Four padlocks surrounding a hand with its index finger extended.

Often referred to as tunneling protocols, VPN (Virtual Private Network) protocols are rules that ensure the VPN works smoothly, safely, and reliably. There is a wide variety of VPN protocols — we’ll review how they compare.

What is a VPN protocol?

A VPN protocol is a set of instructions that determines how data and traffic are encrypted and routed between your computer and the VPN server. The VPN software on your device uses the protocols to establish and maintain a secure connection to the VPN server.

Table of contents

    VPN protocol comparison

    Here’s a quick comparison table, but bear in mind that whether a VPN protocol will be stable (read as: will not cause connectivity issues), depends on the VPN provider’s server configuration as well.

    VPN protocol
    Security
    Speed
    Encryption algorithm
    Setup
    Good for
    OpenVPN TCP
    Very secure (no known vulnerabilities)
    Very fast
    AES-256-GCM
    Easy with a VPN, difficult on its own
    Router compatibility, any and everyday use
    OpenVPN UDP
    Very secure (no known vulnerabilities)
    Very fast
    AES-256-GCM
    Easy with a VPN, difficult on its own
    Router compatibility, any and everyday use
    IKEv2/IPSec
    Very secure (no known vulnerabilities)
    Very fast
    AES-256-GCM
    Easy with a VPN, difficult on its own
    Short-distance connections, mobile networks, and everyday use
    L2TP/IPsec
    Secure
    Fast
    AES-256-GCM
    Easy on Windows
    Good for increasing privacy while browsing
    WireGuard
    Very secure (no known vulnerabilities)
    Very fast
    ChaCha20
    Easy
    Everyday use
    PPTP
    Not secure
    Very fast
    MPEE 128 bit
    Very easy
    Outdated and not advised to use due to known issues
    SSTP
    Average
    Average
    AES-256-GCM
    Easy on Windows
    Connecting Windows devices
    SoftEther
    Very secure (no known vulnerabilities)
    Very fast
    AES-256-GCM
    Client setup
    Everyday use

    VPN protocol comparison table

    Lets define some of the categories that aren’t as straightforward:

    Security — the results for each protocol are a combination of different metrics, like encryption strength, data integrity (ensuring that data is not tampered with during transmission), and vulnerability to known attacks.

    Speed — VPN protocol speed was measured by considering what goes into data transmission and how it affects speed (encryption, latency, bandwidth, compression, etc.).

    For example, stronger encryption (e.g., AES-256) generally slows down the connection more than lighter encryption (e.g., AES-128 in PPTP). OpenVPN uses compression, which adds up to how quickly the data transmission happens.

    Setup — some protocols are easy to set up because all they require is a VPN app, while others can be set up manually without a proprietary app and require more know-how (like OpenVPN). The results were based on how easy it would be for a person to set up and use a VPN protocol. 

    A deep dive into VPN security protocols

    When looking deeper into VPN protocols, it’s important to know that a VPN protocol combines “lesser” protocols to create a secure and private communication channel. Each “lesser” protocol has a specific job, like encrypting data, setting up the connection, or ensuring data integrity.

    We’ve prepared a pros and cons table for each industry-standard VPN protocol, so let’s take a closer look at what makes ‘em shine:

    OpenVPN

    Pros
    Cons
    No known vulnerabilities
    Maybe not as fast due to bulky code
    Top-tier encryption and authentication
    Software setup may seem challenging
    Open-source

    OpenVPN is an open-source VPN system that comes both as software and a protocol for VPN services. Its encryption and verification processes are based on the TLS (Transport Layer Security) methodologies.

    It is usually paired with the very secure AES-256-GCM encryption algorithm. The open-source nature of this protocol allows specialists worldwide to check it for security gaps and other issues. 

    OpenVPN is quite hard to set up manually, but that’s not an issue if you use a VPN service like Surfshark it’s all done for you in advance

    OpenVPN TCP vs. UDP: what are they?

    Both TCP and UDP are different transport layer protocols that OpenVPN uses to establish a VPN connection.

    TCP (Transmission Control Protocol) — the data is sent in a sequence, and each data packet is given an identifier. If the packet is lost or sent in the wrong order, the receiver indicates that the data packet needs to be resent. Because of that, TCP tends to be the more stable of the two.

