Your VPN app has a protocol menu, and two names keep coming up. Pick wrong and you get a sluggish tunnel, or one that won’t connect at the office.
Short answer: use WireGuard for almost everything. Switch to OpenVPN when a network blocks UDP (run it on TCP port 443) or your company already uses certificates.
We ran both on our Linux test box. In our WireGuard vs OpenVPN test, WireGuard moved 2.9 times more data.
The reason surprised us. And it’s about to change.
What actually separates WireGuard and OpenVPN?
Both encrypt your traffic properly. They differ in how they travel, how they pick encryption, and where the work happens.
- Transport. WireGuard speaks UDP only. OpenVPN runs over UDP or TCP, on any port; 1194 is the default.
- Encryption. WireGuard uses one fixed set: ChaCha20-Poly1305 for data, Curve25519 for key exchange, BLAKE2s for hashing. OpenVPN negotiates. A TLS session sets up the keys, then both sides agree on a data cipher. Version 2.6 offers AES-256-GCM, AES-128-GCM and ChaCha20-Poly1305 by default.
- Where the work happens. WireGuard has lived inside the Linux kernel since version 5.6 in 2020. Classic OpenVPN is an ordinary program, so every packet travels from the kernel to the app and back.
New to tunnels? Our VPN tunnel explainer shows what that wrapping does to each packet.
Which of the three matters most? The last one. Here’s how we found out.
How we compared them (and what we didn’t test)
In November 2026 we built a two-machine lab on our Linux box. Two network namespaces, joined by a virtual cable, played VPN server and client.
- WireGuard: the kernel module with wireguard-tools v1.0.20210914, MTU 1,420.
- OpenVPN: version 2.6.14 with OpenSSL 3.5.7, AES-256-GCM, tls-crypt and certificate login, over UDP and TCP.
- The tests: five 10-second iperf3 transfers per tunnel, 10 timed connections each, handshake packet captures and CPU readings.
Two caveats first. The virtual cable runs at memory speed, about 64,000 Mbit/s with no tunnel. So treat our speeds as lab numbers; the ratios are what carry over.
And our kernel (6.12) has no OpenVPN offload module. This is classic userspace OpenVPN, which plenty of routers and older apps still run. It isn’t the newest fast path, and we’ll come back to that.
We didn’t test a commercial VPN over the real internet, phone battery, long-distance latency or a censoring firewall. Where we cover those, it’s the protocols’ own documentation plus arithmetic.
Which one is faster when you push real traffic?
WireGuard, by about three times. It averaged 4,116 Mbit/s against 1,423 Mbit/s for OpenVPN over UDP.
| Tunnel | Median of 5 runs | Range (Mbit/s) |
|---|---|---|
| WireGuard | 4,116 Mbit/s | 4,049 to 4,188 |
| OpenVPN, UDP | 1,423 Mbit/s | 1,404 to 1,461 |
| OpenVPN, TCP | 1,142 Mbit/s | 1,138 to 1,189 |
Why such a gap? Not packet size. OpenVPN’s wrapper was actually smaller: 24 bytes per packet. WireGuard adds 32, plus up to 15 bytes of padding to blur exact sizes.
The cost is CPU. At full speed, the OpenVPN process used 164% of a CPU core copying packets out of the kernel and back. WireGuard does that work inside the kernel, so no single program carries the bill.
Does that matter on a 300 Mbit/s home line? Less than the table suggests. Capped at 500 Mbit/s, both tunnels delivered in full. Whole-box CPU landed in the same range: 96-100% of one core for OpenVPN, 64-111% for WireGuard.
So on a fast server chip, the gap shows at the ceiling. Phones and cheap routers hit that ceiling far sooner. We didn’t measure them, but that’s where WireGuard’s lighter path should be the one you feel.
Our take: speed goes to WireGuard. If both protocols feel slow on your VPN, blame distance or a crowded server.
How fast does each one connect, and reconnect?
WireGuard sets up a tunnel in one round trip. OpenVPN over UDP needed five in our capture before real data could flow.
WireGuard sent a 148-byte hello and got a 92-byte reply. Our test ping went straight after.
OpenVPN sent 19 packets first. The TLS greeting, both certificates in 1,206-byte chunks, the key exchange, then the server pushing tunnel settings. Each step waited for the other side.
| Time to first ping (median of 10) | Result |
|---|---|
| WireGuard | 0.002 s |
| OpenVPN, UDP | 0.016 s |
| OpenVPN, TCP | 0.101 s |
That cable has zero delay, and the OpenVPN times include starting the program. On the real internet, round trips are the cost. With a server 100 ms away, WireGuard’s setup takes about 0.1 seconds. OpenVPN’s five round trips need at least 0.5, and TCP adds its own handshake.
