Disclosure: VPNFin is reader-supported. If you buy a VPN through links on this page, we may earn a commission at no extra cost to you. This never affects our ratings — here’s our full disclosure.
VPN protocols decide how your device and the VPN server build the tunnel. Three open standards dominate: WireGuard, which is fast and light; OpenVPN, which is flexible and works on many routers; and IKEv2, which reconnects quickly when you switch networks. Providers add their own on top: NordVPN’s NordLynx and NordWhisper, ExpressVPN’s Lightway, Proton’s Stealth, VyprVPN’s Chameleon and Astrill’s StealthVPN. Some are dropping older ones: Mullvad removed OpenVPN on 15 January 2026. Our guide to Mullvad and OpenVPN covers removed in January, and how to move to WireGuard.
This guide explains each protocol, what it suits and how to choose.
WireGuard
WireGuard uses ChaCha20 encryption and a small codebase. VPNSmith measured it at about 3 to 5% CPU on a phone against 12 to 18% for OpenVPN, which makes it lighter on battery. Our WireGuard vs OpenVPN guide compares them.
OpenVPN
OpenVPN runs over UDP or TCP and works on many routers, which suits manual setups. It is heavier than WireGuard. Proton removed it from its Apple apps, and Mullvad dropped it entirely in January 2026.
IKEv2
IKEv2 handles network changes well, which suits phones moving between Wi-Fi and mobile data. Proton removed it from its macOS and iOS apps over concerns about Apple’s implementation. Our IKEv2 vs WireGuard guide compares the two.
Proprietary VPN Protocols
NordLynx is NordVPN’s WireGuard-based protocol, as our NordLynx vs WireGuard guide explains. ExpressVPN’s Lightway uses AES-256 with post-quantum key exchange by default. Proton’s Stealth, VyprVPN’s Chameleon and Astrill’s StealthVPN disguise traffic on networks that block VPNs.
Choosing a Protocol
Leave the app on automatic, such as Proton’s Smart Protocol, for everyday use. Pick WireGuard or a WireGuard-based option for speed and battery. Switch to an obfuscated protocol on networks that block VPNs, and to OpenVPN for routers that need it.
VPN Protocols on Routers
Routers support whatever their firmware offers. Proton’s router guides mostly use WireGuard, and older models may only run OpenVPN, as our Proton VPN router guide notes.
VPN Protocols and Battery
On phones, WireGuard is the lighter choice. TheBestVPN measured about 2% battery over two hours of streaming on WireGuard against about 7% on OpenVPN TCP. Our VPN battery guide covers the tests.
UDP or TCP
UDP is faster; TCP gets through some restrictive networks more reliably. If a connection fails on UDP, try TCP before switching protocol.
Post-Quantum Protocols
Some protocols now add post-quantum key exchange: ExpressVPN’s Lightway by default and NordVPN’s NordLynx as an option. Our post-quantum VPN guide explains why.
Is One of the VPN Protocols Most Secure?
WireGuard, OpenVPN and IKEv2 are all considered secure when implemented well. The weaker points are leaks and logging, not the protocol choice among these three.
Protocols and Streaming
Netflix checks address lists, route origin and DNS, BitsFromBytes reports, so switching server helps more than switching protocol.
Protocols and Gaming
For games, low latency matters most. WireGuard-based protocols usually add the least delay; test with a nearby server.
Changing Protocols
Most apps let you pick a protocol in settings. On macOS, Proton asks for a network extension before you change it, its support pages note. After switching, reconnect and test speed.
Quick Rule
Everyday: automatic. Phone battery: WireGuard. Blocked network: obfuscated. Router: OpenVPN if WireGuard is missing. Never PPTP.
Lightway and NordLynx
Lightway is ExpressVPN’s own protocol, and NordLynx is NordVPN’s build on WireGuard that adds a double NAT system, assigning internal addresses per session instead of keeping a fixed one per user, our NordLynx guide explains.
Obfuscated Protocols in Practice
Stealth-type protocols wrap VPN traffic to look like ordinary encrypted web traffic. They are slower, Proton notes for Stealth, so use them only where networks block standard protocols.
Testing a Protocol
Switch, reconnect, then run a speed test and a leak test. Our DNS leak guide covers the second.
Protocols on Free Plans
Free plans usually offer the same main protocols as paid ones. Proton’s free plan includes Stealth, Toolradar notes, which few free plans offer.
Who Needs to Care
Most people can leave the setting alone. Travellers to restrictive countries, router builders and anyone fixing battery or speed problems benefit from knowing the options.
Protocols on TVs
Some TV apps offer fewer protocol choices than their desktop versions. If a TV connection struggles, check whether the app lets you switch, or use a router running WireGuard instead, which also covers every other device at home.
Support
If no protocol connects on a network, contact the provider’s support with the network type and country; they may recommend a specific obfuscated server.
Retired Protocols
PPTP is obsolete and should not be used for privacy. L2TP survives in some manual setups but most providers have moved on to WireGuard and their own protocols.
Encryption Under the Protocol
Each protocol pairs with ciphers such as AES-256-GCM or ChaCha20. Our VPN encryption guide explains the layers.
How We Research
This page draws on our protocol guides, VPNSmith’s 2026 measurements, Proton’s support note on IKEv2 and OpenVPN, our Mullvad tables and provider protocol pages. We cross-checked these sources against each other, and where they conflict or something can’t be verified, we say so in the text rather than guessing. We checked time-sensitive figures, including prices in US dollars, on 8 October 2026. The main source we relied on is VPNSmith’s protocol comparison. Our full approach lives on the About Us page.
VPN Protocols FAQ
WireGuard and WireGuard-based protocols, in most tests.
Obfuscated ones, such as Proton’s Stealth or NordWhisper.
For routers and manual setups; apps increasingly prefer WireGuard.
NordVPN’s WireGuard-based protocol.
Yes; it is obsolete.
The Verdict
VPN protocols matter less than they once did: WireGuard suits most uses, obfuscated protocols handle blocked networks and OpenVPN remains for routers. Leave the app on automatic unless you have a reason.