    UDP (User Datagram Protocol) — the data is sent in a stream, and the packets aren’t assigned an identifier. The packets are only checked if they arrive uncorrupted. UDP has almost no error correction and “doesn’t care” for lost packets. Because of that, it’s faster, and more users tend to use it, but disconnects happen more frequently.

    We recommend trying them both and using the one that provides a smoother connection.

    IKEv2/IPSec

    Pros
    Cons
    Very fast
    Speed may vary depending on the distance between your device and the server
    Stable connection
    Works well on mobile networks

    Internet Key Exchange version 2 (IKEv2) is the authentication protocol used with the IPSec (Internet Protocol Security) VPN protocol. Since IPSec operates in the background on the system’s kernel, it allows IKEv2 to be very fast.

    IKEv2 is implemented on most operating systems, so you can easily use it instead of the slower OpenVPN.

    Flow chart showing the IKEv2 IPsec protocol tunneling process.

    L2TP/IPsec

    Pros
    Cons
    Relatively secure
    Outdated
    L2TP does not encrypt itself
    L2TP doesn’t offer authentication
    Slow

    Layer 2 Tunneling Protocol (L2TP) is a tunneling protocol that does not provide security on its own and uses IPSec for encryption. L2TP encapsulates data twice, which slows down the connection speed.

    Flow chart showing the L2TP IPsec protocol tunneling process.

    WireGuard

    Pros
    Cons
    Secure
    Prone to DPI (Deep Packet Inspection) because it doesn’t offer obfuscation
    Only 4,000 lines of code
    Open-source
    Exceptional speed
    Connectionless
    Easy to set up

    WireGuard delivers a connection speed faster than IKEv2 and OpenVPN yet only uses 4,000 lines of code (to compare, OpenVPN clocks in at around 70,000). Its lightweight code allows easier auditing and, in theory, improves stability.

    While it doesn’t have years of experience and testing like OpenVPN, WireGuard offers top-tier security and encryption standards at an unmatched speed due to its simplicity. Implemented on major platforms, like Linux, macOS, Windows, Android, etc.

    *WireGuard is a registered trademark of Jason A. Donenfeld.

    PPTP

    Pros
    Cons
    Easy setup
    Not as secure as other alternatives
    Fast
    Known to be exploited
    Severely outdated
    Easily blocked by firewalls

    Point-to-Point Tunneling Protocol (PPTP) is an obsolete tunneling protocol that no VPN service should ever use. It only supports encryption ciphers up to 128 bits and is vulnerable to exploits like: 

    Flow chart showing the PPTP protocol tunneling process.

    SSTP

    Pros
    Cons
    Easily bypasses firewalls
    Code was never audited
    Can use industry-standard encryption
    Difficult to make compatible with operating systems apart from Windows
    Connections are stable even where network connectivity is unstable/unreliable
    Code isn’t open-sourced — unavailable for VPN developers to tinker with
    Easy setup on Windows OS

    Secure Socket Tunneling Protocol (SSTP) is a tunneling protocol that can send PPP (Point-to-Point Protocol) traffic. SSTP can run over port 443, which is often left open in firewalls, allowing the user to bypass them.

    SSTP does have its drawbacks: there’s a lack of compatibility with other operating systems besides Windows and Linux, and its code remains unaudited, which may lead some to speculate about security risks.

    Flow chart showing the SSTP protocol tunneling process.

    SoftEther

    Pros
    Cons
    Fast, stable, and secure
    Relatively new — hasn’t had much time for testing
    Comes with additional features to protocols like OpenVPN
    Open-source

    SoftEther is an open-source multi-protocol VPN client and server software. It adds advanced functionality features — GUI (Graphical User Interface) Management and RPC (Remote Procedure Calls) over HTTPS (Hypertext Transport Protocol).

    SoftEther was built for fast throughput, which, at least in theory, makes it faster than OpenVPN’s TCP mode. However, it hasn’t been around that long, so it’s not as tested as OpenVPN.

