🔬 Methodology: 480 speed tests per protocol (WireGuard, OpenVPN UDP, OpenVPN TCP, IKEv2, L2TP/IPsec) conducted via DCSpeedTest across fiber, cable, and LTE connections to 12 VPN server locations in 6 countries. Same hardware, same test conditions.
Why Protocol Choice Matters More Than Server Location
Most VPN users pick a server location and never think about protocol. In our testing, protocol choice caused a bigger speed difference than server distance for connections under 500ms ping. The protocol determines encryption overhead, packet size, and kernel integration — all of which affect throughput.
Speed Test Results by Protocol (Median across all tests)
- WireGuard: 92% of base speed retained. Lowest CPU usage. Best performance on mobile (handles network switching without reconnection). Winner for speed and battery life.
- IKEv2/IPsec: 87% of base speed retained. Excellent mobile performance — designed to seamlessly handle network transitions (WiFi → LTE). Built into iOS and macOS natively. Runner-up, especially for Apple devices.
- OpenVPN UDP: 76% of base speed retained. The industry standard for 15 years. Highly compatible. UDP mode significantly faster than TCP. Best for compatibility.
- OpenVPN TCP: 61% of base speed retained. TCP mode used when UDP is blocked (corporate firewalls, some countries). Port 443 can disguise VPN traffic as HTTPS. Use only when UDP is blocked.
- L2TP/IPsec: 71% of base speed retained. Older protocol, double-encapsulation adds overhead. No meaningful privacy advantages over WireGuard. Avoid unless required by corporate IT.
WireGuard: Why It Wins
WireGuard's codebase is 4,000 lines vs OpenVPN's 70,000+ lines. Less code = smaller attack surface and faster kernel integration. WireGuard runs in the Linux kernel directly (kernel 5.6+), eliminating userspace encryption overhead. Our CPU utilization during WireGuard encryption averaged 2.3% vs 11.7% for OpenVPN on the same hardware at the same speed.
When NOT to Use WireGuard
- Corporate environments that block non-standard ports (WireGuard uses UDP 51820 by default).
- Countries with active DPI firewall censorship — WireGuard packets have a distinctive fingerprint that can be detected and blocked. OpenVPN on port 443 with obfuscation is more resilient here.