Choosing a VPN protocol used to be simple: OpenVPN was the safe default, and everything else was a compromise. That assumption stopped holding a while ago. WireGuard is now the default engine behind NordVPN’s NordLynx, and Mullvad shut down its OpenVPN servers entirely on January 15, 2026, leaving WireGuard as the only option on its network. Meanwhile, IKEv2/IPsec quietly became the protocol governments and mobile carriers lean on for roaming connections, and its reference implementation, strongSwan, just shipped hybrid post-quantum key exchange support that neither of its rivals can match natively.
This comparison breaks down WireGuard vs OpenVPN vs IKEv2 using 2026 benchmark data, current CVE disclosures, provider adoption patterns, and pricing from the business VPN market. If you’re picking a protocol for a self-hosted VPN, choosing a commercial provider, or setting policy for an enterprise remote-access rollout, the numbers below should settle most of the argument.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
WireGuard vs OpenVPN vs IKEv2: the quick verdict
WireGuard wins on raw speed and simplicity. Independent 2026 throughput tests put WireGuard around 940 Mbps on gigabit connections versus roughly 520-680 Mbps for OpenVPN and 780-850 Mbps for IKEv2, according to protocol benchmarking published this year. OpenVPN remains the most configurable and the most battle-tested, with two decades of audits behind it, but it’s measurably slower and heavier on CPU and battery. IKEv2/IPsec, especially through the strongSwan implementation, sits in between on speed but pulls ahead on two things that matter for 2026 deployments: seamless mobile roaming via MOBIKE and production-ready post-quantum key exchange.
None of the three is universally “best.” The right pick depends on whether you value throughput, auditability, mobile reliability, or quantum-safe migration timelines. We’ll walk through each of those dimensions with data.
What each protocol actually is
WireGuard: minimalism as a security feature
WireGuard was designed from scratch to fit inside the Linux kernel with a tiny codebase, in sharp contrast to the sprawling legacy VPN stacks it competes against. The current mainline release is version 1.0.20260223, and it hard-codes its cryptographic choices rather than negotiating them: Curve25519 for key exchange, BLAKE2s for hashing, and ChaCha20-Poly1305 for the data channel. There’s no cipher negotiation, no legacy fallback modes, and no configuration sprawl. That’s a deliberate trade-off. It makes WireGuard fast and easy to audit, but it also means the protocol itself has no built-in path to post-quantum cryptography without a wrapper layer added by the implementer.
OpenVPN: the flexible, thoroughly audited veteran
OpenVPN is a TLS-based VPN that rides on top of OpenSSL or a similar TLS library, which is why its security profile depends heavily on how it’s configured. The 2.6 branch is the current long-term-stable release, with 2.6.22 shipping August 5, 2026, according to endoflife.date’s tracking. A newer 2.7 branch (2.7.6, also dated August 4, 2026) adds features like the ovpn-dco kernel data-channel offload and native AEAD ciphers, closing some of the performance gap with WireGuard. Most commercial deployments in 2026 default to AES-256-GCM for the data channel and ECDHE key exchange over TLS 1.3. OpenVPN’s biggest asset is flexibility: it can run over TCP or UDP, tunnel through port 443 to look like ordinary HTTPS traffic, and support an enormous range of authentication methods.
IKEv2/IPsec: the enterprise and mobile standard
IKEv2 (Internet Key Exchange version 2) paired with IPsec is the protocol most enterprise VPN appliances and mobile operating systems have used natively for years, largely because Windows, iOS, and Android all ship built-in IKEv2 clients. strongSwan is the most widely deployed open-source implementation, and its 6.0.7 release landed June 7, 2026. It’s highly configurable at the cipher level, though most 2026 deployments settle on AES-256-GCM for the ESP data channel and SHA-256 or SHA-384 for integrity. IKEv2’s standout feature is MOBIKE (RFC 4555), which lets a connection survive a network change, like switching from Wi-Fi to cellular, without dropping and re-establishing the tunnel.
