VPN protocols explained

What a VPN protocol is

A VPN protocol is the set of rules your device and the VPN server follow to set up the tunnel. It decides how the two sides prove who they are, how they agree on encryption keys, which ciphers protect your data, and how packets are wrapped and sent. Different protocols make different trade-offs between speed, code size, how easily they pass through firewalls, and how well they cope when your phone switches from Wi-Fi to mobile data.

If you are new to VPNs, start with our primer on what a VPN is.

WireGuard

WireGuard was designed by security researcher Jason A. Donenfeld. His whitepaper describes a deliberately small protocol: it has no menu of cipher options, so there is nothing to misconfigure. It uses the Noise protocol framework for its handshake, Curve25519 for key exchange, ChaCha20-Poly1305 for encryption and BLAKE2s for hashing. The paper puts the Linux implementation at around 4,000 lines of code, far smaller than OpenVPN or typical IPsec stacks, which makes it easier to review.

WireGuard was merged into the mainline Linux kernel in version 5.6, released in 2020, and now ships on Windows, macOS, iOS and Android through official apps.

One design choice matters for commercial VPNs. Standard WireGuard gives each peer a fixed internal IP address and keeps the peer's last known real IP in server memory while the connection is in use. For a company that promises not to link users to activity, that is awkward. Providers have built their own wrappers to deal with it, which is where several of the "proprietary" protocols below come from.

Our WireGuard vs OpenVPN guide goes deeper on the choice between the two.

OpenVPN

OpenVPN is an open-source VPN project that has been developed since the early 2000s. It builds its security on TLS, the same family of protocols that protects HTTPS, and usually uses a library such as OpenSSL for the cryptography. It can run over UDP, which is faster, or TCP. Over TCP on port 443 its traffic looks much like ordinary HTTPS traffic to a simple firewall, which is why it is often the fallback on hotel, school or office networks that block other VPNs.

OpenVPN is flexible, which is both a strength and a cost. It supports many cipher and configuration options, and its codebase is far larger than WireGuard's. In practice most providers configure it well, and it has a long record in production. It is generally slower than WireGuard on the same hardware because of its design and because most implementations run outside the operating system kernel.

IKEv2/IPsec

IPsec is a suite of IETF standards that encrypts traffic at the network layer. IKEv2 (Internet Key Exchange version 2, defined in RFC 7296) is the part that authenticates the two sides and sets up the keys. The MOBIKE extension (RFC 4555) lets a connection survive when your device changes networks, for example walking out of Wi-Fi range onto mobile data. That makes IKEv2 a good fit for phones.

IKEv2 is built into iOS, macOS and Windows, so it works without third-party drivers. NIST's guide to IPsec VPNs (SP 800-77 Rev. 1) covers how organizations should configure it. Its main practical weakness is that it uses UDP ports 500 and 4500, which some restrictive networks block.

L2TP/IPsec

L2TP (Layer 2 Tunneling Protocol) creates a tunnel but does not encrypt anything by itself. It is almost always paired with IPsec, as described in RFC 3193. The result works on a very wide range of older devices, but the traffic is wrapped twice, which adds overhead. Many services that offered it used a single pre-shared key for all customers, which weakens the protection. Most consumer VPNs have dropped it in favor of IKEv2 or WireGuard.

SSTP

Secure Socket Tunneling Protocol is Microsoft's protocol that carries VPN traffic inside an HTTPS (TLS) connection on port 443. Microsoft lists it among the connection types Windows supports. It gets through firewalls well, but it is closed and tied mostly to Windows, so few consumer VPNs use it now.

PPTP: why it is broken

Point-to-Point Tunneling Protocol dates from the 1990s and was published as RFC 2637 in 1999. Its problems are well documented. Bruce Schneier and Mudge published a cryptanalysis of Microsoft's PPTP implementation in 1998. In 2012 Microsoft issued Security Advisory 2743314, warning that unencapsulated MS-CHAP v2 authentication, which PPTP relies on, could let an attacker recover credentials, and advising customers to protect it with a stronger tunnel or move to a different protocol.

Apple removed PPTP from iOS 10 and macOS Sierra in 2016, telling network administrators to move to more secure alternatives such as IKEv2. If a VPN app or router still offers PPTP, treat that as a sign the setup is out of date.

Proprietary and provider-specific protocols

Several large providers market protocols under their own names. Most are built on a known open protocol or on standard TLS libraries, with extra layers of the provider's own. What you can check about each depends on how much the company publishes.

NordLynx. NordVPN describes it as WireGuard with a custom double NAT layer: one interface gives every user the same local address, and a second assigns a unique address per session. NordVPN says this avoids storing user identities on servers. The company also says the double NAT part is proprietary, so outside researchers can't fully review it. NordLynx works only in NordVPN's apps. See our NordVPN review.

Lightway. ExpressVPN says Lightway uses the wolfSSL cryptography library, that the core was rewritten from C into Rust, and that it includes post-quantum protection by default using ML-KEM, a NIST-selected standard. The company lists audits by Cure53 in 2021 and 2022, and by Cure53 and Praetorian in 2024 after the rewrite. Its code is on GitHub. See our ExpressVPN review.

Hydra. Hotspot Shield's support pages call Hydra its proprietary protocol and recommend it as the default. The company has published little technical detail, and outside descriptions of how it works disagree, so there is not much an outsider can verify. See our Hotspot Shield review.

Stealth. Proton VPN announced Stealth in October 2022 for use in places that block VPNs. Proton says it uses obfuscated TLS tunneling over TCP, so it looks more like ordinary web traffic, and that it is available on all plans, including the free one. See our Proton VPN review.

Which protocol should you use?

• Default: WireGuard, or the provider's WireGuard-based option. It is modern, small and fast to reconnect.
• On a network that blocks VPNs: OpenVPN over TCP port 443, or a provider's obfuscation mode such as Proton's Stealth.
• On a phone that moves between networks: WireGuard or IKEv2 both handle this well.
• On an old router or device: IKEv2 if available. Use L2TP/IPsec only if nothing better exists, and never PPTP. See VPN on a router.

The protocol is only one part of security. A strong protocol from a provider that keeps logs still exposes you. See no-logs policies explained and run a leak test after you connect.