VPN Protocols Explained

A VPN protocol defines how your device creates and maintains the encrypted tunnel to the VPN server. Different protocols make different trade-offs between speed, security, compatibility, and resistance to censorship. This guide covers every major protocol in use today.

Protocol Comparison Overview

Protocol	Speed	Security	Censorship resistance	Battery use	Status
WireGuard	Fastest	Excellent	Moderate (UDP only)	Low	Recommended
OpenVPN UDP	Good	Excellent	Moderate	Moderate	Recommended
OpenVPN TCP	Moderate	Excellent	High (port 443)	Higher	Use for censorship bypass
IKEv2/IPSec	Fast	Very good	Lower (fixed ports)	Low	Good for mobile
L2TP/IPSec	Slow	Good	Low	Moderate	Avoid if possible
SSTP	Moderate	Good	High (HTTPS port)	Moderate	Windows-only, rarely needed
PPTP	Fast	Broken	Low	Low	Never use

Proprietary Protocols

Several providers have developed their own protocols built on top of established cryptographic foundations:

Protocol	Provider	Based On	Key Advantage
NordLynx	NordVPN	WireGuard	Double NAT preserves no-logs guarantee
Lightway	ExpressVPN	wolfSSL	Very fast reconnects, open-sourced in 2021
Stealth	ProtonVPN	Obfuscated WireGuard/OpenVPN	Bypasses deep packet inspection
Catapult Hydra	Hotspot Shield	DTLS/TLS	Proprietary speed optimisations

Which Protocol Should You Use?

• Default choice: WireGuard - Fastest and modern.
• Restricted network (school, corporate, hotel): OpenVPN TCP on port 443 - Mimics HTTPS and is nearly unblockable.
• Mobile device: WireGuard first; IKEv2 as fallback for seamless network handoffs.
• Censorship-heavy country: Provider's obfuscated mode (Stealth, obfs4) or OpenVPN TCP 443.
• Legacy hardware: OpenVPN (runs on very old kernels and embedded routers).
• Never use: PPTP - It uses RC4 encryption which was broken in the early 2000s.

For WireGuard-specific details, see What Is WireGuard?. For OpenVPN specifics, see What Is OpenVPN?. Test your VPN setup with our VPN Leak Test or check our full VPN Guide hub.

Frequently Asked Questions

Which VPN protocol should I actually use?

WireGuard, or your provider's WireGuard-based variant such as NordLynx or Lightway, for almost everything. Fall back to OpenVPN only when you need TCP mode to get through a restrictive firewall, and to an obfuscated protocol only on networks that actively block VPNs.

Is IKEv2 still a reasonable choice?

Yes, particularly on mobile. IKEv2 handles network switching — Wi-Fi to cellular and back — more gracefully than most alternatives, which is why it remains the default in several iOS clients.

Should I avoid PPTP and L2TP?

Avoid PPTP entirely; its encryption has been broken for years. L2TP/IPSec is not broken but is slower than WireGuard with no compensating advantage, so there is rarely a reason to pick it today.

Does the protocol affect whether my VPN gets blocked?

Significantly. Standard WireGuard and OpenVPN have recognisable traffic signatures that Deep Packet Inspection can fingerprint. Obfuscated protocols disguise the traffic as ordinary HTTPS, which is what gets through restrictive networks.

How we evaluate VPNs: every provider on this site is judged on audited no-logs claims, leak-test results, protocol support, jurisdiction, and price transparency — never on commission. Our full evaluation method →

ⓘ Affiliate disclosure: Some links to VPN providers in these guides are affiliate links - We may earn a commission at no extra cost to you. This never affects rankings or evaluations.

Last updated: 2026-08-02