Disclosure: VPNFin is reader-supported. If you buy a VPN through links on this page, we may earn a commission at no extra cost to you. This never affects our ratings — here’s how we research.
Every provider now advertises WireGuard, and the implication is that faster also means better. On speed that is true. On privacy it is a claim the protocol itself does not make.
WireGuard’s own design documentation states that anonymity was not a goal. It was built for site-to-site tunnels between parties who already know each other — a company office connecting to a data centre, not a stranger hiding from a network. On that model, storing a table of who is connected is sensible rather than dangerous.
Commercial VPNs adopted it anyway, then had to solve that problem themselves. This WireGuard vs OpenVPN guide covers what each protocol actually is, what providers added on top, and which one to select in the app.
The Short Answer
Use WireGuard for almost everything. Faster, lighter on battery, and every reputable provider has addressed its privacy limitation.
Switch to OpenVPN when the network fights you. It can run over TCP on port 443, which looks like ordinary HTTPS traffic and gets through firewalls that block everything else.
And check what your provider did about the peer table before assuming WireGuard alone means privacy. The good ones explain it; the rest do not mention it.
What Each One Is
OpenVPN has existed since 2001. It uses TLS — the same mechanism that secures HTTPS — for its control channel, runs on essentially every platform and router, and has been audited repeatedly over two decades. Vulnerabilities have been found and patched, which is what a maintained project looks like.
WireGuard is newer and deliberately narrow. Its cryptography is fixed: ChaCha20 for encryption, Poly1305 for authentication, Curve25519 for key exchange, BLAKE2s for hashing. No options, no negotiation, no way to configure it badly. If one of those ever falls, the protocol version gets replaced rather than reconfigured.
The speed difference comes from where they run. WireGuard operates in kernel space; OpenVPN runs in user space, which costs it performance. That is architectural rather than a matter of tuning.
The Peer Table Problem
This is the part worth understanding, because it changes what a provider’s protocol list tells you.
WireGuard maps public keys to allowed IP addresses, and that mapping stays on the server until it reboots. In a company network that is exactly right: the server should know which office is connected.
On a commercial VPN it is a record of who you are and when you connected. Kept on a server, it sits awkwardly beside a no-logs policy, and a WebRTC leak could expose the assigned address separately.
⚠️ This is a design trade-off rather than a flaw. WireGuard’s known-limitations documentation says plainly that the protocol was built for trusted networks with persistent identities.
Providers solved it in two distinct ways.
Double NAT — NordVPN and Proton VPN. Two network interfaces per user. The first assigns every user on a server the same local address, so nothing distinguishes you in the peer table. The second assigns a dynamic address per tunnel so packets still find their way back. Nothing identifying is stored, and the dynamic address exists only while the session runs. NordVPN calls its version NordLynx.
Timed removal — Mullvad and OVPN. Rather than masking the entry, they delete it. If no handshake occurs for 180 seconds, the peer is removed and re-added on reconnection. The record exists for three minutes at most. Our Mullvad review covers how that fits its wider architecture.
⚠️ Both work. What matters is that your provider did one of them. A provider that lists WireGuard without explaining how it handles the peer table is worth a question, and reputable ones publish the answer.
Speed: WireGuard, and It Is Not Close
Independent testing consistently puts WireGuard-based protocols ahead, and the direction holds across setups even when the size of the gap varies. NordVPN reports its own speeds exceeding 800 Mbps on NordLynx, which is a provider figure rather than an independent one — though CNET’s 2.9% average loss points the same way from outside.
The battery difference matters more on phones than the throughput does. WireGuard’s lean implementation uses noticeably less processing power, which shows up as hours rather than percentages.
⚠️ On a phone or a home connection you will probably notice neither. How much speed you actually lose puts the percentages in context: most connections are slower than the point where protocol choice becomes visible. Our speed ranking shows the same effect between providers — the published figures differ more than the products do.
Where OpenVPN Still Wins
One property keeps it alive, and it is a good one.
OpenVPN can run over TCP on port 443. That is the port HTTPS uses, so the traffic resembles ordinary web browsing rather than a VPN tunnel. Networks that block UDP wholesale — hotels, schools, offices, censored countries — frequently let it through, which is why it is the first thing to change on a hotel network.
