VPN Protocols Explained

A VPN protocol is a set of rules that governs how your VPN connection is established, how data is encrypted, and how it's transmitted. Think of it as the language your device and the VPN server use to communicate.

Every VPN protocol must handle three things:

1. Authentication — Verifying the identity of both your device and the VPN server to prevent impersonation
2. Encryption — Scrambling your data so it's unreadable to anyone who intercepts it
3. Transmission — Packaging and sending the encrypted data efficiently

Different protocols make different tradeoffs between security, speed, and compatibility. Some prioritize maximum encryption at the cost of speed. Others optimize for performance while maintaining strong security.

Modern VPN apps typically default to the best protocol for your platform but allow manual selection in settings. Understanding the options helps you optimize for your specific use case — whether that's maximum speed, best battery life, or getting through restrictive networks.

WireGuard has become the default protocol for most VPN providers since its inclusion in the Linux kernel in 2020.

Technical specs: - Encryption: ChaCha20 (data), Poly1305 (authentication), Curve25519 (key exchange), BLAKE2s (hashing) - Transport: UDP only - Codebase: ~4,000 lines - Speed: strong reported performance on premium VPNs (1 Gbps connection)

Advantages: - Strong-performing protocol — Consistently outperforms OpenVPN by by a wide margin in public reports - Smallest codebase — 4,000 lines vs. OpenVPN's 100,000+. Easier to reported, fewer potential vulnerabilities - Battery efficient — Uses less CPU than OpenVPN, extending battery life on laptops and phones - Quick connections — Establishes tunnels in milliseconds, reconnects almost instantly after network changes

Limitations: - UDP only — Can't switch to TCP if UDP is blocked (unlike OpenVPN) - Static IP assignment — By default, WireGuard assigns the same internal IP to each user, which some argue is a privacy concern. Top providers (NordVPN, Mullvad) have implemented workarounds - Newer — Less time in production than OpenVPN, though it's been extensively reported

NordVPN uses WireGuard as the foundation of its NordLynx protocol, adding a double NAT system to address the static IP concern. Mullvad was one of WireGuard's earliest adopters and contributed to its development.

OpenVPN has been the industry standard since 2001. It's open-source, highly configurable, and runs on virtually every platform.

Technical specs: - Encryption: AES-256-GCM (configurable — supports multiple ciphers) - Transport: UDP or TCP - Codebase: ~100,000 lines - Speed: moderate to strong reported performance on premium VPNs (1 Gbps connection)

Advantages: - TCP mode — Can run on TCP port 443 (HTTPS port), making it look like regular encrypted web traffic. Essential for restrictive networks - Maximum configurability — Supports custom ciphers, key lengths, authentication methods, and transport modes - Universal compatibility — Works on every platform and is supported by virtually every VPN provider - 20+ years of auditing — The most extensively reviewed VPN protocol in existence

Limitations: - Slower than WireGuard — The larger codebase and more complex processing result in somewhat lowerer throughput - Higher CPU usage — More battery drain on mobile devices and laptops - Complex configuration — Manual setup (without a VPN app) requires multiple configuration files and certificate management

When to use OpenVPN: - When WireGuard is blocked (OpenVPN TCP on port 443 can get through most firewalls) - When you need maximum configurability for a specific network environment - When your device or router doesn't support WireGuard

IKEv2 (Internet Key Exchange version 2) paired with IPSec is built into most operating systems and excels on mobile devices.

Technical specs: - Encryption: AES-256 (via IPSec) - Transport: UDP ports 500 and 4500 - Built into: Windows, macOS, iOS, Android - Speed: strong reported performance on premium VPNs

Advantages: - MOBIKE support — Seamlessly handles network switching (Wi-Fi to cellular, between Wi-Fi networks) without dropping the connection. This is IKEv2's killer feature - Fast reconnection — Re-establishes tunnels in under 1 second after a network interruption - Native OS support — No additional software needed on most platforms - Strong security — IPSec's encryption is well-established and extensively reported

Limitations: - Firewall blocking — Uses well-known ports that are easy to identify and block on restrictive networks - Closed-source implementations — While the protocol is standardized, some implementations are proprietary - Less flexible — Fewer configuration options than OpenVPN

When to use IKEv2: - On mobile devices where network switching is frequent - When battery life is a priority (more efficient than OpenVPN) - When your VPN doesn't support WireGuard on your platform

Some VPN providers develop proprietary protocols optimized for their infrastructure:

ExpressVPN Lightway: - Built on wolfSSL cryptographic library - Supports both UDP and TCP transport - ~2,000 lines of code (even smaller than WireGuard) - Documented in public provider materials - Speed: strong reported performance according to public third-party reports - Connects in under 1 second - Available on all ExpressVPN platforms

NordVPN NordLynx: - Built on WireGuard with a custom double NAT system - Addresses WireGuard's static IP assignment concern - Speed: strong reported performance according to public third-party reports (strong protocol in public reports) - Available on all NordVPN platforms

Both proprietary protocols offer performance equal to or better than standard WireGuard. The tradeoff is vendor lock-in — you can only use Lightway with ExpressVPN and NordLynx with NordVPN.

For most users, choosing between these protocols comes down to which VPN provider you use. If you use NordVPN, NordLynx is the strong choice. If you use ExpressVPN, Lightway is optimal. If you use any other provider, WireGuard is the universal best option.

Here's a decision framework based on your use case:

For maximum speed: NordLynx (NordVPN) > Lightway (ExpressVPN) > WireGuard > IKEv2 > OpenVPN

For best battery life: WireGuard/NordLynx/Lightway > IKEv2 > OpenVPN

For restrictive networks: OpenVPN TCP (port 443) > Lightway TCP > everything else

For mobile devices: IKEv2 (best network switching) > WireGuard (best speed) > OpenVPN

For router setup: WireGuard (least CPU overhead) > OpenVPN (most compatible)

For maximum security: Any modern protocol is secure. WireGuard, OpenVPN, and IKEv2/IPSec all use encryption that's considered unbreakable. The security difference between them is negligible for practical purposes.

General recommendation: Use WireGuard (or your provider's WireGuard-based protocol) as your default. Switch to OpenVPN TCP on port 443 only if WireGuard is blocked on your network. Use IKEv2 on mobile if your provider doesn't support WireGuard on your phone.

Never use PPTP — it's been completely broken since 2012 and provides no meaningful security.