Why Protocol Choice Matters
A VPN protocol is the method used to establish and maintain the encrypted tunnel between your device and the VPN server. Different protocols use different encryption algorithms, handshake procedures, and transport methods. The choice affects speed, security, firewall penetration, and battery usage on mobile devices. Most quality VPN providers let you choose which protocol to use.
WireGuard
WireGuard is the newest major protocol and has become the default recommendation for most use cases. Its codebase is around 4,000 lines compared to OpenVPN's 70,000+ lines, which means less surface area for vulnerabilities and easier security auditing. WireGuard is fast, uses modern cryptographic standards, and reconnects very quickly when switching networks. NordVPN's NordLynx, ExpressVPN's Lightway, and Mullvad all use WireGuard or WireGuard derivatives as their primary protocol.
OpenVPN
OpenVPN has been the industry standard for over a decade. It is highly configurable, widely supported, and battle-tested. Its age means many security audits have been conducted and weaknesses are well understood. It is slower than WireGuard and its handshake takes longer, which makes mobile network switching slightly less smooth. OpenVPN is still a solid choice for maximum compatibility with older devices and configurations.
IKEv2/IPSec
IKEv2 is particularly good on mobile devices because it handles network switching smoothly, reconnecting automatically when you move between WiFi and cellular. Apple devices use IKEv2 natively. It is fast and secure but less configurable than OpenVPN. Good choice for iOS users who want speed and stability.
What to Use
For most users: WireGuard or your VPN provider's WireGuard-based proprietary protocol (NordLynx, Lightway). For maximum compatibility and older devices: OpenVPN. For iOS with frequent network switching: IKEv2. Avoid PPTP entirely: it is outdated and has known security vulnerabilities. Avoid L2TP/IPSec without a thorough provider review: it has been reportedly backdoored in some implementations.