VPN protocols explained: WireGuard vs. OpenVPN vs. IKEv2
Every VPN app lets you pick a protocol somewhere in settings, usually without explaining what it does. Here's how WireGuard, OpenVPN, and IKEv2 actually differ — speed, security, battery life, and when to pick which.
Open a VPN app's settings and there's usually a "Protocol" dropdown with a few cryptic options. Most people never touch it. It's worth understanding, because the protocol you pick affects speed, security, and how well the connection survives switching networks. For the full connection process — handshake, tunneling, routing — see how a VPN works, technically; this post focuses specifically on comparing the protocol options.
The two-line summary
WireGuard is the modern default: fast, simple, and well-audited, and what most quality VPN providers use today. OpenVPN and IKEv2 are older but still relevant — OpenVPN for restrictive networks, IKEv2 for mobile devices switching networks frequently.
Pick WireGuard unless you have a specific reason not to.
WireGuard
Released in 2015 and merged into the Linux kernel in 2020, WireGuard was built to fix what its predecessors got wrong: it's around 4,000 lines of code, versus 600,000+ for OpenVPN, which makes it far easier to audit for bugs and far faster to run.
Strengths:
- Fastest of the three in almost every benchmark.
- Modern cryptography (ChaCha20, Curve25519) with no legacy cipher baggage.
- Small codebase means fewer places for vulnerabilities to hide.
- Reconnects quickly after network changes (Wi-Fi to cellular, sleep/wake).
Weaknesses:
- UDP-only — some restrictive networks and firewalls block UDP traffic, where OpenVPN's TCP mode can get through.
- By design, the base protocol needs to assign a static IP per client, which is a mild privacy consideration some providers solve with extra engineering on top (rotating internal IPs, no persistent logs tied to them).
Most providers running WireGuard have built their own layer on top to address that last point — Mullvad's implementation and NordVPN's "NordLynx" are both WireGuard-based with additional handling for this.
OpenVPN
The previous-generation standard, still widely deployed and extremely battle-tested — it's been in production use since 2001 and has survived two decades of security scrutiny.
Strengths:
- Runs over TCP as well as UDP — TCP mode can often get through firewalls and restrictive networks (hotel Wi-Fi, some countries' network filtering) that block WireGuard's UDP traffic.
- Highly configurable — enterprises and advanced users can tune almost every parameter.
- Long track record with no major unresolved vulnerabilities.
Weaknesses:
- Slower than WireGuard, sometimes noticeably.
- Large codebase (600,000+ lines) means a bigger attack surface, even with a strong security history.
- More complex to configure manually.
OpenVPN is the right pick when you specifically need TCP mode for a restrictive network, or when you're connecting to an older enterprise VPN setup that doesn't support WireGuard.
IKEv2/IPsec
Built directly into iOS and macOS at the operating system level, which is why it's often the default for manually configured "VPN" entries on those platforms, and why many enterprise VPNs use it.
Strengths:
- Excellent at handling network changes — built-in support for reconnecting seamlessly when switching from Wi-Fi to cellular, which matters a lot on mobile.
- Fast, comparable to WireGuard in many benchmarks.
- Native OS support on Apple platforms means no third-party app needed for basic use.
Weaknesses:
- Uses UDP ports that are somewhat more recognizable and blockable than WireGuard's flexible port assignment.
- Implementation quality varies more between providers than WireGuard does, since IKEv2 has more configuration surface.
Side-by-side comparison
| WireGuard | OpenVPN | IKEv2/IPsec | |
|---|---|---|---|
| Speed | Fastest | Slower | Fast |
| Codebase size | ~4,000 lines | 600,000+ lines | Varies by implementation |
| Firewall traversal | UDP only | UDP or TCP | UDP |
| Mobile network switching | Good | Fair | Excellent |
| Native OS support | No (needs app) | No (needs app) | Yes, on iOS/macOS |
| Best for | Most users, most of the time | Restrictive networks, legacy compatibility | Mobile devices, Apple ecosystem |
Which one should you actually pick
- Default to WireGuard if your VPN app offers it. It's faster and simpler for the vast majority of use cases.
- Switch to OpenVPN (TCP mode) specifically when a network is blocking your VPN connection — hotel Wi-Fi, an airport, or a country with active network filtering. TCP traffic on port 443 is much harder to distinguish from ordinary HTTPS traffic.
- IKEv2 is a reasonable default on iPhone/iPad if you're using the OS-native VPN configuration rather than a third-party app, since it's built in and handles network switching well.
For most users on a quality provider's app, this choice is largely invisible — the app defaults to WireGuard and only exposes the alternative protocols as a fallback option in settings.
Quick FAQ
Is WireGuard less secure because its codebase is smaller? No — the opposite argument is generally accepted as stronger. A smaller, simpler codebase is easier to audit thoroughly, which is part of why WireGuard has had a strong security track record since release.
Can a website tell which protocol I'm using? No — protocol choice is invisible to the destination website. It only affects the connection between your device and the VPN server.
Why would I ever choose a slower protocol on purpose? Reliability. A slightly slower connection that actually gets through a restrictive network beats a faster one that's blocked entirely.
Do all VPN providers support all three protocols? No — coverage varies. Check a specific provider's supported protocols in what to look for when choosing a VPN if this matters for your use case.
TL;DR
WireGuard is faster, simpler, and the right default for most people. OpenVPN's TCP mode is the fallback when a network blocks your connection. IKEv2 is a solid native option on Apple devices, particularly for handling network switches on mobile. Pick WireGuard unless you have a specific reason not to.