WireGuard vs OpenVPN (plain English)
A VPN protocol is the method your app uses to build the encrypted tunnel between your device and the VPN server. WireGuard, OpenVPN, IKEv2/IPsec, and Lightway take different approaches. The options you see depend on your provider, app version, and device. Start with the setting your provider recommends, then adjust it if you have a specific connection problem.
WireGuard and provider implementations
WireGuard is designed around a compact codebase and modern cryptography. It carries encrypted traffic over UDP and can adapt when a device changes IP address. These design choices make it a useful option to try for everyday connections, but they do not guarantee uninterrupted roaming or a particular speed on your device.
NordLynx is NordVPN’s technology built around WireGuard. Lightway is a separate protocol developed by ExpressVPN. ExpressVPN also offers WireGuard, alongside Lightway, in supported apps. The provider name alone does not tell you which protocol your current connection uses; check the app settings.
OpenVPN and the UDP/TCP choice
OpenVPN can carry traffic over UDP or TCP. OpenVPN’s documentation recommends UDP for performance and describes TCP as a compatibility option. TCP may help when a network blocks UDP, but it can also introduce performance problems. OpenVPN documents these trade-offs.
A provider may offer OpenVPN over TCP port 443, a port also used for HTTPS. That can help on networks that allow this port, but the port number alone does not make VPN traffic indistinguishable from web browsing. Filters may still identify or block the connection. Check whether your provider documents additional obfuscation for your app if ordinary connections fail.
IKEv2/IPsec and changing networks
IKEv2 is commonly paired with IPsec to establish a VPN connection. Its MOBIKE extension allows a connection to adapt to a different network address, which can help when moving between Wi-Fi and mobile data. Both the implementation and configuration must support it. Check your provider’s instructions for your device; IKEv2 is not available in every app.
How they compare at a glance
| Protocol | Connection options | When to consider it | What to check |
|---|---|---|---|
| WireGuard | UDP | An everyday connection where your provider supports it | App support and whether the network allows UDP |
| OpenVPN | UDP or TCP | A supported alternative, including TCP when UDP is blocked | Provider settings and performance on your connection |
| IKEv2/IPsec | IPsec with IKEv2 | A supported option when switching between networks | App availability and MOBIKE support |
| Lightway | Provider-specific protocol | The recommended option in an ExpressVPN app | Available modes and provider instructions for your device |
Connection options and practical checks. Speed, stability, and battery use need testing on your device and network.
Which should you pick
- Start with Automatic or the protocol your provider recommends for your app.
- Try WireGuard if it is available, and compare responsiveness and reconnects on your usual network.
- Try OpenVPN over TCP if your provider supports it and UDP connections fail. It may help, but it cannot guarantee access.
- Consider IKEv2/IPsec if your provider supports it on your device and recommends it for changing networks.
- Keep the setting that works reliably for your use case, and follow provider guidance when an app update changes the options.
Frequently asked questions
Is WireGuard safe?
WireGuard uses modern cryptography and is designed with a small, reviewable codebase. Your protection also depends on an up-to-date app, correct configuration, and the provider’s implementation. A protocol name alone does not establish the security of the whole service.
What is NordLynx or Lightway?
NordLynx is NordVPN’s technology built around WireGuard. Lightway is a separate VPN protocol developed by ExpressVPN. ExpressVPN also offers WireGuard in supported apps, so Lightway and WireGuard are distinct choices.
Which protocol is fastest?
There is no universal winner. Performance depends on the app implementation, your device, the route to the server, server load, and network conditions. Compare the supported options on the same connection rather than treating a protocol ranking as a speed test.
Do I have to choose a protocol myself?
Usually you can start with Automatic or the provider’s recommended setting. What Automatic selects varies by app and provider. Manual selection is useful when troubleshooting or testing a supported alternative.
Is OpenVPN obsolete now that WireGuard exists?
No. OpenVPN remains a supported option at many providers and offers both UDP and TCP connections. TCP can help where a network blocks UDP, although filters can still block the VPN and performance may differ.