Now picture your phone leaving home Wi-Fi for mobile data. WireGuard has no connection to lose. It replies to whichever address it last heard from, so your next packet just carries on. Fresh keys get swapped every two minutes without you noticing.
A dropped OpenVPN session has to run that whole TLS exchange again. A VPN kill switch keeps your real IP hidden during that gap.
Round two goes to WireGuard. On a phone, it isn’t close.
Is one more secure than the other?
Neither has a known practical break when set up properly. The real difference is a fixed design versus a flexible one.
WireGuard’s whitepaper puts its Linux code under 4,000 lines, not counting the crypto. One person can read all of it. And there are no cipher settings to get wrong, because there are no cipher settings.
That simplicity has a price. If one of its algorithms weakens, the fix is a new protocol version, not a config change. It isn’t quantum-resistant by default either, though an optional pre-shared key adds a layer.
OpenVPN leans on OpenSSL, the library behind much of HTTPS. That’s decades of hardening, inside a far bigger codebase. Old configs still use retired ciphers or compression; version 2.6 allows only modern AEAD ciphers out of the box.
Our lab showed the trade-off firsthand. OpenVPN refused to start twice: once over a key file in the wrong format, then over a server certificate missing its “server” usage flag. The client was right to refuse. It also shows how many parts have to line up.
Our take: a tie on strength. WireGuard is harder to misconfigure. OpenVPN wins if you need certificates, username logins or your company’s sign-in system.
What does each one remember about you?
Plain WireGuard ties each user’s key to a fixed tunnel address on the server. It also keeps your last real IP in memory while the server runs.
Each WireGuard peer is a public key plus the tunnel addresses it may use. Our lab server held exactly that, plus the address our client last connected from. OpenVPN, by contrast, handed our client 10.8.0.2 from a pool when the session started.
For a commercial VPN, that’s a problem to engineer around. NordVPN’s WireGuard-based NordLynx gives every user on a server the same internal address, plus a temporary one per session. Our NordVPN review covers how that fits its wider privacy setup.
Self-hosting? You’re the operator, so this round doesn’t apply. With a provider, ask how it handles WireGuard addresses.
Which one gets through a strict firewall?
OpenVPN, because it can run over TCP port 443, the same port as every HTTPS website. WireGuard is UDP-only and doesn’t try to look like anything else.
Hotel, office and campus networks often allow web traffic and little more. WireGuard’s documentation is blunt: no TCP mode and no obfuscation. Wrapping tools exist, and some VPN apps add a disguise, but the protocol itself won’t sneak through.
OpenVPN on TCP 443 usually does. Here’s the catch: that’s TCP inside TCP. When Wi-Fi drops packets, both layers retry at once and the connection stalls. Even on our perfect cable, TCP mode ran 20% slower than UDP.
Blocked at home rather than on the road? Check your router first. Our VPN passthrough guide explains the setting that trips up older VPN types.
This round goes to OpenVPN, and it’s the main reason to keep it installed.
Which one is easier to run on your own server?
WireGuard. A working client config is seven lines and one key pair. Our OpenVPN client needed 19 lines plus four key and certificate files.
[Interface]
PrivateKey = <client-private-key>
Address = 10.66.0.2/24
[Peer]
PublicKey = <server-public-key>
Endpoint = 198.51.100.7:51820
AllowedIPs = 0.0.0.0/0For OpenVPN we built a certificate authority, signed server and client certificates with the right usage flags, and generated DH parameters and a tls-crypt key. Version 2.6 lets small setups skip the authority by pinning certificate fingerprints, which helps.
WireGuard hands you less, though. No user logins, no pushed settings. Every new device gets added on the server by hand: fine for five devices, a chore for fifty people.
Our take: WireGuard for a homelab or small team. OpenVPN when you already manage certificates or need logins you can revoke per user.
The catch: “OpenVPN is slow” has an expiry date
Our three-to-one gap is classic OpenVPN. Data channel offload, or DCO, moves OpenVPN’s encryption into the kernel: the same trick that makes WireGuard fast.
- Windows: OpenVPN 2.6 already uses its DCO driver by default, and 2.7 dropped the older Wintun driver.
- Linux: the new
ovpnmodule ships in the kernel from version 6.16, but works only with OpenVPN 2.7 or newer. Version 2.6 needs a separate module, which our box didn’t have. - The limits: DCO handles only AES-GCM and ChaCha20-Poly1305 with no compression, so the oldest configs fall back to the slow path.
OpenVPN says DCO lifts performance by up to 300%. We couldn’t test it, so treat that as the vendor’s figure. Either way, it only changes the speed round. Connections still start with the same multi-round-trip TLS exchange, and the firewall edge stays with OpenVPN.
WireGuard vs OpenVPN: which should you use?
Use WireGuard unless a network blocks it or you already run OpenVPN certificates. Here’s the call by reader.
