WireGuard vs OpenVPN vs IKEv2: Every VPN Protocol Explained in Plain English

Pick WireGuard for almost everything in 2026: it is the fastest mainstream VPN protocol, uses modern cryptography, and barely touches your battery. Switch to OpenVPN over TCP port 443 when a hotel, office or campus firewall blocks you, and lean on IKEv2 when your phone hops constantly between Wi-Fi and mobile data.

That is the short answer. The long answer is more interesting, because the protocol picker buried in your VPN app's settings is the single most consequential toggle in the whole product. It decides how fast your connection is, how long your battery lasts, whether the tunnel survives a train ride, and whether a restrictive network can spot and block you. This guide explains what each protocol actually does, how proprietary ones like NordLynx and Lightway relate to WireGuard, and exactly when to switch.

What a VPN protocol actually is, in plain English

A VPN protocol is the rulebook two computers follow to build an encrypted tunnel between them. It defines how your device and the VPN server prove their identities, agree on encryption keys, wrap your traffic in ciphertext, and keep the tunnel alive as networks change. Different rulebooks make very different trade-offs.

Every protocol has to solve the same four problems. First, the handshake: your device and the server must authenticate each other and agree on secret keys without anyone eavesdropping. Second, the data channel: once keys exist, every packet you send gets encrypted, transmitted, and decrypted on the other side. Third, transport: the encrypted packets ride inside either UDP (fast, connectionless) or TCP (reliable, but slower and prone to congestion feedback loops). Fourth, session management: what happens when your IP address changes, the connection drops, or keys need rotating.

The protocol is not the same thing as the encryption cipher. AES-256 and ChaCha20 are ciphers — the mathematical locks. The protocol is the entire procedure that decides which locks to use, when to change the keys, and how to move the locked boxes. That is why "military-grade AES-256 encryption" tells you almost nothing about whether a VPN is fast or reliable; the protocol around the cipher matters just as much.

One more piece of plain-English translation: when your app offers Automatic, it is simply choosing one of these protocols for you based on your network conditions, usually preferring the provider's fastest option and falling back to something more firewall-friendly when the first attempt fails.

WireGuard: the lean modern standard

WireGuard is the protocol that dragged VPNs out of the 2000s. Created by security researcher Jason A. Donenfeld and merged into the Linux kernel in version 5.6 in March 2020, it was designed around a radical idea: make the code so small that a single security researcher can audit all of it in a reasonable sitting.

The numbers behind that idea are striking. WireGuard's original kernel implementation weighed in at roughly 4,000 lines of code. OpenVPN's core is around 70,000 lines, and once you include OpenSSL and its other dependencies, the surface an auditor must reason about climbs into the hundreds of thousands. Less code means fewer places for bugs to hide, and WireGuard's cryptographic design has been formally analyzed by academic researchers using machine-checked proofs.

WireGuard also refuses to negotiate. Where OpenVPN lets administrators choose among dozens of cipher and handshake combinations, WireGuard hard-codes one modern suite: ChaCha20-Poly1305 for encryption, Curve25519 for key exchange, and BLAKE2s for hashing, arranged using the Noise protocol framework. If a weakness is ever found in one of those primitives, everyone updates to a new version together — there is no downgrade path for an attacker to exploit, and no way to misconfigure the crypto. In day-to-day use, three properties stand out:

• It connects almost instantly. The lightweight handshake typically completes in well under a second, versus the multi-second TLS negotiation classic OpenVPN performs.
• It is silent when idle. WireGuard sends nothing unless there is traffic to carry (an optional keepalive pings every 25 seconds if you need it), which is a large part of why it is gentle on phone batteries.
• It roams natively. Because sessions are tied to cryptographic keys rather than IP addresses, you can close your laptop on Wi-Fi and reopen it on a hotspot without renegotiating.

WireGuard has two genuine limitations. It runs only over UDP, so networks that block unfamiliar UDP traffic kill it instantly, and its distinctive handshake is easy for deep packet inspection to fingerprint. And in its vanilla form, a WireGuard server keeps each user's public key and last-seen endpoint address in memory — a privacy wrinkle commercial providers must engineer around, which is exactly where NordLynx enters the story below.

OpenVPN: the configurable veteran

OpenVPN is the elder statesman of the trio. Released by James Yonan in 2001, it has spent a quarter century being attacked, audited, patched and deployed on everything from enterprise firewalls to consumer routers. Nothing else in the VPN world has this depth of real-world battle testing, and that longevity is its core argument.

