When you connect to a VPN, you’re choosing (or accepting your provider’s choice of) an underlying protocol. WireGuard, OpenVPN, IPsec, IKEv2 — each has different performance, security, configuration, and platform characteristics. In 2026, WireGuard has become the default for many providers; the others still have meaningful niches.

This post compares the major VPN protocols at a practical level: what each is, how it performs, where it shines, where it lags, and how to choose.

What a VPN Protocol Does

A VPN protocol establishes:

An encrypted tunnel between two endpoints.
Authentication — both sides verify each other’s identity.
Key exchange — sets up the encryption keys.
Encapsulation — wraps traffic so it can be sent through the tunnel.

Different protocols make different trade-offs in each of these areas.

WireGuard

WireGuard (open source, mainline Linux kernel since 2020) is the modern darling.

Design principles:

Minimal codebase (~4,000 lines vs OpenVPN’s 100,000+).
Fixed cipher choice (ChaCha20-Poly1305 for encryption, Curve25519 for key exchange, BLAKE2s for hashing). No negotiation; no version compatibility nightmare.
UDP only. No TCP fallback in the protocol itself.
Stateless in a sense — no persistent connection state. The protocol uses a roaming-friendly model where peers can change IPs and the connection survives.
Public-key based authentication. Each peer has a public key; the other side knows which keys to accept.

Config file looks like:

[Interface]
PrivateKey = <your private key>
Address = 10.0.0.2/32

[Peer]
PublicKey = <server's public key>
Endpoint = vpn.example.com:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

That’s literally the whole thing. The simplicity is the point.

WireGuard pros

Fast. Often 2-3x throughput of OpenVPN.
Small attack surface.
Easy to configure.
Connection migration (good for mobile).
Mainline kernel support → minimal overhead.

WireGuard cons

No built-in user authentication (push everyone to use external auth on top, like with key rotation or a tunnel-broker).
UDP-only → blocked by some restrictive networks.
No native obfuscation (some networks DPI-block WireGuard fingerprint).

WireGuard is the right default for new VPN deployments in 2026 unless you have a specific reason for something else.

OpenVPN

OpenVPN is the venerable open-source workhorse. Has been the leader for over a decade.

Design:

Userspace (vs WireGuard’s kernel). Slower, more flexible.
SSL/TLS-based. Uses the same cryptographic primitives as HTTPS.
Runs over UDP or TCP. TCP for restrictive networks (looks like normal HTTPS).
Highly configurable. Many ciphers, options, certificate management, push directives.

OpenVPN pros

Mature, audited, widely deployed.
TCP mode bypasses most firewalls.
Granular configuration for complex deployments.
TLS-based, so familiar primitives for security teams.
Cross-platform (Windows, Mac, Linux, BSD, mobile).

OpenVPN cons

Slower than WireGuard.
Larger codebase = bigger attack surface.
More complex configuration.
Performance scales poorly on multi-core.

OpenVPN remains relevant for environments needing TCP fallback or where existing infrastructure is built around it. New deployments often pick WireGuard instead.

IPsec

IPsec is the IETF standard, used heavily in enterprise and site-to-site VPNs. Not one protocol — a suite of related protocols (ESP, AH) plus a key-exchange protocol (IKE).

Two main modes:

Tunnel mode — encapsulates the whole IP packet. Used for site-to-site VPNs.
Transport mode — encrypts only the payload. Used for end-to-end.

Always paired with IKE (Internet Key Exchange):

IKEv1 — older, complex, being phased out.
IKEv2 — modern, simpler, widely supported.

IPsec pros

Universal vendor support (Cisco, Juniper, every firewall).
Standardized — interoperability across vendors is reliable.
Stable for site-to-site (router-to-router VPNs).
Hardware acceleration on many platforms.

IPsec cons

Complex configuration. Many parameters that must match.
Many flavors and modes lead to compatibility headaches.
NAT traversal historically painful (NAT-T mitigates).
Less great for ad-hoc remote-access scenarios than newer protocols.

For enterprise site-to-site VPNs (e.g., “connect office to AWS VPC”), IPsec is still the default. For consumer or remote-user VPNs, others have surpassed it.

IKEv2 / IPsec

IKEv2 is the key-exchange protocol for IPsec. As a complete VPN solution, “IKEv2/IPsec” usually means IKEv2 for setup + ESP for encrypted tunnels.

Why list it separately: it’s the protocol Apple and Microsoft built into their OSes’ VPN clients. iOS, macOS, and Windows have native IKEv2 support out of the box.

IKEv2 pros

Native OS support (iOS, macOS, Windows).
Fast reconnection (good for mobile).
Built-in NAT traversal.
Strong security if configured correctly.