WireGuard is UDP only. Where UDP is blocked, it simply does not connect. Providers work around this with separate obfuscation protocols rather than by changing WireGuard: Proton’s Stealth, Surfshark’s Camouflage, NordWhisper, Avast’s Mimic.
OpenVPN also runs on almost anything. Older routers, corporate systems and devices that predate WireGuard support it, which is why our router guide still treats it as the fallback — and why it remains the route for an Apple TV too old to run an app.
⚠️ That advantage is narrowing. Mullvad retired OpenVPN entirely in January 2026, the first major provider to do so, which leaves owners of OpenVPN-only routers without an option there.
The Protocols Providers Built Themselves
Half the names in a modern VPN app are neither WireGuard nor OpenVPN, and they divide into two groups.
Built on WireGuard: NordLynx is WireGuard with double NAT. Proton VPN’s implementation takes the same approach.
Built from scratch: ExpressVPN’s Lightway uses wolfSSL rather than borrowing from either, is open source, and offers post-quantum protection. Surfshark’s Dausos is the most ambitious of the group — AEGIS-256X2 encryption, a separate tunnel per user, post-quantum key exchange, audited by Cure53 in April 2026.
And one that cannot be checked. Hotspot Shield’s Catapult Hydra is proprietary and closed, so its security properties rest on the company’s own account of them.
⚠️ A proprietary protocol name is not a reason to choose a provider. It is a reason to ask whether anyone outside the company has examined it.
Which One Should You Actually Select?
Most apps default to WireGuard or the provider’s version of it, and that default is correct. Change it in three situations.
The connection will not establish at all. Try OpenVPN TCP — a blocked UDP port is the most common cause, as our troubleshooting guide covers.
You are on a network that inspects traffic. OpenVPN TCP on 443 blends in; an obfuscation protocol blends in better still. On a Mac there is a third reason to switch: IKEv2 resolves a known conflict with Apple’s own services.
Your router only speaks OpenVPN. Check before switching provider, particularly if Mullvad is on your shortlist.
⚠️ Protocol choice matters less than provider choice. A VPN that keeps logs will keep them whichever protocol you select, and what a VPN actually hides does not change with the tunnel.
How We Research
This guide draws on WireGuard’s published design and known-limitations documentation, provider explanations of their own implementations including NordVPN’s account of double NAT and Mullvad’s of timed peer removal, published analyses of protocol behaviour from named outlets, and our own reviews of the providers named — cross-checked and verified at publication. We don’t run our own speed tests. Where a figure comes from a provider rather than an independent tester, as NordVPN’s 800 Mbps claim does, we say so in the sentence rather than in a footnote. Our full approach lives on the About Us page.
WireGuard vs OpenVPN FAQ
WireGuard, consistently. It runs in kernel space while OpenVPN runs in user space, which is an architectural difference rather than a matter of configuration. The size of the gap varies by network and server, but the direction holds across independent testing. WireGuard also uses noticeably less battery on phones.
The base protocol stores a mapping of your key to an internal address on the server until it reboots, because it was designed for networks where identities are known and persistent. Commercial providers add a layer to prevent that. NordVPN and Proton VPN use double NAT; Mullvad and OVPN delete the entry after three minutes without a handshake.
NordVPN’s implementation of WireGuard with a double NAT system on top. Two network interfaces mean no identifying address is stored against your session, which resolves the peer table concern while keeping WireGuard’s speed. Proton VPN takes the same approach without giving it a separate name.
When the network blocks UDP. OpenVPN can run over TCP on port 443, the port HTTPS uses, so it resembles ordinary browsing and passes firewalls that stop everything else. It is also the fallback for older routers and devices that predate WireGuard support.
It cannot be independently verified, which is the issue. Hotspot Shield’s Hydra is closed source, so its security properties rest on the company’s own description. Lightway and Dausos are proprietary but published, meaning outside auditors can examine them. The distinction is publication rather than ownership.
The Verdict
Select WireGuard and stop thinking about it. It is faster, lighter and cryptographically simpler, and every provider worth paying has dealt with its peer table.
Keep OpenVPN in mind for the awkward cases. TCP on port 443 remains the thing that gets through when nothing else does, and that is worth more than a few hundred megabits when you are in a hotel that blocks UDP.
And notice what the protocol list does not tell you. WireGuard was designed for networks where everyone knows each other. The reason it works for the opposite case is that your provider built something on top of it — so the question worth asking is what, and whether they will say.