Technically, OpenVPN builds its tunnel on top of TLS — the same security layer that protects HTTPS websites — using the OpenSSL library for cryptography, most commonly with AES-256-GCM on the data channel. That heritage brings enormous flexibility: administrators can choose ciphers, authentication methods, certificate schemes and ports. Flexibility cuts both ways, though. A well-configured OpenVPN deployment is extremely secure; a sloppy one can be meaningfully weaker, and the sheer number of knobs is precisely how sloppy configurations happen.

OpenVPN's superpower is transport flexibility. It runs over UDP for speed, but it can also run over TCP on port 443 — the exact port and transport your browser uses for HTTPS. To a firewall doing casual filtering, an OpenVPN-over-TCP-443 session looks a lot like someone browsing a secure website. That is why it remains the go-to protocol on hotel networks, university campuses, corporate guest Wi-Fi and other environments that block conventional VPN traffic. Sophisticated deep packet inspection can still distinguish it, which is where obfuscation layers come in — more on that later.

Its historical weakness was speed. Classic OpenVPN processes every packet in user space, forcing constant, expensive copying between the operating system's kernel and the application. The project answered in 2023 with Data Channel Offload (DCO), shipped in OpenVPN 2.6, which moves encryption and packet handling into a kernel module the way WireGuard always did. OpenVPN and early adopters report throughput improvements ranging from roughly 2x to 10x with DCO, and in April 2025 the ovpn kernel module was accepted into the mainline Linux kernel, shipping by default from version 6.16. The catch: both your client and your provider's servers need DCO-aware builds, and much of the commercial VPN fleet still runs the classic path, so WireGuard's speed advantage remains real in practice.

IKEv2/IPsec: the mobile specialist

IKEv2 — Internet Key Exchange version 2 — is the protocol your iPhone probably already speaks natively. Developed jointly by Microsoft and Cisco and standardized by the IETF, it handles the handshake and key management, then hands the actual packet encryption to the IPsec suite built into your operating system's kernel.

That native integration is IKEv2's defining advantage. Because iOS, macOS and Windows all ship first-party IKEv2/IPsec support, the encryption work happens deep inside the OS rather than in a third-party app shuttling packets around. The result is low CPU overhead, respectable speeds — generally faster than classic OpenVPN, a step behind WireGuard — and excellent battery behavior on phones.

Its signature feature is MOBIKE, the IKEv2 Mobility and Multihoming extension standardized in RFC 4555. MOBIKE decouples the encrypted session from your IP address, so when your phone drops off your home Wi-Fi and picks up 5G mid-video-call, the tunnel simply updates its endpoint and carries on rather than renegotiating from scratch. Before WireGuard arrived with equivalent roaming, this made IKEv2 the undisputed protocol for commuters, and it is still the reason many apps default to it on iOS.

The trade-offs: IKEv2 communicates over UDP ports 500 and 4500, which are among the first things restrictive firewalls block, so it is a poor choice on hostile networks. And while open-source implementations like strongSwan exist, many deployments rely on closed OS-level code, which sits awkwardly with users who want every layer inspectable. Cryptographically, a properly configured IKEv2/IPsec tunnel with AES-256 remains thoroughly solid in 2026.

PPTP, L2TP/IPsec and SSTP: the legacy tier

Three older names still haunt VPN settings menus and router firmware, and it is worth being blunt about them. One is actively dangerous, one is merely obsolete, and one is a niche Windows tool that modern protocols have replaced. None of them belongs in your daily rotation, whatever your use case.

• PPTP dates to the late 1990s and is broken — not "aging," broken. Researchers demonstrated in 2012 that its MS-CHAPv2 authentication could be cracked within about a day, and tooling has only improved since. Apple removed PPTP support from iOS and macOS back in 2016. A service advertising PPTP for anything beyond retro-computing is a red flag.
• L2TP/IPsec is not insecure when configured correctly, just outclassed. It wraps your data twice — L2TP encapsulation inside IPsec encryption — which wastes CPU and bandwidth, and it uses fixed ports that firewalls block trivially. Every job it does, IKEv2/IPsec does better.
• SSTP is Microsoft's TLS-based tunnel from the Windows Vista era. Running over TCP 443 gives it decent firewall evasion, but it is closed source, effectively Windows-only, and offers no meaningful advantage over OpenVPN in TCP mode.

Head-to-head: speed, security, battery and firewall evasion

Now for the direct comparison. The honest summary is that there is no single champion — WireGuard wins most categories, but the margins and the exceptions are exactly what should drive your choice. Here is how the big three separate on the four dimensions that matter most in real-world use.