Pick WireGuard if…
- You’re on your phone all day. One-round-trip setup and silent roaming mean fewer “reconnecting” moments between Wi-Fi and mobile data.
- You game, stream or download big files, because it moved 2.9 times more data in our lab. Our best VPNs for gaming list starts from there.
- You self-host for a handful of devices. Seven lines per client beats running a certificate authority.
Pick OpenVPN if…
- Your network blocks UDP. Hotels, offices and campuses that only allow web traffic usually let OpenVPN on TCP 443 through.
- Your company already uses certificates or central logins, because OpenVPN plugs into them and WireGuard needs extra tooling. Teams can start with our VPNs for remote work guide.
- You need what WireGuard leaves out: settings pushed from the server, per-user revocation, or an old router that offers nothing else.
- Transport
- UDP only
- Encryption
- Fixed: ChaCha20-Poly1305, Curve25519
- Speed in our lab
- 4,116 Mbit/s
- Round trips to connect
- 1
- Works over TCP 443
- No
- Client setup
- 7 lines, 1 key pair
- User logins and revocation
- No
- Transport
- UDP or TCP
- Encryption
- Negotiated over TLS (AES-GCM or ChaCha20)
- Speed in our lab
- 1,423 Mbit/s (UDP, no DCO)
- Round trips to connect
- 5 (UDP, our capture)
- Works over TCP 443
- Yes
- Client setup
- 19 lines + 4 key files
- User logins and revocation
- Yes
We may earn a commission when you buy through links on this page. This does not affect our reviews.
How to switch protocols in your VPN app
You rarely need to. NordVPN, Surfshark and ExpressVPN all offer a WireGuard-based option and OpenVPN in their settings.
Leave it on WireGuard. When a network refuses to connect, switch to OpenVPN over TCP, then switch back when you leave. Our Surfshark VPN review shows how one app handles it.
Need a provider first? NordVPN runs its own WireGuard variant, Surfshark offers both protocols, and ExpressVPN adds its own Lightway protocol. These are affiliate links; we may earn a commission at no extra cost to you.
Frequently asked questions
WireGuard vs OpenVPN: which one unblocks streaming sites better?
Neither, on its own. Streaming services block by the server’s IP address, not by the protocol. The same server unblocks the same catalogue on WireGuard or OpenVPN. Pick WireGuard for smoother high-bitrate playback and let your provider’s server choice handle the unblocking.
Can WireGuard run over TCP?
Not natively. Its developers left TCP out on purpose, because tunnelling TCP inside TCP performs badly. Separate tools can wrap WireGuard’s UDP packets in TCP, and some VPN apps build in their own disguise. If you need TCP today, OpenVPN is the simpler route.
Does OpenVPN on port 443 hide that I’m using a VPN?
Not completely. Sharing the HTTPS port gets it past simple port filters, but a firewall that studies traffic patterns can still spot it. The tls-crypt option encrypts OpenVPN’s setup messages, which makes fingerprinting harder. Harder isn’t invisible.
Does WireGuard use less phone battery than OpenVPN?
We didn’t measure battery, so we won’t give a number. WireGuard sends nothing while idle unless keepalives are switched on, and it reconnects without a fresh TLS exchange. OpenVPN’s sample server config pings every 10 seconds. Both facts point toward WireGuard being lighter.
Is WireGuard quantum-safe?
Not by default. Its key exchange uses Curve25519, which a large enough quantum computer could break. An optional pre-shared key mixed into the handshake adds a symmetric layer that resists that attack. Some VPN providers now add post-quantum key exchange on top as well.
Is IKEv2 better than both WireGuard and OpenVPN?
Only in narrow cases. IKEv2 is built into Windows, macOS and iOS, so it works without a separate app, and it copes well with network switching. It runs on fixed UDP ports 500 and 4500, though, so strict firewalls block it as easily as WireGuard.
Why is my OpenVPN TCP connection so slow on hotel Wi-Fi?
Two layers of TCP are fighting. When the Wi-Fi loses a packet, the inner and outer connections both back off and retry, and the delays stack up. Try OpenVPN on UDP first, and drop to TCP 443 only when UDP won’t connect at all.
Do I need a certificate authority to run OpenVPN at home?
Not anymore. OpenVPN 2.6 lets each side trust the other’s self-signed certificate by its SHA-256 fingerprint, so you can skip building a full certificate authority. You still make a certificate per device, which is more work than WireGuard’s single key pair.
The bottom line
For most people, WireGuard is the right default: faster, quicker to connect and far simpler to run. Keep OpenVPN for strict firewalls, certificate-based company logins and old hardware.
One warning: our speed gap measures classic OpenVPN, and DCO is shrinking it. The firewall and setup differences won’t change.
Next step: open your app’s protocol setting, leave it on WireGuard, and note where OpenVPN TCP lives. You’ll want it the day a hotel network says no. That’s the whole WireGuard vs OpenVPN decision.