Full specs comparison table
| Specification | WireGuard | OpenVPN | IKEv2/IPsec (strongSwan) |
|---|---|---|---|
| Current stable version (Aug 2026) | 1.0.20260223 | 2.6.22 (LTS) / 2.7.6 | strongSwan 6.0.7 |
| Key exchange | Curve25519 (fixed) | ECDHE via TLS 1.3 (configurable) | Configurable ECDH, RSA/ECDSA |
| Data channel cipher | ChaCha20-Poly1305 (fixed) | AES-256-GCM (typical default) | AES-256-GCM (typical default) |
| Transport | UDP only | UDP or TCP | UDP (ESP), some NAT-T fallback |
| Peak throughput (gigabit link) | ~940 Mbps | ~520-680 Mbps | ~780-850 Mbps |
| Handshake / connect time | 0.1-0.3s | 1-3s | 0.5-1s |
| Mobile roaming support | Key-based, no formal standard | Requires reconnect on IP change | MOBIKE (RFC 4555), seamless |
| Post-quantum readiness | Not in core spec; vendor wrappers only | Depends on TLS library PQ support | ML-KEM hybrid built into strongSwan 6.0.3+ |
| Kernel integration | Native Linux kernel module | Userspace (ovpn-dco offload in 2.7) | Kernel-level via XFRM |
| Config complexity | Minimal, no negotiation | High, many tunable options | High, extensive cipher suite options |
| Default in major consumer VPNs (2026) | Mullvad (exclusive), NordVPN (NordLynx) | Legacy fallback on most providers | Native OS clients (Windows/iOS/Android) |
| CVEs disclosed 2025-2026 (core protocol) | 0 (1 in third-party tool WireGuard Easy) | 6+ (memory safety, DoS, privilege escalation) | 6+ (mostly EAP/TLS plugin surface) |
Benchmark data: three sources, one consistent pattern
Throughput numbers vary by testbed, but the ranking is remarkably consistent across independent 2026 tests. A protocol comparison run on gigabit links this year measured WireGuard at 940 Mbps TCP and 980 Mbps UDP, against OpenVPN’s 520 Mbps TCP and 680 Mbps UDP, with IKEv2 landing at 780 Mbps TCP and 850 Mbps UDP. A separate 2026 evaluation reported overhead of roughly 5.6% for WireGuard, 13.8% for IKEv2, and 25.7% for OpenVPN over UDP, relative to the raw line rate.
A third data point, this one from constrained cloud testbeds rather than local gigabit links, found mean throughput of 22.9 Mbps for WireGuard, 16.8 Mbps for IKEv2, and just 8.7 Mbps for OpenVPN running over TCP on port 443. Latency followed the same pattern: WireGuard averaged about 4.7ms of added latency versus roughly 8.2ms for IKEv2 in that test. OpenVPN’s TCP mode, often used specifically to disguise VPN traffic as regular HTTPS, carries the heaviest performance penalty of any common configuration.
CPU and battery impact tell a similar story. Guides benchmarking mobile performance in 2026 consistently rank WireGuard and IKEv2 as low-CPU, low-battery-drain options, while OpenVPN is flagged as the heaviest of the three on both counts, a direct consequence of its userspace encryption model versus the kernel-level handling WireGuard and IKEv2 both use.
One caveat on those OpenVPN figures: they reflect OpenVPN in its default, userspace configuration. OpenVPN’s Data Channel Offload (DCO) targets exactly the userspace penalty described above, moving data-channel encryption into the kernel through the ovpn module that was mainlined into the Linux kernel in 6.16 and ships in the OpenVPN 2.7 branch. Providers that have enabled it report sizable gains: IPVanish reported Windows downloads up 131% on TCP and 196% on UDP, as covered by TechRadar, and Norton says DCO more than doubles its OpenVPN speeds. OpenVPN’s own engineering team has shared a like-for-like figure too: an iperf3 test by Antonio Quartulli, OpenVPN’s principal engineer and lead DCO author, measured roughly 3.61 Gbps for the legacy userspace build versus 7.15 Gbps with DCO enabled on the same workstation, close to a 2x gain on identical hardware. The provider numbers are single-vendor figures, and on Windows DCO can be mutually exclusive with obfuscation modes, so treat all of these as directional rather than a substitute for a controlled head-to-head. The point for this comparison is that the default-config figures above are OpenVPN’s floor rather than its ceiling: with DCO active it closes a real part of the gap, though independent testing still places it behind WireGuard at the top end. For the mechanism, see OpenVPN’s own DCO overview.
