VPN Protocol Comparison: 21 tunnels side by side
The VPN Protocol Comparison sets 21 VPN and tunnel protocols, from WireGuard, OpenVPN and IKEv2 to VLESS with REALITY, Hysteria2 and Snowflake, against each other on cryptography, port, roaming, DPI fingerprint and security status, so you can pick one for your network.
Scoring rule
- Each ticked condition removes protocols that cannot meet it. The reason is listed under Ruled out.
- UDP blocked removes UDP-only protocols. Only TCP 443 also removes anything that cannot run over TCP 443.
- DPI keeps protocols rated TLS-shaped or resistant. Broken, deprecated and unencrypted protocols are left out unless included.
- Rank: DPI resistance (resistant 3, TLS-shaped 2, recognisable 1, obvious 0), plus roaming (native 2, re-handshake 1) when roaming is ticked, plus 1 for a built-in client. Ties keep table order.
Checked by hand against specifications and published research, with sources at the foot of the page. No live measurements; fields we could not state with confidence are left out.
How the comparison works
Each of the 21 protocols carries the same fields: family, security status, wire transport and port, cryptography, handshake and roaming, DPI fingerprint, obfuscation options, platforms and a one-line verdict. Three flags drive the filters: safe to deploy today, designed to resist deep packet inspection, and shipped with a mainstream operating system. Three network facts sit beside them: whether the protocol needs UDP, whether it can run over TCP port 443, and how it survives an IP change.
- Matrix lists every protocol in one sortable table. Tap a row for the full fields, a copy button and a shortcut into Compare.
- Compare two puts any pair side by side, marks the better side on the structured fields and highlights rows that differ. The comparison has its own link, such as /tools/vpn/protocols/wireguard-vs-openvpn-udp.
- Network fit removes protocols that cannot work under the conditions you tick and ranks the rest by the scoring rule shown under the list.
- Full detail shows every field for every protocol shown.
Everything runs in this page. The search term is kept in the link so a filtered view can be shared.
How to read the result
- Two questions decide most choices: is it safe to run (Status), and will it survive your network (DPI visibility).
- Status runs from audited and current, through legacy and deprecated, to broken and no encryption. Rows shaded red are the three protocols outside the safe set: L2TP/IPsec, PPTP and GRE.
- DPI visibility is how cheaply an operator can identify the protocol on the wire: obvious, recognisable, TLS-shaped or resistant. It says nothing about whether traffic can be read. WireGuard is rated obvious, yet its handshake has published machine-checked security proofs, which is rare in this table.
- Roaming is native when the session survives an IP change, re-handshake when it recovers quickly, and reconnects when the tunnel has to start again.
- Configuration and key handling break more deployments than cipher choice. For a config file, run the Config Audit; for what is blocked in a given country, use the Censorship Radar.
FAQ
Which VPN protocol is the most secure?
No protocol wins on every axis. Of the 21 compared here, 18 have no known protocol-level break; PPTP is broken, GRE has no encryption, and L2TP/IPsec is deprecated. WireGuard has the smallest audit surface, a fixed cipher suite with nothing to negotiate, and a handshake with published machine-checked security proofs.
Which VPN protocols get past deep packet inspection?
Nine are built to resist inspection: Shadowsocks, VLESS + XTLS + REALITY, Trojan, Hysteria2, obfs4, AmneziaWG, WireGuard over MASQUE, VMess and Snowflake. VMess is rated TLS-shaped and the other eight resistant. Plain WireGuard, OpenVPN over UDP and IKEv2 are rated obvious.
Should I use WireGuard or OpenVPN?
WireGuard is the default when the network is not filtering: a one round trip handshake, native roaming across networks, and roughly 4,000 lines in the reference kernel implementation. OpenVPN suits mature server features such as per-user certificates and pushed routes, and its TCP mode on port 443 is the fallback when UDP is dropped.
Which protocols still work when UDP is blocked?
Ten can run over TCP port 443: OpenVPN (TCP), SSTP, OpenConnect / AnyConnect, SoftEther, Shadowsocks, VLESS + XTLS + REALITY, Trojan, obfs4, SSH tunnel and VMess. Tick UDP is blocked or Only TCP 443 gets out in the Network fit tab to rank them.
Is this data measured live?
No. It is reference data checked by hand against specifications, RFCs and published research, and fields we could not state with confidence are left out. For which providers are blocked in a given country, use the Censorship Radar, which reads OONI measurements.
Sources: WireGuard paper, RFC 7296 (IKEv2), RFC 3931 (L2TP), RFC 2784 (GRE), RFC 9298 and RFC 9484 (MASQUE), MS-SSTP, OpenSSH release notes, OSTIF and QuarksLab OpenVPN audit (2017), MS-CHAPv2 break (2012), how China detects Shadowsocks (USENIX Security 2023), Tor Snowflake. Checked by hand. Tell us where we are wrong.