VPN Protocols Explained: WireGuard, OpenVPN and IKEv2 in Plain English

Open almost any VPN app and you will find a protocol setting with names like WireGuard, OpenVPN and IKEv2. The choice sounds technical, but it decides how your tunnel is built, how it reconnects, and how easily its security can be checked. A protocol is the set of instructions your device and the VPN server use to negotiate the encrypted connection: as Proton VPN’s protocol guide puts it, a VPN protocol is made up of a control channel, which handles key exchange, authentication and connection settings, and a data channel, which carries your actual traffic. The WireGuard project describes its own design goal as a VPN that is simple, fast and modern, using state-of-the-art cryptography. This guide explains the three protocols you are most likely to meet, in the context of our pillar explainer, VPNs Explained: What a VPN Does, What It Does Not, and When You Need One.

What a protocol actually does inside the tunnel

Three jobs happen every time you connect. First, the handshake: your device and the server authenticate each other and agree fresh encryption keys, so both ends can trust the tunnel and older sessions stay protected if a key is later exposed — a property called perfect forward secrecy, which Proton describes as using a unique set of keys for each session. Second, encryption: your traffic is wrapped inside encrypted packets, a process called encapsulation, so the network between you and the server sees only scrambled data addressed to the server. Third, transport: those packets travel over the internet using UDP, which sends without waiting for delivery checks, or TCP, which checks and resends. Proton notes that TCP’s checks take time and that running a VPN over TCP can slow a connection, while TCP on port 443 — the port HTTPS uses — can help a connection pass networks that block other traffic. Every protocol below is a different way of doing these three jobs.

WireGuard: the modern, deliberately small design

WireGuard was designed to be lean. Its technical whitepaper says it can be simply implemented for Linux in less than 4,000 lines of code, making it easily audited and verified, and the project site contrasts that with IPsec and OpenVPN/OpenSSL codebases so large that auditing them is an overwhelming task even for teams of experts. Instead of negotiating from a menu of ciphers, WireGuard is, in the whitepaper’s words, cryptographically opinionated: it intentionally lacks cipher agility and uses one fixed set of modern building blocks. The project’s protocol page lists them: ChaCha20 for symmetric encryption, authenticated with Poly1305; Curve25519 for key exchange; BLAKE2s for hashing; SipHash24 for hashtable keys; and HKDF for key derivation, with a handshake based on the Noise protocol framework. All WireGuard packets are sent over UDP. The design also handles movement well: the project explains that both client and server send data to the most recent endpoint they have authenticated, giving full IP roaming on both ends, and Proton notes WireGuard can maintain a connection while changing Wi-Fi networks. Simplicity is the trade-off as well as the strength: WireGuard does not try to be a toolkit, and features such as key distribution are deliberately left to other layers.

OpenVPN: the flexible, long-serving standard

OpenVPN is the veteran. OpenVPN’s own history says James Yonan started the open-source project in 2001, with the first open-source release in 2002, aiming for a tunnel program that was secure, free, fast and worked on standard TCP and UDP protocols. The Community Edition remains a free, open-source project maintained by a global community, as OpenVPN’s comparison page describes, while the company sells managed products built on the same protocol. Technically, Proton explains that OpenVPN uses SSL/TLS to handle its key exchange and control channel, and its own protocol for encapsulation and the data channel, with both channels encrypted. Its defining practical advantage is transport flexibility: it can run over UDP, normally the faster choice, or over TCP — including TCP port 443 — which makes it useful on restrictive hotel, office or school networks that block UDP or most non-web ports. The cost of that flexibility is complexity and size: a much larger, more configurable codebase, which is exactly the contrast WireGuard was built against. For setup in practice, see How to Use a VPN: A Step-by-Step Guide for Every Device.

IKEv2/IPsec: the built-in mobile specialist

IKEv2 is the key-exchange part of the IPsec suite. Proton explains that IKEv2 sets up a control channel by authenticating a secure channel between your device and the server using Diffie-Hellman key exchange, then establishes a security association — agreement on the same keys and algorithms — after which IPsec carries the data, encapsulating it with the Encapsulating Security Payload (ESP). Two properties make IKEv2 worth knowing. First, support: Proton notes IKEv2/IPsec is supported on Windows 7 and later, macOS 10.11 and later, and most mobile operating systems, so it often works without extra software concepts to learn. Second, reconnection: Microsoft documents that its VPN Reconnect feature uses IPsec tunnel mode with IKEv2, taking advantage of the IKEv2 mobility and multihoming extension, MOBIKE, to automatically re-establish a VPN connection when internet connectivity is restored. Proton makes the same point in user terms: IKEv2/IPsec supports the Mobility and Multihoming protocol, making it more reliable for people often switching between Wi-Fi networks. The downsides are that IPsec is complex, which Proton says can lead to poor implementation, and that IKEv2’s fixed ports make it easier to block than OpenVPN.

