VPN protocols explained

Using a VPN seems very straightforward – download your preferred app, pick a server location of your choice, and connect. However, if you take a deeper look, you quickly realize that there’s an entire system of rules dictating how your data travels. If you're interested in learning more, having VPN protocols explained is important.

If you’ve used VPNs in the past, you might already be familiar with names like OpenVPN or WireGuard. But what exactly is behind them? Protocols like WireGuard run on just 4,000 lines of code compared to OpenVPN's 70,000, which is what makes them faster and easier to audit. So, while you might initially assume that we’re discussing a bunch of different names, in reality we are discussing different mechanisms.

Of course, you don’t need to worry about all the technical jargon. In this guide, I try to break down what these protocols are in simple terms. I also discuss how they enable connections, compare the top VPN protocols on the market, and help you recognize which is the best option for your specific daily needs.

What is a VPN protocol?

A VPN protocol is a set of rules on how the data is packaged and sent over a private network. They establish VPN tunnels to safely exchange data. It is sort of similar to sending a package via post in real life.

Let’s say you’re sending an expensive tea set to your grandma abroad. If you want it to reach her in one piece, you'll have to wrap it in bubble wrap, add a "fragile" sticker on the box, and choose a reputable delivery service. But if you're sending a baseball bat to your cousin, fragile stickers and bubble wrap won’t be necessary.

Different VPN protocols are like the bubble wrap – or the absence of it – when it comes to sending data over the VPN. The less encryption and verification (bubble wrap), the faster data delivery is. But with less encryption, online traffic becomes less secure.

Therefore, when it comes to specific purposes when security is less important than speed and vice versa, it is best to use different protocols that prioritize different aspects of the data exchange process. I discuss which protocols are best for different use cases further down in the article.

Now that we know the basics of a VPN protocol, let’s take a look at the most common ones.

Common VPN protocols

Here are the most common VPN protocols in more detail:

IKEv2

Internet Key Exchange version 2, or IKEv2 for short, is very common on VPN mobile apps. That’s because when the connection with a VPN server is interrupted, IKEv2 will automatically reconnect you. This allows for virtually seamless switching between Wi-Fi and mobile data.

The protocol also supports advanced cipher functions. You can use it with 3DES and AES for encryption, with the latter considered the safest method.

OpenVPN

Probably the most popular VPN protocol on the market, OpenVPN uses TLS with SSL/TLS for private key exchange. In short, it uses very secure encryption to safely share secret "keys" needed to lock and unlock your data. OpenVPN relies on the OpenSSL crypto library – an index of secure cryptography algorithms that make your tunnel safer.

OpenVPN uses two types of standard network protocols:

• User Datagram Protocol (UDP) – requires less data verification, which makes it quite fast.
• Transmission Control Protocol (TCP) – usually requires multiple data verifications, which in turn slows down the data exchange process. On the other hand, this allows for stable connections and is good for connecting to remote servers.

L2TP/IPSec

Layer 2 Tunneling Protocol (L2TP) doesn't have any encryption, so it also uses the Internet Protocol Security (IPSec) with the 256bit AES variant. Basically, L2TP creates the tunnel and handles authentication on its own.

L2TP itself is a combination of two protocols that preceded it: Layer 2 Forwarding Protocol and Point to Point Tunneling Protocol. This VPN protocol is considered secure, but there is one concern: L2TP/IPSec was co-developed with NSA, and there are suspicions that there may be backdoors to L2TP/IPSec traffic.

WireGuard

One of the most recent major tunneling protocols, WireGuard offers by far the best connection speeds, all while maintaining top-notch security. This protocol solves problems that arise from IPSec and OpenVPN implementations, which tend to be quite complicated and more prone to misconfigurations.

One of the best things about WireGuard is that it has very few lines of code and is, therefore, very easy to implement or patch. And when it comes to security, WireGuard uses publicly available cryptography packages like Poly1305 for data authentication and ChaCha20 for encryption.

WireGuard also offers tools for developers to add their extensions and scripts.