Pricing: business and enterprise VPN market in 2026
Protocol choice is often invisible to buyers because it’s baked into a vendor’s platform, but the underlying protocol does correlate with pricing tier. Cloud-first, WireGuard-based ZTNA platforms tend to undercut legacy IPsec appliance vendors substantially.
| Provider / Platform | Primary protocol | Price (per user/month) | Segment |
|---|---|---|---|
| Twingate | WireGuard-based | $5-$10 | SMB / cloud ZTNA |
| Cloudflare Zero Trust | WireGuard-based tunnels | Free up to 50 users, ~$7 above | SMB / startup |
| NordLayer | NordLynx (WireGuard) | $7-$14 (drops to ~$7 at 100+ seats) | SMB / mid-market |
| Perimeter 81 | WireGuard / IPsec hybrid | $8-$16 | Mid-market |
| Zscaler Private Access | Proprietary tunnel | ~$11.66+, up to $20-$40 in full SASE bundles | Enterprise |
| Cisco AnyConnect / legacy appliances | IPsec / SSL VPN | $50-$150 per device/year plus hardware | Large enterprise |
The pattern is clear: entry-level cloud VPN and ZTNA platforms built on WireGuard cluster around $5-$10 per user per month, mid-tier hybrid platforms land in the $7-$16 range, and legacy IPsec/SSL VPN appliances from vendors like Cisco, Fortinet, and Palo Alto carry per-device licensing plus hardware costs that push effective per-user spend well past $50 a year before support contracts.
Security track record: CVEs and audit surface
Codebase size shapes how much attack surface a protocol carries, and this is where WireGuard’s minimalism pays off most directly. WireGuard’s core kernel implementation is small by design; OpenVPN and strongSwan are both large, modular codebases covering protocol negotiation, plugin systems, and extensive legacy compatibility layers, which naturally creates more room for bugs.
That difference shows up in the 2025-2026 CVE record. strongSwan disclosed several vulnerabilities this cycle, including CVE-2025-62291, a critical heap-based buffer overflow in the EAP-MSCHAPv2 plugin fixed in version 6.0.3, and CVE-2026-35330, a libsimaka attribute-length bug that could enable remote code execution, patched in 6.0.6. Notably, nearly all of strongSwan’s disclosed flaws live in EAP/TLS plugin code rather than the core IKEv2 state machine itself.
OpenVPN’s 2025-2026 disclosures include CVE-2025-12106 (a heap buffer over-read from insufficient argument validation), CVE-2025-15497 (a denial-of-service issue in epoch key slot processing), and CVE-2026-9560, a macOS privilege-escalation flaw in OpenVPN Connect that allowed arbitrary commands with elevated privileges. WireGuard’s core protocol has no disclosed CVEs in this window; the one notable 2026 vulnerability, CVE-2026-63089, hit WireGuard Easy, a third-party management tool, not the protocol itself, and stemmed from a weak PRNG generating brute-forceable link tokens.
The takeaway isn’t that OpenVPN or strongSwan are insecure. Both remain widely trusted and actively maintained. It’s that WireGuard’s smaller surface area produces fewer opportunities for the kind of parsing and memory-safety bugs that dominate the other two protocols’ CVE histories.
Codebase size and audit surface: why smaller wins
Security researchers have made a specific argument about WireGuard since before its 1.0 release: a smaller codebase is easier to audit line by line, and every line you don’t ship is a line that can’t contain a bug. WireGuard’s core kernel module is commonly cited in technical talks and academic literature as being on the order of a few thousand lines of code, a fraction of what OpenVPN or strongSwan carry. That’s not an incidental detail. OpenVPN’s codebase spans protocol negotiation, a full TLS stack integration, platform abstraction layers for Windows, macOS, Linux, and mobile, plus the newer ovpn-dco kernel offload driver added in the 2.7 branch. strongSwan is arguably the largest of the three, since it supports IKEv1 and IKEv2, dozens of optional plugins (EAP methods, PKCS#7, RADIUS integration, post-quantum key exchange modules), and legacy compatibility modes going back over a decade.