The legacy names to avoid: L2TP and PPTP

Two older names still appear in router menus and old tutorials. L2TP, the Layer Two Tunneling Protocol, was meant to replace PPTP, but Proton explains that L2TP adds no encryption of its own; it is normally paired with IPsec to handle encryption and authentication, which is why you see it written as L2TP/IPsec. Proton’s assessment is that its security improves on PPTP but that it is slower and less stable, and should only be considered if there are no other options. Its own apps refuse L2TP/IPsec connections because, in Proton’s judgement, their security does not meet its standards. PPTP is clearer still. Proton says PPTP has had numerous known security vulnerabilities since 1998, relies on Microsoft’s MPPE encryption using RC4 with a maximum of 128-bit keys, and concludes there is no reason to use it if you care about securing your data — noting that even Microsoft has advised its users to upgrade to other protocols. The EFF makes the same point more briefly, listing PPTP as an example of broken encryption to check against when choosing a VPN. If a service still offers PPTP as a feature, treat that as information about the service.

What “proprietary” protocols usually are

Many apps list a protocol with a brand name instead of WireGuard or OpenVPN. Read those names carefully rather than assuming either the best or the worst. Proton’s own Stealth protocol is a transparent example: Proton describes Stealth as based on WireGuard tunnelled over TLS, using the same encryption as WireGuard with an added layer of TLS encryption, built to work where regular VPN protocols are blocked. That is the common pattern — a provider-built variant that starts from WireGuard and adds obfuscation or transport changes for restrictive networks. A branded name is not automatically a problem. The questions to ask are whether the provider says what it is built on, whether the underlying protocol is a modern standard, and whether the code or design has been independently reviewed. A provider that will not say what its proprietary protocol is based on is asking for trust it has not earned. Mullvad’s recent history shows the industry direction: it removed OpenVPN from its desktop app in favour of WireGuard, adding WireGuard anti-censorship methods — including wrapping WireGuard traffic in UDP-over-TCP on port 443 — to replace the uses OpenVPN used to cover.

Which protocol should you pick?

For most readers, the answer in words is a short table. Default: WireGuard. Choose it for everyday use on home and mobile connections, because its small, fixed design is easy to audit, its handshake is a single round trip, and it roams between networks gracefully. Restrictive network: OpenVPN, especially over TCP on port 443, because that flexibility is what gets a tunnel out of networks that block UDP or unfamiliar ports — accept that it may be slower. Mobile stability inside an operating system’s built-in VPN support: IKEv2/IPsec, because MOBIKE was designed to re-establish the connection when you move between networks. Avoid: PPTP in all cases, and bare L2TP without IPsec in all cases. And if your app offers an automatic or “smart” setting, that is usually a selector that tries a modern protocol first and falls back when blocked — a reasonable default while you learn. Protocol is only one part of choosing, though; provider practices matter at least as much, which is why this guide pairs with How to Choose a VPN: A Practical Checklist That Cuts Through the Marketing.

What this means

For a US reader, the protocol menu matters less than the marketing suggests, and differently than it suggests. No protocol choice changes what your VPN provider can see, what it logs, or which country’s laws apply to it. WireGuard’s less-than-4,000-line design does not make a dishonest provider honest; it makes an honest provider’s software easier to check. That is the correct way to use protocol information: as evidence about engineering quality, not as a privacy guarantee. A provider that defaults to WireGuard or OpenVPN, publishes its apps as open source, and explains its branded variants the way Proton explains Stealth is showing you checkable work. A provider that hides behind a secret protocol name, or still promotes PPTP, is showing you the opposite. Compare the three modern options on the jobs they actually differ on — auditability, transport flexibility and reconnection — and the choice becomes simple rather than mysterious.

The comparison also has a daily, practical side. On a phone that moves between home Wi-Fi, office Wi-Fi and mobile data during a US commute, reconnection behaviour is worth more than any theoretical feature list: WireGuard’s roaming design and IKEv2’s MOBIKE both exist precisely for that pattern, which is why either is a sensible mobile default. On a restrictive network — a hotel, a hospital, a school or an employer that blocks unfamiliar traffic — OpenVPN over TCP port 443 is the option most likely to connect at all, because it can use the same port as ordinary secure web traffic. None of this requires benchmark charts. Beware any guide, including provider pages, that ranks protocols by precise speed percentages: performance depends on your device, your connection and the server’s load, and neither WireGuard’s nor OpenVPN’s official documentation asks you to choose on invented numbers. Choose the modern protocol that fits your network, keep it updated, and put the rest of your effort where it counts — a trustworthy provider, strong account passwords, ideally managed with the habits in our password manager security checklist, and software updates on every device.

Bottom line

For most people: WireGuard or OpenVPN, on a reputable provider’s modern default. Protocols are evidence of engineering quality, not a privacy guarantee — they never change what your provider can see or log.

Read Next

• VPNs Explained: What a VPN Does, What It Does Not, and When You Need One
• How to Use a VPN: A Step-by-Step Guide for Every Device

Sources

• WireGuard Project, “WireGuard: fast, modern, secure VPN tunnel” and “Protocol & Cryptography” — https://www.wireguard.com/ and https://www.wireguard.com/protocol/ (accessed 7 November 2026)
• Jason A. Donenfeld, WireGuard Project, “WireGuard: Next Generation Kernel Network Tunnel” (technical whitepaper) — https://www.wireguard.com/papers/wireguard.pdf (accessed 7 November 2026)
• Proton VPN, “Which VPN protocol is the best?” — https://protonvpn.com/blog/whats-the-best-vpn-protocol (accessed 7 November 2026)
• OpenVPN, “What is OpenVPN?” and “Access Server vs Community Edition Comparison” — https://openvpn.net/as-docs/what-is-openvpn/ and https://openvpn.net/access-server-or-community/ (accessed 7 November 2026)