Raw speed

WireGuard wins, usually by a lot. In widely cited gigabit-line lab tests, WireGuard sustains roughly 940-960 Mbps where classic OpenVPN over UDP manages about 480 Mbps on identical hardware. Real-world tests through commercial VPN servers typically show WireGuard 20-40% faster than OpenVPN, with IKEv2 landing between them. Connection setup shows an even bigger gap: WireGuard's handshake completes in milliseconds, while OpenVPN's TLS negotiation can take several seconds. DCO is closing the throughput gap where it is deployed, but you should verify what your own connection delivers — our VPN speed test explains how we measure this across providers. Protocol overhead also compounds with distance: a difference you barely notice connecting to a nearby city becomes very visible tunneling to another continent.

Security

This one is closer than the marketing suggests. WireGuard's tiny, formally analyzed codebase and fixed modern cryptography make it the easier protocol to trust by design. OpenVPN counters with a quarter century of adversarial history and repeated independent audits; configured with current defaults, it has no known practical breaks. IKEv2/IPsec is cryptographically sound, with the caveat that you are often trusting your OS vendor's closed implementation. The practical ranking for most people: all three are secure; WireGuard is the most auditable; OpenVPN is the most proven; misconfiguration, not protocol choice, is the realistic risk.

Battery life

On phones, WireGuard and IKEv2 are the clear winners, for different reasons. WireGuard stays completely silent when no traffic flows, so an idle tunnel costs almost nothing overnight. IKEv2 benefits from running inside the OS kernel and from MOBIKE's cheap reconnections, avoiding the expensive renegotiations that drain batteries during network handoffs. OpenVPN is the heaviest option: user-space packet processing plus a chattier control channel means measurably more CPU wake-ups across a day of mobile use. If your VPN app noticeably warms your phone, checking the protocol setting should be your first move.

Firewall evasion

Here the ranking flips completely. OpenVPN over TCP port 443 is the strongest standard option, because it shares a port and transport with all HTTPS traffic. WireGuard is the weakest: UDP-only, a well-known default port, and a handshake signature that deep packet inspection systems fingerprint easily. IKEv2's reliance on UDP 500 and 4500 makes it similarly fragile on locked-down networks. Against serious DPI — national firewalls, aggressive corporate filters — even OpenVPN-over-443 gets caught, and you need an obfuscation layer: providers wrap tunnels in genuine TLS, or offer Shadowsocks-style stealth transports that make VPN packets indistinguishable from ordinary web browsing.

Lightway, NordLynx and the proprietary protocols

Open any major VPN app and you will find names that appear in no networking textbook: NordLynx, Lightway, Catapult Hydra, NordWhisper, Stealth. The pattern to understand is that these are not exotic new cryptography — they are either WireGuard with provider-specific fixes, or independent lean protocols built on the same design philosophy WireGuard proved out.

NordLynx: WireGuard with a privacy patch

NordLynx, introduced by NordVPN on Linux in 2019 and rolled out to all its major apps by spring 2020, is WireGuard's data plane wrapped in a solution to the privacy wrinkle mentioned earlier. Vanilla WireGuard expects the server to hold a table mapping each user's public key to an assigned internal IP — uncomfortable territory for a no-logs service. NordLynx interposes a double network address translation (double NAT) system: one interface gives every connected user the same local IP address, hiding individuals in the crowd, while a second dynamically assigns a unique session IP that exists only for the lifetime of the connection, with nothing identifiable stored on the server. The speed is WireGuard's; the bookkeeping is redesigned. Other providers solve the same problem differently — some wipe idle peer data on a timer — but the tunnel underneath all of these is WireGuard.

Lightway: ExpressVPN's independent take

Lightway is frequently mislabeled a WireGuard variant; it is not. ExpressVPN built it from scratch as its own minimal protocol, with a core small enough to audit quickly, published as open source, and using the wolfSSL cryptography library rather than WireGuard's Noise construction. Two things make it notable in 2026. First, unlike WireGuard it natively supports both UDP and TCP modes, so it degrades gracefully on networks that choke UDP. Second, ExpressVPN rewrote the entire protocol in Rust — a memory-safe language that eliminates the buffer-overflow class of vulnerabilities endemic to C — announcing the rewrite in February 2025 backed by two independent security audits from Cure53 and Praetorian. A month earlier it had swapped Lightway's post-quantum key encapsulation to ML-KEM, the NIST-standardized algorithm designed to resist future quantum-computer attacks, replacing the earlier Kyber implementation it had run since 2023.