More code isn’t inherently worse if it’s well-maintained, and both OpenVPN and strongSwan have long histories of responsible disclosure and rapid patching. But the practical effect shows up in exactly the kind of vulnerabilities each project has disclosed. OpenVPN’s 2025-2026 CVEs cluster around argument parsing and buffer handling, the classic failure modes of a large C codebase handling untrusted network input. strongSwan’s cluster almost entirely in optional plugin code, meaning a deployment that disables unused EAP methods and legacy plugins meaningfully shrinks its own exposure. WireGuard, by contrast, doesn’t give an implementer those knobs to misconfigure in the first place, because there’s nothing optional to turn off. The protocol’s own documentation describes this as a deliberate design philosophy: it’s easier to secure a system with fewer moving parts than to secure every possible configuration of a system with many.
For teams doing their own security review before a rollout, this translates into a very different audit workload. Reviewing a WireGuard deployment mostly means checking key management and peer configuration. Reviewing an OpenVPN or strongSwan deployment means checking cipher suite selection, TLS/EAP configuration, certificate handling, and often a much longer list of enabled features that need to be individually evaluated for necessity.
NIST and government guidance in 2026
For US federal agencies and contractors, protocol choice isn’t purely a performance question, it’s a compliance one. NIST Special Publication 800-77 Revision 1, “Guide to IPsec VPNs,” remains the canonical federal reference document, most recently updated June 30, 2020. It recommends always providing confidentiality for sensitive VPN traffic, using FIPS-approved integrity algorithms, and preferring AES in GCM modes over older CBC-based cipher suites. Because the guidance is written specifically around IPsec, IKEv2 retains a structural advantage in federal and defense-adjacent environments where NIST alignment is a procurement requirement, even though WireGuard and OpenVPN are both cryptographically sound by any independent assessment.
The post-quantum dimension adds another layer. NIST’s PQC transition materials explicitly flag VPN deployments, specifically PQC-only and hybrid modes of the IKEv2 key exchange, as a priority migration area. France’s ANSSI has gone further with a dedicated IPsec post-quantum transition document that names strongSwan 6.0.3 and later as a practical, already-available vehicle for hybrid ML-KEM deployment. Neither agency has published equivalent guidance naming WireGuard or OpenVPN as a reference implementation for post-quantum migration, which matters for any organization whose compliance posture depends on citing a specific government standard rather than a vendor’s marketing claim about “quantum-resistant” encryption.
None of this means WireGuard or OpenVPN are unsuitable for government use. Plenty of agencies run WireGuard-based tooling internally. It means that if your organization needs to point to a specific NIST or ANSSI document during an audit, IKEv2/IPsec currently has more paper trail behind it than the alternatives.
Common mistakes when choosing a VPN protocol
Assuming “newer” automatically means “better” for your specific network. WireGuard’s speed advantage is real, but if your organization’s network actively blocks UDP traffic outbound, a WireGuard deployment will simply fail to connect for those users, and no amount of raw throughput matters if the tunnel never establishes. Test against your actual network conditions, not just a lab benchmark.
Confusing a VPN provider’s marketing name for the underlying protocol. NordLynx, Lightway, and similar proprietary names are built on or inspired by WireGuard, but they aren’t identical to upstream WireGuard, and their post-quantum additions are vendor-specific implementations that haven’t gone through the same public standardization process as strongSwan’s RFC 9370 support. Read past the brand name before assuming feature parity.
Ignoring mobile roaming until after deployment. Teams that pilot a VPN protocol on desktop workstations often skip testing the mobile roaming scenario entirely, then discover in production that field staff are getting dropped connections every time they switch from office Wi-Fi to cellular. This is precisely the gap MOBIKE was built to close, and it’s worth testing explicitly before a company-wide rollout rather than after complaints start coming in.
Treating protocol choice as a permanent decision. Most modern VPN platforms, from Cloudflare Zero Trust to NordLayer, support running multiple protocols simultaneously with automatic client-side fallback. There’s rarely a reason to commit to a single protocol network-wide when a primary-plus-fallback configuration costs little extra complexity and covers more edge cases.
