VPN Protocols Compared: WireGuard, OpenVPN, IKEv2 & More

What you’ll find here

Definitions, decision help, and protocol data from paid VPN tests

This page covers the main types of VPN protocols without turning into a glossary dump. You can pick a sensible starting protocol, see how WireGuard, OpenVPN, and IKEv2 differ, inspect our own paid protocol results, and check where a protocol was actually available in the VPN apps we reviewed.

Start here

Which VPN protocol should you use?

For most people, the boring answer is the useful one: leave a trustworthy VPN on its recommended Automatic or Smart setting, or try WireGuard (or a well-documented WireGuard-based option) when you want a fast general-purpose default. OpenVPN UDP is a strong fallback when you want OpenVPN without TCP overhead. OpenVPN TCP and provider-specific stealth modes become more interesting when a network blocks ordinary VPN traffic.

There is no protocol that wins every network, device, and provider. In our paid tests, WireGuard-family options were the fastest download choice in all seven providers where we had a usable same-session WireGuard-family versus OpenVPN pairing. That is meaningful first-party evidence, but it is a pattern from our test cycle, not a law of networking.

These are starting points, not security or performance guarantees. Provider implementation, server route, device, network filtering, and app version can change the result.

The terminology matters

What a VPN protocol actually controls

A VPN protocol is the set of rules and cryptographic/networking behavior used to establish and operate the tunnel between your device and a VPN endpoint. The protocol influences connection setup, packet handling, supported transports, cryptography, roaming behavior, and how easily a VPN can fit through different network conditions.

VPN apps make this harder to read than it should be because the same menu can contain actual protocols, transports, obfuscation modes, and an Automatic selector. Those labels are not interchangeable. Split tunneling is a routing policy that decides which traffic uses the tunnel; it is not another VPN protocol.

One trap worth avoiding: “WireGuard TCP”

The WireGuard protocol specification says its packets are sent over UDP, and WireGuard’s own limitations page says native WireGuard does not tunnel over TCP. A VPN can still offer a product setting called “WireGuard TCP” by adding its own transport or obfuscation layer. Proton VPN does exactly that. We treat the provider-labeled mode as a provider implementation, not as evidence that native WireGuard suddenly gained TCP support.

Decision matrix

VPN protocols compared

First-party evidence

What our paid VPN protocol speed tests showed

Our consolidated speed dataset contains 268 records. The protocol-comparison subset contains 65 VPN-on records across all nine VPNs in our current ranked comparison. We changed protocol or connection mode while keeping the provider and comparison route fixed, then used the Speedtest by Ookla Windows app to record ping, download, upload, and secondary fields when the tool captured them.

Protocol is only one variable in a speed result. To compare a no-VPN baseline with a VPN-on result on your own connection, use our VPN speed test and speed-loss calculator; the guide separates throughput retention, latency, route choice, protocol choice, and repeatability instead of collapsing them into one “fast” label.

Two patterns were unusually consistent. Among the seven providers where we had a usable WireGuard or WireGuard-derived result and a comparable OpenVPN result, the WireGuard-family option posted the higher download result in all seven sessions. Among the five providers with direct OpenVPN UDP and TCP results, UDP posted the higher download result in all five sessions. The consistency is interesting; the sample size is still seven and five providers, not the entire VPN market.

These are same-provider Miami comparisons from each documented session, not a seven-VPN speed ranking. Absolute Mbps should not be compared across providers because baseline speed, routing, test date, and implementation differ. VPN.ac WireGuard used the official WireGuard Windows client with VPN.ac profiles.

A concrete example: Surfshark in Miami

Surfshark gives us a particularly clean illustration because OpenVPN TCP, OpenVPN UDP, and WireGuard were each tested twice on the same Miami comparison route. Average ping barely moved, but download throughput changed dramatically: 30.81 Mbps on OpenVPN TCP, 291.00 Mbps on OpenVPN UDP, and 491.38 Mbps on WireGuard.

The high-volume comparison, kept honest

WireGuard vs. OpenVPN: the short version

WireGuard and OpenVPN are both serious VPN technologies, but they make different design choices. WireGuard is deliberately compact and uses a fixed modern cryptographic design with UDP transport. OpenVPN is older, highly configurable, and can operate over UDP or TCP. That flexibility makes OpenVPN valuable when compatibility matters, even when a WireGuard implementation is faster on an ordinary network.

Search demand for “WireGuard vs OpenVPN” is large enough that we plan to give this comparison its own dedicated evidence page. This broad protocol guide deliberately stops at the decision-level answer instead of stretching one section into a second article.

