks the protocol
- VPN serverspeaks the same protocol
- Websitedoes not see the protocol
The protocol only matters between your device and the VPN server. Websites see normal traffic from the server.
Is WireGuard better than a VPN?
WireGuard is not an alternative to a VPN. It is one of the protocols VPN apps use to build their tunnel. In the same way, OpenVPN is both a protocol and the name of the software that runs it.
The common protocols compared
| WireGuard | OpenVPN | IKEv2/IPsec | |
|---|---|---|---|
| Age | since about 2016 | since 2001 | since the 2000s |
| Code size | small, easy to review | large | part of the system |
| Speed | usually fast | slower than WireGuard | fast |
| Works through strict networks | sometimes blocked | can run over TCP port 443, like web traffic | sometimes blocked |
| Mobile networks | reconnects quickly | slower to reconnect | built for switching networks |
| Built into phones and computers | partly | needs an app | often built in |
Many providers also build their own protocol, often on top of WireGuard. Examples are NordVPN’s NordLynx, which builds on WireGuard, and ExpressVPN’s Lightway. ExpressVPN’s trust center lists several external audits of Lightway.
TCP or UDP: which is better?
OpenVPN can run over UDP or over TCP. UDP is usually faster, which is why it is the common default. TCP, especially on port 443, looks like ordinary encrypted web traffic to a network. So it gets through networks that block VPNs more often, for example in hotels or offices.
And PPTP?
PPTP is a protocol from the 1990s and has long been considered insecure. Apple removed support for it from iOS and macOS in 2016. If an app offers you PPTP, choose something else.
Which one to choose
- Start with the app’s default. Most apps pick the best protocol for your network automatically.
- If the VPN does not connect on a hotel or office network, switch to OpenVPN over TCP. It looks most like normal web traffic.
- If the connection keeps dropping on mobile, try WireGuard or IKEv2.
- If speed matters most, try WireGuard.
What the protocol does not change
- Which country the server is in. That is a matter of the location, not the protocol; see Virtual VPN locations.
- What the VPN provider can see. Every protocol ends at the provider’s server.
- Whether your DNS requests leak. That depends on the app; see DNS and WebRTC leaks.
Protocols are not tested on this site. The archive measures where the provider’s published servers are, not how fast or secure each protocol is. The provider pages show what each provider’s list contains.
Next step
Read What VPN encryption protects to see which part of the trip a protocol protects.
The figures in this guide come from the archive and change with every data update. As of November 1, 2026.
Check it with the archive's data
- VPN services and providers: locations, measurements, prices
- Finder: which VPN or security tool fits you?
Read next: VPN tunnel and encryption: what is protected and what is notAll guides