VPN Protocols Compared

WireGuard was merged into the Linux kernel in 2020 and has quickly become the default recommendation for new VPN deployments. Its design philosophy is radical minimalism: the entire codebase is around 4,000 lines compared to OpenVPN's ~100,000. Fewer lines means fewer places to hide vulnerabilities, and a codebase small enough for independent security researchers to audit in full. It uses a fixed, modern set of cryptographic primitives — there are no negotiable cipher suites, which eliminates a whole class of downgrade attacks.

WireGuard operates at the kernel level and uses UDP. Handshakes are silent by default (the server doesn't respond to probes unless it recognises the initiating key), which makes WireGuard servers effectively invisible to port scanners.

OpenVPN has been the gold standard for open-source VPNs since 2001. It runs in userspace (not the kernel), uses TLS for the control channel, and can tunnel over either UDP or TCP. Running on TCP port 443 makes OpenVPN traffic visually indistinguishable from HTTPS, which is why it can pass through almost any firewall — including those that block WireGuard's UDP. This firewall traversal capability is OpenVPN's primary advantage over WireGuard for challenging network environments.

The large codebase and flexible cipher negotiation that made OpenVPN powerful also make it harder to audit and configure correctly. Misconfiguration (weak ciphers, missing --tls-auth, self-signed certs without verification) is a real risk.

IKEv2 (Internet Key Exchange version 2) is the key exchange protocol; IPsec handles the actual encryption. Together they form the VPN built natively into iOS, macOS, Windows, and Android — meaning no client software needs to be installed on mobile devices. IKEv2 has a MOBIKE extension that handles network changes (Wi-Fi → cellular) seamlessly, making it the traditional choice for mobile VPNs. Speed is competitive with OpenVPN and often better on mobile hardware that has IPsec acceleration.

L2TP (Layer 2 Tunnelling Protocol) has no encryption of its own — it is always paired with IPsec to provide security. The combination was widely used in the 2000s and early 2010s and is still found in many older routers and NAS devices. It is the slowest of the four: traffic is encapsulated twice (L2TP inside IPsec), doubling overhead. It also uses fixed UDP port 1701 which is easily blocked, and the pre-shared key authentication most consumer setups use is considerably weaker than certificate-based alternatives. There is no good reason to set up L2TP for a new deployment.