IKEv2 cons

Configuration complexity inherited from IPsec.
Easier to misconfigure than WireGuard.
Some enterprise gear still uses IKEv1.

For “connect my iPhone to a corporate VPN,” IKEv2 is often the right answer — no app install needed.

L2TP / IPsec (Legacy)

L2TP/IPsec combines Layer 2 Tunneling Protocol with IPsec for encryption. Was common in the 2000s; now considered legacy.

Disadvantages:

More overhead than alternatives.
Often has known vulnerabilities in default configs.
Slower than IKEv2.
Some implementations use weak pre-shared keys.

If you encounter L2TP/IPsec in 2026, it’s probably legacy infrastructure. Plan to migrate.

PPTP (Don’t Use)

PPTP (Point-to-Point Tunneling Protocol) is the original consumer VPN protocol. Considered broken since the 2010s. Authentication can be cracked in hours.

Many older operating systems and routers still support it. Don’t use it. Every modern OS includes deprecation warnings.

SSL / TLS-Based VPNs

A separate category — SSL/TLS VPNs like OpenVPN above but also Cisco AnyConnect, Fortinet SSL VPN, etc.

Characteristic: traffic looks like HTTPS (port 443). Bypasses most firewalls. Used by enterprises for remote access.

Often web-based (browser-only) or with native client apps. Varies by vendor.

Performance Comparison

Rough numbers from benchmarks (very dependent on hardware and link):

WireGuard: 1-2 Gbps on typical hardware, scales well.
IPsec (with hardware acceleration): Up to 10+ Gbps.
IPsec (software): Several hundred Mbps to 1 Gbps.
OpenVPN (UDP): 200-500 Mbps.
OpenVPN (TCP): Slower; TCP-over-TCP penalty.

For consumer use cases, all are “fast enough.” For high-throughput infrastructure, WireGuard or hardware-accelerated IPsec are the relevant choices.

Bypassing Restrictive Networks

Some networks (corporate firewalls, hotel Wi-Fi, censorship regimes) try to block VPN traffic. Detection strategies and counter-strategies:

UDP-only is detectable

WireGuard, IKEv2, OpenVPN UDP — all use UDP. Blocking all UDP cripples them (and most other apps).

Specific port blocking

Known VPN ports (1194 for OpenVPN, 51820 for WireGuard) are often blocked. Run on alternate ports (443 disguises as HTTPS).

Deep Packet Inspection (DPI)

Sophisticated firewalls fingerprint protocols. WireGuard’s handshake is recognizable; OpenVPN’s is too.

Obfuscation layers

obfsproxy / obfs4 — adds an obfuscation wrapper that makes traffic look generic.
shadowsocks — purpose-built for circumvention.
WireGuard over WebSocket — tunneled inside a WebSocket connection.

For users in restrictive networks, obfuscated VPN protocols are the practical option.

VPN Provider Choice (User Perspective)

For consumers picking a VPN service in 2026:

For speed: WireGuard-based service (Mullvad, Proton, ExpressVPN’s “Lightway” — which is WireGuard-derived).
For mobile + native: IKEv2/IPsec (built into iOS).
For obfuscation: Service that offers obfuscated WireGuard or Shadowsocks.
For corporate: Likely IKEv2/IPsec or vendor-specific SSL VPN (provided by your IT department).

Detection on the Server Side

For applications wanting to identify VPN traffic, the protocol matters less than the destination. VPN exit nodes are usually on hosting ASNs; that’s the signal application code uses.

The Ip2Geo API returns ASN type — hosting, VPN, residential, mobile — inline with geolocation. The underlying protocol (WireGuard vs OpenVPN vs IPsec) is invisible at the application layer.

For more on detection, see how to block VPN and proxy users.

TL;DR

WireGuard — modern default. Fast, simple, small attack surface.
OpenVPN — mature workhorse. TCP fallback. Slower than WireGuard.
IPsec (IKEv2) — enterprise standard. Native iOS/macOS/Windows support.
L2TP/IPsec, PPTP — legacy. Migrate away.
SSL VPNs — enterprise remote access. Bypasses most firewalls.
For new deployments: WireGuard by default.
For mobile remote access: IKEv2 (native OS support).
For site-to-site: IPsec for legacy interop; WireGuard for new deployments.
For obfuscation: WireGuard + obfs4 or Shadowsocks.

The VPN protocol landscape has settled meaningfully since 2020: WireGuard has eaten the consumer market; IPsec/IKEv2 remains the enterprise standard; OpenVPN holds on for specific use cases. For the broader proxy/VPN/Tor landscape, see proxy types explained; for detection strategies, how to block VPN and proxy users.

VPN Protocols Compared: WireGuard, OpenVPN, IPsec, and More