VPN Protocols Explained: WireGuard, OpenVPN and IKEv2

A VPN protocol is the agreed set of rules that decides how your device and the VPN server build the tunnel, verify each other, and encrypt the traffic that flows through it. Think of it as the rulebook for the connection: same goal every time — a secure tunnel — but different rulebooks make different trade-offs between speed, security and reliability.

You rarely have to choose a protocol yourself — good apps pick a sensible default. But knowing the names helps you tell a modern VPN from one still leaning on decades-old tech.

This is a concept-level tour, not a buyer's shootout: the aim is to understand what each protocol is, not to rank providers on raw speed. If you want the mechanism the protocols are implementing, see how a VPN works.

WireGuard

WireGuard is the modern default at most VPNs: it's lean, fast, and built on a small, current set of cryptography. Its big idea is simplicity — it's a fraction of the size of older protocols, which makes it easier to audit and quick to connect. The main caveat is a design detail: WireGuard was built to assign each client a fixed internal address, so privacy-focused providers add their own layer (things like extra address translation) to avoid tying that address to you over time.

OpenVPN

OpenVPN is the mature, battle-tested workhorse. It's older and heavier than WireGuard, but it's been scrutinised for years, it's very flexible, and it can run over TCP to blend in with normal web traffic when a network is trying to block VPNs. It uses the widely trusted OpenSSL library for its encryption. For many years it was the gold standard, and it's still an excellent, safe choice — just typically a little slower than WireGuard.

IKEv2/IPsec

IKEv2 (paired with IPsec) is the protocol you'll often meet on phones. Its strength is stability when you're moving: it reconnects quickly and handles switching between Wi-Fi and mobile data smoothly, thanks to a feature called MOBIKE. It's fast and secure, and it's built into many operating systems, which is why it's a common mobile default.

The older ones: L2TP and PPTP

L2TP/IPsec and PPTP are legacy protocols you'll still see listed, especially on routers and older systems. PPTP in particular is considered obsolete and insecure — its encryption has been broken for years — so it should be avoided for anything private. L2TP/IPsec is more secure than PPTP but slower and dated compared with today's options. As a rule, if a modern app defaults to WireGuard or OpenVPN, there's no reason to reach for these.

Which protocol should you use?

For almost everyone, the right answer is: leave it on "automatic," which today usually means WireGuard, and switch to OpenVPN (TCP) only if a restrictive network is blocking the connection. The protocol matters far less than whether the provider is trustworthy and audited. If you're curious what the protocols are protecting the traffic with, read VPN encryption basics; if you're still assembling the fundamentals, the guide to what a VPN is puts it in context.

Protocol versus cipher: they're not the same

A common mix-up is treating the protocol and the encryption as one thing. They're related but distinct: the protocol is the overall framework for building and running the tunnel — the handshake, the packet format, the negotiation — while the cipher (like AES-256 or ChaCha20) is the specific maths that scrambles the data inside it. WireGuard, for instance, pairs its framework with the ChaCha20 cipher; OpenVPN typically uses AES. You can think of the protocol as the vehicle and the cipher as the lock on the doors. We cover the lock in VPN encryption basics; the protocol is everything around it.

This distinction matters when you read marketing copy. A provider might boast about "AES-256 encryption" while running an ageing protocol, or use a modern protocol with strong defaults you never have to think about. Both parts need to be sound, and in practice the reputable providers get both right — which is why the protocol choice rarely needs your attention.

Obfuscation: protocols that hide they're VPNs

Some networks actively try to detect and block VPN traffic — restrictive countries, some workplaces, and certain streaming services among them. To get through, providers offer obfuscation: a layer that disguises VPN traffic so it looks like ordinary encrypted web browsing. This often takes the form of a "stealth" mode built on OpenVPN over TCP on port 443 (the same port normal HTTPS uses), or a provider's own wrapper around WireGuard.

Obfuscation trades a little speed for the ability to connect at all where plain VPN protocols are blocked, so it's a feature you turn on only when you need it. If you're somewhere a normal connection works fine, leave it off. If a VPN suddenly won't connect on a particular network, an obfuscated or stealth mode is usually the first thing to try — it's the difference between a tunnel that's blocked and one that blends in.

The trade-off is worth stating plainly: obfuscation adds processing and often routes over slower TCP, so it's the right tool for access, not speed. On an open network you'll get better performance from a plain modern protocol, which is exactly why apps keep obfuscation as an option rather than an always-on default.