MITRE detection context: how this compares to endpoint security
VPN protocol choice doesn’t exist in isolation. It’s one layer in a broader security stack that typically includes endpoint detection tools. Organizations running CrowdStrike, SentinelOne, or Microsoft Defender for endpoint protection still need a transport-layer decision, and the same rigor applied to EDR/XDR evaluation (MITRE ATT&CK scores, CVE history, vendor transparency) applies here. A fast, minimal-surface protocol like WireGuard reduces one attack vector, but it doesn’t replace the need for endpoint detection, identity controls, or the kind of zero trust architecture covered in our Zero Trust Network Access setup guide.
Post-quantum cryptography: strongSwan’s head start
Quantum-safe migration is the single biggest differentiator heading into the back half of 2026. strongSwan 6.0.x already implements hybrid post-quantum key exchange per RFC 9370, including ML-KEM (FIPS 203), and France’s ANSSI has published guidance specifically citing strongSwan 6.0.3 and later as a practical vehicle for IPsec post-quantum transition. NIST’s own PQC guidance calls out IKEv2 hybrid key exchange modes as a primary VPN deployment path for the transition.
WireGuard’s core spec has no post-quantum primitives and none are planned at the protocol level, since the design philosophy prizes a fixed, minimal cipher suite. That hasn’t stopped commercial WireGuard-based services from adding quantum resistance at the wrapper layer: NordVPN shipped post-quantum encryption on NordLynx starting on Linux in late 2024 and extended it across Windows, macOS, iOS, and Android through 2025, while ExpressVPN added post-quantum key exchange to its WireGuard-derived Lightway protocol in January 2025. OpenVPN’s path to post-quantum runs through its underlying TLS library; as OpenSSL and LibreSSL add PQ ciphersuites, OpenVPN inherits them without a protocol redesign, but there’s no universal timeline yet.
For organizations with a hard quantum-safe deadline, IKEv2/IPsec via strongSwan is currently the only one of the three with production-ready, standards-based PQ support out of the box.
Which major VPN providers use which protocol
Provider defaults are a useful signal of where the industry has landed. Mullvad made the most decisive move: it began deprecating OpenVPN in its desktop app with version 2025.14 and shut down its OpenVPN servers entirely on January 15, 2026, meaning the service now runs WireGuard exclusively. NordVPN defaults every app to NordLynx, its WireGuard-based implementation, having phased out OpenVPN as the recommended option even on Linux. ExpressVPN built its own protocol, Lightway, described as WireGuard-inspired but architecturally distinct, and set it as the default across every platform while keeping OpenVPN and IKEv2 available as fallback options.
Proton VPN and Surfshark both support all three protocols, with WireGuard as the default on modern apps and OpenVPN retained mainly for networks that block WireGuard’s UDP-only traffic pattern. On the enterprise side, legacy vendors like Cisco, Fortinet, and Palo Alto Networks still lean on IPsec/IKEv2 or proprietary SSL VPN implementations, largely because their appliance hardware and existing customer deployments were built around that stack years before WireGuard existed.
Mobile and roaming performance
If your primary use case is a phone moving between Wi-Fi and cellular networks all day, IKEv2 still has a structural advantage. MOBIKE, the mobility extension defined in RFC 4555, lets an IKEv2 tunnel survive an IP address change without a full renegotiation, which is precisely why Windows, iOS, and Android all ship native IKEv2 clients. strongSwan’s implementation also supports make-before-break reauthentication, overlapping old and new security associations so the connection never fully drops during a handoff.
WireGuard handles roaming gracefully too, just without a formal standard behind it. Because peers are identified by cryptographic keys rather than IP addresses, a WireGuard tunnel can silently pick up a new source IP without renegotiating, and its sub-300ms handshake time means even a full reconnect is barely noticeable. OpenVPN is the clear laggard here: a network change typically forces a full TLS handshake, which takes 1-3 seconds and, on a spotty connection, can mean repeated drops during a commute or transit ride.
Five real-world deployment examples
Self-hosted personal VPN on a home server. A developer running a Raspberry Pi or small VPS as a personal VPN gateway gets the most value from WireGuard: minimal config, native kernel support on modern Linux distros, and throughput that saturates most home upload speeds without taxing the device’s CPU.
Enterprise remote-access VPN across managed laptops. A company standardizing on Windows and macOS laptops with native OS-level clients often defaults to IKEv2, since it avoids installing third-party software and integrates with existing certificate infrastructure and MDM policies.