The rest of the field

Hotspot Shield's Catapult Hydra is a proprietary speed-focused transport that predates WireGuard's rise. NordVPN added NordWhisper in January 2025, a web-tunnel protocol built specifically to look like ordinary browser traffic on restrictive networks. Proton VPN's Stealth wraps WireGuard inside TLS for censorship circumvention. Most other providers' "custom" options are simply their own WireGuard implementations under a marketing name. The question to ask of any proprietary protocol is not "is it novel?" but "what specific problem does it solve, and is the code published?" — the answers separate genuine engineering from rebranding.

Which protocol should you pick? Use case by use case

Protocol choice is situational, and the good news is that switching takes about ten seconds. Rather than crowning one winner, match the protocol to what you are actually doing and where you are connecting from. These pairings cover the overwhelming majority of situations you will meet in practice.

• Everyday browsing and downloads: WireGuard (or NordLynx/Lightway in apps that offer them). Maximum speed, instant connections, no downsides on a normal home network.
• Streaming in HD and 4K: WireGuard-class protocols again — sustained throughput is what prevents buffering, and fast handshakes make server-hopping painless. Our guide to the best VPNs for streaming covers which providers pair fast protocols with reliable unblocking.
• Gaming and video calls: WireGuard, for the lowest added latency and jitter; its lean packet processing adds the fewest milliseconds to each round trip.
• Phones and commuting: IKEv2 or WireGuard. Both survive Wi-Fi-to-cellular handoffs gracefully; try each for a day and keep whichever your battery prefers.
• Hotel, campus, office or in-flight Wi-Fi that blocks VPNs: OpenVPN over TCP 443 first; if that also fails, your provider's obfuscated or stealth mode.
• Routers and whole-home coverage: WireGuard where the firmware supports it, OpenVPN as the universal fallback — our VPN router guide walks through the firmware options, and the same logic applies when you set up a VPN on Android TV.
• Maximum-scrutiny privacy: WireGuard from a provider that has engineered around endpoint retention, or OpenVPN if you value the longest audit trail. Protocol is only one layer here — jurisdiction, logging policy and infrastructure matter more, which is what our VPN privacy guide digs into.

How to switch protocols in your VPN app

Every mainstream VPN app exposes the protocol setting, and changing it is the highest-leverage troubleshooting step most users never try. The exact menu path varies by provider, but the shape is identical everywhere, and you can revert just as easily if the experiment goes badly. Here is the generic procedure.

1. 1Disconnect from any active VPN session — some apps grey out protocol options while connected.
2. 2Open Settings or Preferences, then find the section called Protocol, Connection, or VPN Settings.
3. 3Select the protocol you want to test. In ExpressVPN this lives under Options > Protocol (Lightway UDP/TCP, Automatic); in NordVPN under Settings > Connection > VPN protocol (NordLynx, OpenVPN UDP/TCP); in Surfshark under Settings > VPN settings > Protocol (WireGuard, OpenVPN, IKEv2); in Proton VPN under Settings > Protocol (WireGuard variants, OpenVPN, Stealth).
4. 4Reconnect to your usual server and confirm the app reports the new protocol as active.

Two pieces of advice for the experiment. First, change one variable at a time — same server, same time of day — or you will not know whether the protocol or the network moved your numbers. Second, verify rather than assume: run a before-and-after speed measurement, then confirm the tunnel is protecting you by checking for a DNS leak and a WebRTC leak, since a protocol switch occasionally resets app-level protections. If a protocol refuses to connect at all, that is diagnostic information too: it usually means your network is filtering that protocol's ports, and the firewall-evasion ladder above tells you what to try next.

A final note on Automatic mode: it is a sensible default, and providers have become good at picking well. But it optimizes for connecting successfully, not necessarily for your priority — so if you specifically care about speed, battery, or stealth, an explicit choice beats the algorithm.

The bottom line

The protocol wars have a clear shape in 2026. WireGuard's design won: every serious provider now ships either WireGuard itself, a patched flavor of it like NordLynx, or an independent protocol like Lightway built on the same minimal, modern-cryptography philosophy. OpenVPN has retired from the speed race but remains irreplaceable as the firewall-friendly, quarter-century-audited fallback. IKEv2 keeps its niche wherever phones roam. Set WireGuard as your default, memorize the switch to OpenVPN TCP for hostile networks, and you have extracted essentially all the value that settings menu has to offer.