Same protocol, different transport

OpenVPN UDP vs. TCP: use UDP for speed, TCP for compatibility

OpenVPN’s own documentation says UDP is used for optimal performance while TCP is supported for compatibility with restrictive networks. That lines up with our test direction. In all five providers where we recorded a direct OpenVPN UDP-versus-TCP comparison, UDP had the higher download result.

PureVPN is a single-run early-cycle pairing; the other four provider rows use two runs per transport. These results do not mean TCP is “bad.” TCP can be the connection that works when UDP is filtered, and a working slower tunnel beats a fast protocol the network refuses to pass.

Names that need context

NordLynx, NordWhisper, Stealth, Lightway, Dausos, and other provider modes

Provider-specific protocols can be genuinely useful, but their names are not a technical specification. We only map them to a protocol family when the provider documents that relationship or our evidence supports it. If documentation is thin, we leave the internals unknown rather than reverse-engineering a marketing label from vibes.

Old does not automatically mean useful

PPTP, L2TP/IPsec, SSTP, and SoftEther

Legacy protocols still appear in search results and some VPN apps, but they should not all be treated as peer alternatives to WireGuard or OpenVPN. Microsoft’s current VPN protocol guidance says new Windows Server 2025 RRAS installations no longer accept PPTP and L2TP by default; SSTP and IKEv2 remain accepted. Microsoft also recommends against PPTP and L2TP there because of their security limitations.

Hands-on first, current docs second

Which protocols our reviewed VPNs exposed

The left side of this table is historical first-party evidence: what we actually saw in the paid Windows app during that provider’s review. The current-source note is a separate August 2026 documentation check. Keeping those two clocks separate matters because apps change faster than protocol definitions.

“Observed hands-on” is not a promise of current availability. Check your exact OS and app version before choosing a VPN specifically for one protocol.

How the 65 records were produced

How we tested VPN protocol performance

Protocol testing was one block inside a much larger paid review workflow. We purchased each service, installed and used the consumer apps, documented the protocol choices actually exposed, and ran protocol comparisons with the Speedtest by Ookla Windows app. A protocol speed block could take hours once reconnections, repeat runs, screenshots, notes, and troubleshooting were included.

We kept each protocol comparison inside one provider and one documented server route, usually Miami. That is the right level for claims such as “WireGuard was faster than OpenVPN in this Surfshark session.” It is not valid to look at VPN.ac’s 653 Mbps WireGuard average and CyberGhost’s 625 Mbps average and declare VPN.ac universally faster, because the baselines, dates, app/client path, routing, server load, and other conditions were not one laboratory-controlled cross-provider session.

Later reviews generally used two runs per protocol/mode. NordVPN and PureVPN were part of the earlier stage of the cycle and have single-run protocol comparisons. We keep those measurements because they are genuine recorded tests and useful directional evidence, while labeling their smaller repeat depth anywhere it affects interpretation. We do not silently manufacture a second run to make a table look symmetrical.

We also preserve implementation boundaries. VPN.ac’s WireGuard result came from the official WireGuard Windows client loaded with VPN.ac profiles because WireGuard was not integrated into the VPN.ac Windows app. Automatic/Smart is never treated as a known protocol unless the app or provider identifies what it selected. Failed connections, such as PrivateVPN’s OpenVPN modes and Turbo VPN’s V2Ray attempt, are recorded as connection observations rather than converted into fictional 0 Mbps speed tests.

For the full testing system, including Evidence Levels, baseline handling, speed-ranking formulas, leaks, streaming, app controls, support, cancellations, and refunds, read How We Test VPNs.

What the evidence can and cannot say

Limitations of this protocol comparison

We are proud of this dataset, and we also know exactly where its edges are. This was our first full paid VPN test cycle. As we finished the early reviews, the methodology became more structured, so there are small differences in repeat depth and secondary fields between providers. The underlying measurements remain intact and correspond to real VPN sessions; the improvement was in how consistently we repeated and documented later sessions, not in retroactively changing earlier results.

None of those limits makes a 491 Mbps WireGuard result turn into a 31 Mbps OpenVPN TCP result, or vice versa. They tell us how far the conclusion can travel. Our strongest conclusion is therefore a bounded one: in this paid test cycle, WireGuard-family options consistently led comparable OpenVPN download results, and OpenVPN UDP consistently led TCP in the five direct pairings we recorded.

Primary sources + our own evidence

Sources used for this VPN protocol guide

Technical claims use protocol projects, standards bodies, Microsoft documentation, and current provider documentation. Competitor articles were useful during SERP research for understanding page format, but they are not the factual authority behind the protocol claims published here.

Hands-on review cycle: May–July 2026. Technical/provider source recheck: August 6, 2026.

Common questions

VPN protocol FAQ