Field sales team on cellular connections. Reps moving between office Wi-Fi, client-site Wi-Fi, and 5G throughout the day benefit most from IKEv2’s MOBIKE support, since it keeps CRM and email sessions alive through network handoffs that would otherwise trigger repeated logins.
Bypassing restrictive corporate or national firewalls. OpenVPN’s ability to run over TCP port 443, disguising traffic as ordinary HTTPS, remains the most reliable option when a network actively blocks UDP-based VPN traffic, even though it costs real throughput.
Site-to-site links between data centers with a quantum-safe mandate. A financial institution or government contractor with a documented post-quantum migration deadline should be building on strongSwan’s IKEv2 implementation now, since it’s the only one of the three protocols with ML-KEM hybrid key exchange already in a stable release.
Use-case recommendations
Choose WireGuard if: you want maximum throughput, minimal CPU/battery overhead, the simplest possible configuration, and you’re comfortable that its post-quantum protection will come from a vendor wrapper rather than the core spec. It’s the right default for self-hosted VPNs, gaming, video calls, and most consumer VPN use.
Choose OpenVPN if: you need to disguise VPN traffic as regular HTTPS to get past a restrictive firewall, you’re working with older hardware or software that lacks WireGuard support, or you want the widest possible range of authentication and configuration options for a legacy environment.
Choose IKEv2/IPsec if: your users are mobile and roam between networks constantly, you want native OS client support without installing third-party apps, or your organization has a compliance-driven timeline for post-quantum migration and needs a standards-based path today.
Choose a hybrid/proprietary protocol (NordLynx, Lightway) if: you want WireGuard-class speed with vendor-managed post-quantum key exchange already baked in, and you’d rather not manage the cryptographic wrapper yourself.
Run a dual-protocol setup if: you’re deploying a business VPN gateway and want WireGuard as the default with IKEv2 as an automatic fallback for networks or devices where WireGuard’s UDP-only traffic gets blocked.
Pros and cons
WireGuard
Pros: fastest throughput of the three, smallest codebase and attack surface, sub-second handshakes, lowest CPU and battery draw, native Linux kernel support, zero core-protocol CVEs in the 2025-2026 window.
Cons: UDP-only (can be blocked by restrictive firewalls), no native post-quantum support in the core spec, no formal roaming standard like MOBIKE, fixed cipher suite means no negotiation flexibility.
OpenVPN
Pros: can run over TCP port 443 to bypass firewalls, two decades of security audits and community scrutiny, extremely configurable, wide platform and hardware support.
Cons: slowest of the three protocols by a wide margin, highest CPU and battery usage, largest codebase and CVE count in this comparison, slowest handshake and reconnect times.
IKEv2/IPsec (strongSwan)
Pros: best-in-class mobile roaming via MOBIKE, native OS client support on Windows/iOS/Android, only protocol with production-ready post-quantum hybrid key exchange, solid middle-ground throughput.
Cons: configuration complexity can rival OpenVPN, most 2025-2026 CVEs concentrated in EAP/TLS plugin code, can struggle with aggressive NAT/firewall environments without extra tuning.
Migration guide: moving from OpenVPN to WireGuard or IKEv2
Migrating an existing OpenVPN deployment is straightforward if you plan the cutover in stages rather than flipping a switch.
- Audit your current OpenVPN config. Note the cipher suite, authentication method (certificates vs. username/password), and whether any clients rely on TCP/443 to bypass a firewall, since that capability doesn’t exist in WireGuard.
- Pick the target protocol based on your constraints. If firewall traversal isn’t an issue, WireGuard is the default choice for speed. If your fleet includes managed mobile devices, evaluate IKEv2 with native OS clients instead.
- Install WireGuard or strongSwan alongside the existing OpenVPN server rather than replacing it outright, so you can run both during the transition window.
- Generate new keypairs. WireGuard uses Curve25519 keypairs per peer; IKEv2 typically uses certificates issued from an internal CA or a service like Let’s Encrypt for public-facing endpoints.
- Update firewall rules. WireGuard needs a single UDP port open (typically 51820); IKEv2 needs UDP 500 and 4500 open for NAT traversal.
- Migrate a pilot group of users first. Move 5-10% of users to the new protocol and monitor for connectivity issues, especially from networks with aggressive UDP filtering.
