VPN Protocols: Review, Comparison & Test Results

WireGuard’s advantages and disadvantages.

Pros	Cons
Remarkably quick	Default setup can store user IP addresses
Concise & efficient code base	UDP-only (easily blocked by firewalls)
Minimal data usage
Modern security & encryption

WireGuard is a relatively new open-source VPN protocol. It’s extremely fast, data efficient, and natively only supports UDP communication.

Its widespread adoption among reputable VPNs, due to its fast speeds and secure ChaCha20 encryption, make it the best choice for the majority of users.

Its code base is much shorter than OpenVPN, making it less likely to produce errors, easier for VPN services to implement in their software safely, and quicker to audit thoroughly.

From our own speed tests, we found that WireGuard is two times faster than OpenVPN.

Also, WireGuard uses the least amount of data out of all the widely-used VPN protocols.

WireGuard uses ChaCha20 encryption, Poly1305 for authentication, Curve25519 for key exchange, and Perfect Forward Secrecy (PFS).

WireGuard’s default setup requires static IP addresses, which can compromise privacy. However, many top-tier VPN providers have addressed this with advanced configurations like double Network Address Translation (NAT) systems.

NordVPN, for example, integrates WireGuard with its own double NAT System to create a safer version of WireGuard called NordLynx. It allows servers to establish a WireGuard connection without having to store a static IP address on the server.

ProtonVPN has also implemented a double NAT system with its WireGuard servers to ensure no real IP addresses are stored.

OpenVPN’s advantages and disadvantages.

Pros	Cons
100% safe to use	Bloated code and complicated construction
Highly-configurable protocol	Problematic default configuration
Compatible with many encryption ciphers	OpenVPN consumes a lot of data
	Slower than other protocols

OpenVPN is an open-source, trusted VPN protocol. It was once the most popular protocol and the industry gold standard for decades.

It has been rigorously audited for two decades by security researchers. It also offers PFS that generates new keys for every session of data transfer.

When you use OpenVPN, both the control channel (which handles authentication, key exchange, and configuration) and the data channel (which encrypts and transmits packets) are protected with SSL/TLS encryption. This makes it safer than other protocols that only encrypt the data channel.

It can also use all the cryptographic algorithms contained in the OpenSSL library, including: AES, Blowfish, Camellia, and ChaCha20.

Most VPNs allow you to choose between two transmission modes: TCP and UDP. The key difference between UDP and TCP is that UDP is faster, whereas TCP is more stable and reliable.

This is because TCP establishes a connection before transmitting data, maintains the connection throughout transmission, and closes the connection after all data has been sent successfully.

TCP guarantees data delivery as it checks for errors, confirms whether any packets are lost, and re-initiates transmission if needed.

In contrast, UDP doesn’t open, maintain, and close a connection before delivering data. UDP simply sends the data without handshakes – there is no tracing or retransmission of lost packets.

Importantly, TCP is primarily used in situations where trustworthy communication is necessary, such as sending emails, transferring important files, and bypassing censorship. UDP is great for fast-paced activities, like gaming, streaming video or music, and online calls.

Almost every VPN app natively supports OpenVPN across popular operating systems, including Windows, macOS, Android, Linux, and iOS. You can also manually set up an OpenVPN connection.

However, OpenVPN has its drawbacks. It isn’t as efficient as WireGuard or IKEv2. It has over 70,000 lines of code — compared to just 4,000 in WireGuard. This makes it more difficult for security researchers to audit and increases the risk of bugs occurring.

Like WireGuard, OpenVPN stores your IP address and username by default but the protocol can easily be configured to not store IP addresses.

OpenVPN also increases your data usage by up to 20%, which is more than any other VPN protocol we’ve tested.

IKEv2/IPSec’s advantages and disadvantages.

Pros	Cons
Very fast	Microsoft’s code base is closed-source
Switch between WiFi networks and mobile data seamlessly	Fails to bypass online censorship
Supports many strong encryption ciphers	It might be compromised by the NSA

IKEv2 (Internet Key Exchange version 2) is a fast VPN protocol that provides a very stable connection. In our tests, IKEv2/IPsec was the second-fastest protocol. This is because it uses less bandwidth – just 7.88% compared to OpenVPN UDP’s 17.14%.

IKEv2 offers a unique auto-reconnect feature using Mobility and Multihoming Protocol (MOBIKE). This keeps the connection with a VPN gateway active while moving from one address to another.

MOBIKE helps users switch seamlessly between cellular data and WiFi networks on mobile.

However, IKEv2 doesn’t provide any encryption on its own, so it’s usually combined with IPSec (Internet Protocol Security) to form IKEv2/IPSec.

Microsoft and Cisco created the IKEv2/IPSec protocol together, which might cause concern due to their reputation for closed-source code, but there are now many open-source iterations that have been audited.

IPSec is a suite of security protocols that uses 256-bit ciphers, such as AES, Camellia and ChaCha20. After IKEv2 has established a secure connection between your device and the VPN server, IPSec encrypts your data for its journey through the tunnel.

There are unconfirmed suspicions IPSec may have been hacked by the NSA. Security researchers like Edward Snowden have suggested that IPSec was deliberately weakened during its creation.