SSTP

Secure Socket Tunneling Protocol (SSTP) is a development of PPTP and L2TP protocols. It sends PPTP or L2TP traffic through the SSL 3.0 channel. This addition allows data integrity checks and encryption measures. Plus, it uses the standard SSL and TCP port 443, so you can bypass most firewalls. It also means that the exchanged data can be unsupervised and work around closed ports and other restrictions put in place by your network administrator.

The SSTP protocol uses 2048-bit certificates for authentication and the 256-bit SSL cipher for encryption. It's one of the most secure VPN protocols, even though it's not very recent.

PPTP

Point to Point Tunneling Protocol (PPTP) is one of the first tunneling protocols, and is gravely outdated. This protocol encrypts data in transit with the MPPE cipher, which is very vulnerable to attacks from modern computers. Data packets could potentially be intercepted and modified. The protocol has no methods to verify the legitimacy of sources which sent the data.

What are proprietary VPN protocols?

Some VPN service providers have created their own tunneling protocols, such as NordVPN’s NordLynx or Hotspot Shield’s Catapult Hydra. Some of these offer better speeds, security, or an improved ability to bypass firewalls.

The main problem with proprietary protocols is that most of them aren’t open-source, most likely, to protect the developers’ work. But this also makes inspecting them harder, and, in some cases, a sense of transparency may be lost.

In comparison, some common tunneling protocols like OpenVPN or WireGuard are open-source. This makes them transparent, as anyone who is interested can inspect the source code and verify the security of the protocol.

However, some protocols, like NordLynx, are just modified versions of WireGuard or OpenVPN, so there probably is no need to worry that much about their safety.

VPN protocol comparison

Here are the VPN protocols compared in terms of compatibility, encryption, security and efficiency:

	Compatibility	Encryption	Security	Efficiency
IKEv2	Windows, macOS, iOS, Android	Blowfish, Camellia, 3DES, ChaCha20, AES	Secure	Fast
OpenVPN	Requires additional configuration files	TLS with DES, RC2, DESX, BF, CAST, AES	Very secure	Fast with UDP, slow with TCP
L2TP	Windows, macOS, iOS, Android	AES or 3DES via IPSec	Secure	Depends on implementation
WireGuard	Linux, requires additional configuration files for other OS	ChaCha20, Curve25519, HKDF, BLAKE2, SipHash24	Very secure	Very fast
SSTP	Windows	AES	Secure	Depends on implementation
PPTP	Most operating systems	MPPE with RSA RC4	Very insecure	fast

Choosing the Best VPN protocols for different use cases

Although it would seem tempting to call WireGuard the best tunneling protocol on the market, the reality may not be as clear cut. Also, not all your devices will support all the existing protocols (relevant if you're using the VPN without a VPN app). In such cases, it's good to know which protocols you should use in which scenarios.

Streaming

If you think about streaming media, you're likely to need speed over privacy. VPNs are often used to avoid geo-blocking, and in such a situation, you're probably less afraid about the police knocking down your door because you've watched a show on Hulu.

For the best performance, I recommend NordVPN’s NordLynx, which is built around WireGuard. Simply using WireGuard will also work, and IKEv2, L2TP/IPSec, or even OpenVPN in UDP mode are all decent choices.

Downloads

If you want to download data from P2P networks, you'll have to combine speed with privacy in equal parts. Downloaded torrents put your IP address out in the open due to the transparency of BitTorrent. It makes you an easy target for copyright holders as well as hackers.

So, I recommend using the protocol versions that are secure and speedy like WireGuard (including NordVPN’s NordLynx) or OpenVPN in UDP mode.

Gaming

If you need a VPN for gaming, your focus should be a ping that’s as low as possible. The best option to reduce ping is to pick a fast tunneling protocol like IKEv2 or WireGuard and connect to a nearby location. The closer it is, the less distance the signal has to travel back and forth, adding less latency.

Privacy

Suppose you're a whistleblower or someone working in a very restrictive country. In that case, the privacy and security of the connection should be your top goals. For this reason, I recommend the safest possible protocols: WireGuard and OpenVPN. You also want to seek out a VPN that has some sort of stealth mode to bypass firewalls.

FAQ