- Test roaming behavior explicitly if mobile users are part of the rollout. Confirm MOBIKE is working correctly for IKEv2, or verify WireGuard reconnects cleanly across a Wi-Fi-to-cellular handoff.
- Set the new protocol as default, keep OpenVPN as fallback. Most business VPN platforms support automatic protocol fallback for clients on restrictive networks.
- Decommission OpenVPN gradually. Once telemetry shows the new protocol handling the vast majority of connections reliably, sunset the OpenVPN listener the way Mullvad did in January 2026.
- Document the post-quantum roadmap. Even if you’re not migrating to strongSwan today, record when your organization plans to adopt hybrid ML-KEM key exchange, since NIST and ANSSI guidance both treat this as a near-term requirement rather than a hypothetical.
Configuration snippets
A minimal WireGuard peer configuration looks like this:
[Interface]
PrivateKey = <server-private-key>
Address = 10.0.0.1/24
ListenPort = 51820
[Peer]
PublicKey = <client-public-key>
AllowedIPs = 10.0.0.2/32A comparable strongSwan IKEv2 connection block:
conn ikev2-vpn
keyexchange=ikev2
left=%any
leftauth=pubkey
leftcert=serverCert.pem
leftsendcert=always
leftsubnet=0.0.0.0/0
right=%any
rightauth=eap-mschapv2
rightsourceip=10.0.1.0/24
eap_identity=%identity
ike=aes256gcm16-prfsha384-ecp384
esp=aes256gcm16-ecp384
auto=addNote the explicit cipher suite declaration in the strongSwan config versus WireGuard’s fixed, non-negotiable primitives. That’s the core philosophical split between the two protocols in one code block.
The verdict, with data
On throughput, WireGuard wins decisively: roughly 940 Mbps versus IKEv2’s 780-850 Mbps and OpenVPN’s 520-680 Mbps in 2026 gigabit-link tests. On attack surface, WireGuard wins again, with zero core-protocol CVEs disclosed in the 2025-2026 window against six-plus each for OpenVPN and strongSwan. On mobile roaming, IKEv2 is the clear leader thanks to MOBIKE’s formal standard for surviving network changes. On post-quantum readiness, IKEv2 via strongSwan is currently the only protocol of the three with production-grade hybrid ML-KEM support built directly into a stable release, a genuine edge as NIST and ANSSI guidance push organizations toward quantum-safe migration timelines.
OpenVPN’s case rests almost entirely on its TCP/443 firewall-evasion capability and its two-decade audit history. That’s still a legitimate reason to keep it in the toolkit as a fallback, but it’s no longer the default anywhere that performance or battery life matters. The broader industry has already voted with its infrastructure: Mullvad went WireGuard-only, NordVPN defaults to NordLynx, and ExpressVPN built its own WireGuard-inspired protocol rather than sticking with OpenVPN. For most new deployments in the second half of 2026, the practical choice is WireGuard by default, with IKEv2 as the pick for mobile-heavy or quantum-safe-mandated environments, and OpenVPN retained specifically for networks that actively block everything else.
Hidden costs of switching protocols
The per-user pricing table above only tells part of the story. Switching a fleet of devices from OpenVPN to WireGuard or IKEv2 carries costs that don’t show up on a vendor invoice. Client software needs to be redeployed or reconfigured across every managed device, which for a large fleet usually means going through an MDM push rather than a manual install. Firewall rules need updating on both the VPN gateway and any perimeter firewalls between users and that gateway, since WireGuard’s single UDP port and IKEv2’s dual-port NAT traversal requirements don’t map cleanly onto rules written for OpenVPN’s TCP/443 tunnel.
There’s also a training cost that’s easy to underestimate. Help desk staff who’ve spent years troubleshooting OpenVPN connection issues need a crash course in diagnosing WireGuard handshake failures or IKEv2 IKE_SA negotiation errors, which look nothing like the TLS handshake errors they’re used to reading. Organizations that skip this step tend to see a temporary spike in support tickets during the first few weeks after a protocol migration, not because the new protocol is less reliable, but because the diagnostic playbook is unfamiliar.