The VPN protocol also doesn’t bypass online censorship. IKEv2 is easily blocked by firewalls and WiFi administrators because it only works on UDP port 500.

IKEv2/IPSec is therefore a poor choice for unblocking websites in countries like China and Russia.

SoftEther’s advantages and disadvantages.

Pros	Cons
Designed to bypass internet firewalls	Not available with most VPNs
Compatible with strong encryption ciphers	Requires manual configuration to be safe

When configured properly, SoftEther is a fast and secure open-source protocol, compatible with many encryption ciphers: AES-256, RC4-128, and Triple-DES-168.

The protocol is particularly good for bypassing “everyday” firewalls in workplaces and schools.

It bases its encryption and authentication protocols on OpenSSL. Like OpenVPN, this means it can use TCP Port 443, which firewalls find difficult to effectively block due to it being the port used for HTTPS (or secure websites).

Crucially, most VPNs never adopted SoftEther. It’s not supported natively on any operating system and, of the VPNs we’ve reviewed, only Hide.me supports it.

Also, SoftEther’s default configuration isn’t safe out of the box. By default, clients don’t verify the server’s certificate. Attackers can therefore impersonate a VPN server and gain access to user credentials and online activity.

And although its known for its censorship-circumventing capabilities, SoftEther now lags some of the most advanced VPN obfuscation necessary to beat aggressive internet restrictions.

L2TP/IPSec’s advantages and disadvantages.

Pros	Cons
Compatible with strong encryption ciphers	Complex code leads to poor implementation
Open-source code	Fails to bypass firewalls
	IPSec might be compromised
	Slower than other protocols
	Incompatible with NAT

Layer 2 Tunneling Protocol (L2TP) was released in August 1999 as the immediate successor to PPTP. Like IKEv2, L2TP is usually combined with IPSec to form a hybrid L2TP/IPSec VPN protocol.

Overall, its performance is disappointing and L2TP is slowly being phased out of the VPN market. Less than half of VPNs we’ve reviewed offer it. Most reputable services offer faster and safer alternatives.

It was created by Microsoft and Cisco, but there are open-source code bases available on GitHub that have implemented L2TP/IPSec servers, so the protocols can be audited and checked for backdoors.

Its complex code has led to poor implementation among VPNs. Due to the complexity of combining L2TP and IPSec, some VPNs used pre-shared keys to set up the protocol. This opened users up to Man-In-The-Middle attacks, in which an attacker falsifies authentication credentials, impersonates a VPN server, and eavesdrops on your connection.

L2TP/IPSec is also slower than other protocols, because it uses a double encapsulation feature that wraps your data in two layers of encryption.

While double encapsulation improves the security of the protocol, it’s also resource-intensive and slows down your VPN speeds.

L2TP/IPSec is also incompatible with NAT, which can cause connectivity problems. In this case, you’ll need to use a VPN passthrough feature on your router to connect to a VPN using L2TP.

SSTP’s advantages and disadvantages.

Pros	Cons
Offers secure AES-256 encryption	Not available with most VPNs
Good for bypassing censorship	Closed-source and owned by Microsoft
Easy to set up on Windows

Secure Socket Tunneling Protocol (SSTP) is a reliable option for bypassing firewalls, although most high-end VPNs have dropped it for more modern protocols.

SSTP is a proprietary protocol owned and operated by Microsoft. It’s typically used to protect native Windows connections. It uses SSL/TLS and TCP port 443 by default, as well as AES-256 encryption ciphers to establish a secure connection.

This is the port that all regular HTTPS traffic flows through, making it difficult for firewalls to block and effective for bypassing certain forms of web censorship.

It used to be vulnerable to Man-in-the-Middle attacks because it used SSL3. Nowadays, SSTP is configured to use TLS 1.2 and 1.3, which is much more secure and resistant to cyberattacks.

Overall, there are newer and more private alternatives already available with VPNs, like WireGuard and OpenVPN, so there isn’t a reason to use SSTP.

PPTP’s advantages and disadvantages.

Pros	Cons
Fast speeds	Serious security vulnerabilities
	Not compatible with 256-bit encryption keys
	Poor choice for bypassing censorship
	Reportedly cracked by the NSA

Point-to-Point Tunneling Protocol (PPTP) is an obsolete VPN protocol that has many known security issues. It’s one of the oldest network protocols that were widely used for creating encrypted tunnels.

It was developed and released by Microsoft in July 1999 to function in everyday Windows environments, with low data consumption and high speeds. This was the era of dial-up internet: a lot has changed since then, and PPTP is no longer the standard.

As a result of its simple setup and good performance at the time, the protocol was popular with small- to medium-sized businesses for internal site-to-site and remote VPNs. Worryingly, some companies still rely on this protocol to this day.

Most VPN providers have stopped supporting PPTP altogether because of its inferior 128-bit encryption and known vulnerabilities.

For example, a blog post from 2016 claims that a PPTP-encrypted VPN connection can be cracked in just three minutes.

The NSA have also reportedly exploited PPTP’s insecurities to collect huge amounts of data from VPN users.