The pilot-group approach outlined in the migration guide above exists specifically to absorb this cost gradually rather than all at once. A phased rollout spreads the training curve across weeks instead of concentrating it into a single cutover weekend, which is why virtually every enterprise migration guide, including the internal playbooks vendors like Cloudflare and Twingate publish for their own customers, recommends the same staged approach rather than a flag-day switch.
Frequently asked questions
Is WireGuard actually more secure than OpenVPN?
WireGuard has a smaller codebase and no disclosed core-protocol CVEs in 2025-2026, compared to six-plus for OpenVPN. That doesn’t automatically make it “more secure” in every scenario, since OpenVPN has been audited far longer and its vulnerabilities so far have centered on parsing and privilege boundaries rather than the core cryptography. But on raw attack surface, WireGuard has the edge.
Why did Mullvad remove OpenVPN entirely?
Mullvad began deprecating OpenVPN in its desktop app with version 2025.14 and shut down its OpenVPN servers on January 15, 2026, moving to a WireGuard-only network. The company cited WireGuard’s superior speed, smaller codebase, and lower maintenance burden as the primary reasons.
Does WireGuard support post-quantum encryption?
Not at the core protocol level. WireGuard’s spec is fixed to classical Curve25519 key exchange. Commercial services built on WireGuard, like NordVPN’s NordLynx and ExpressVPN’s Lightway, have added post-quantum hybrid key exchange as a wrapper around the core protocol, but that’s a vendor-specific addition, not part of the WireGuard standard itself.
Which protocol is best for mobile devices?
IKEv2/IPsec has the strongest formal support for roaming, thanks to the MOBIKE extension, which lets a connection survive a network change without dropping. WireGuard handles roaming well in practice due to its key-based peer identification, but it lacks a formal roaming standard. OpenVPN is the weakest option for mobile use, since a network change typically forces a full reconnect.
Can I run WireGuard over TCP to bypass a firewall?
Not natively. WireGuard is UDP-only by design. If you need to disguise VPN traffic as HTTPS to get through a restrictive firewall, OpenVPN’s TCP/443 mode remains the more reliable option, even though it costs meaningful throughput.
What protocol do enterprise VPN appliances like Cisco and Palo Alto use?
Most legacy enterprise VPN appliances rely on IPsec/IKEv2 or proprietary SSL VPN implementations, largely because their hardware and existing customer base predate WireGuard’s 1.0 release. Pricing for these appliances typically runs $50-$150 per device per year plus hardware costs, well above cloud-native WireGuard-based ZTNA platforms.
Is IKEv2 still relevant now that WireGuard exists?
Yes. IKEv2 remains the default native VPN client on Windows, iOS, and Android, and strongSwan’s implementation is currently the only one of the three protocols with production-ready post-quantum hybrid key exchange (ML-KEM per RFC 9370) in a stable release. For mobile-heavy or compliance-driven deployments, it’s still the strongest option.
Which protocol should I use for a self-hosted home VPN?
WireGuard is the practical default for a self-hosted setup on a home server or small VPS. Its minimal configuration, kernel-level integration on Linux, and low CPU/battery overhead make it the easiest and fastest option to run yourself, assuming your network doesn’t block UDP traffic.
Do I need to pick just one protocol for my whole organization?
No, and most business VPN platforms actively discourage it. A common pattern is WireGuard as the default for speed, with automatic fallback to IKEv2 or OpenVPN for users on networks that block UDP traffic. Running a single protocol with no fallback is simpler to manage but leaves a subset of users unable to connect from restrictive networks like hotel Wi-Fi or some corporate guest networks.
How much slower is OpenVPN in real-world use, not just lab tests?
Real-world gaps tend to track lab results closely. Across the 2026 benchmarks referenced in this comparison, OpenVPN consistently ran 30-45% slower than WireGuard on the same connection, with the gap widening further when OpenVPN is forced into TCP mode to bypass a firewall. For everyday browsing the difference may be barely noticeable, but for large file transfers, video calls, or gaming over a VPN, the gap becomes obvious quickly.
Sources: WireGuard official documentation, OpenVPN community downloads, strongSwan release notes, NIST SP 800-77 Rev. 1, Guide to IPsec VPNs, IETF RFC 9370, hybrid key exchange in IKEv2, OpenVPN version lifecycle tracker, and Mullvad’s official blog.