    What’s more, the SoftEther protocol utilizes a tunneling process based on the Secure Socket Layer (SSL). This means you’ll see similarities between how SSTP and SoftEther protocols “construct their tunnel.”

    Flow chart showing the softether protocol tunneling process.

    What about Shadowsocks?

    Commonly misunderstood, Shadowsocks is not a VPN protocol but a tunnel proxy based on the SOCKS5 protocol. It’s an open-source project specifically designed to bypass the Great Firewall of China. However, it’s not the most graceful setup to implement and run.

    Why choosing a different VPN protocol matters

    Simply connecting to a VPN server might be enough for you. As long as it works, there’s no need to worry about which VPN protocol you’re using, right? But the default setting isn’t always the best option. Here’s what the experts at NetBlocks say about it:

    The underlying protocol a VPN uses affects latency, performance, and reliability of the encrypted tunnel. Tracking connectivity around the world, we see that not all protocols are equal, so consumers should get familiar with the options,” says Alp Toker, founder and director of an independent internet monitoring organization NetBlocks.

    Common VPN protocol misconceptions

    VPN protocols determine your connection speed: only partially, as there are many other factors that impact your connection speed.

    VPN protocols determine your connection security: they do, and they don’t. The encryption algorithms do most of the “securing” by encrypting your data.

    You may wonder, what makes VPN protocols important, then?

    Protocols help VPN services build and configure their networks on an existing digital foundation.

    It is possible to develop and use your own protocols, but it would require appropriate know-how and a lot of time and resources. Most VPN providers use trusted and audited open-source protocols that support multiple operating systems. With that out of the way, let’s see how industry-standard protocols compare.

    Which VPN protocol should I choose?

    WireGuard and IKEv2/IPSec lead the way as the two best VPN protocols in the industry today. OpenVPN is a close third as it delivers similar results but is more difficult to work with. However, many routers are OpenVPN-compatible, so it’s handy if you want to set up a VPN on your home network.

    Truthfully, “best” is a strong word, and it’s impossible to pick one protocol that’s the best for every situation. Your decision should depend on your specific VPN needs and how you plan to use it. 

    Which VPN protocol is the most secure?

    Just like with the “best” category, there’s no such thing as “the most secure” VPN protocol. SoftEther, WireGuard, SSTP, IKEv2, and OpenVPN all achieve similar levels of security — and they’re really secure. All are trusted by names such as Surfshark and NordVPN, as well as many others in the industry.

    But even with secure protocols, what matters the most is how a provider builds and configures their VPN network. You probably shouldn’t trust a free VPN, even if it runs WireGuard! Free VPNs are often associated with selling user data, or worse — infecting devices with adware.

    Which VPN protocol is the fastest?

    A hand pulling a lever marked protocol.

    Contrary to popular belief, VPN protocols don’t have a dramatic impact on your connection speed. Here’s what really matters:

    • The speed of your internet connection;
    • Your device compatibility and quality;
    • VPN server load and throughput;
    • The distance between you and the VPN server.

    Which VPN protocol is the most stable?

    OpenVPN TCP tends to be the most stable protocol, especially when dealing with unreliable networks. Still, it comes at the price of speed. TCP takes a bit longer than UDP to relay every bit of information.

    Which VPN protocol is best for streaming?

    Don’t you love it when your favorite show starts buffering midway through? Yeah, me neither. You can avoid it by using fast and stable VPN protocols such as WireGuard and IKEv2/IPsec — both are great for streaming content safely and without buffering.

    Disclaimer: Please note that using Surfshark services for any illegal activities is strictly forbidden and violates our Terms of Service. Make sure that any use of Surfshark services for your particular activities conforms to all relevant laws and regulations, including those of any service providers and websites you access using Surfshark.

    Which VPN protocol is best for gaming?

    When playing games online, your performance depends not only on your skill but also on your connection speed.

    If you are planning on gaming with a VPN, to make sure you experience the lowest speed-drop, choose WireGuard as your primary VPN protocol. It’s the fastest option available today, which makes it the best choice for gaming.

    Why WireGuard, OpenVPN, and IKEv2 are the best VPN protocols

    Most protocols outside of WireGuard, OpenVPN, and IKEv2 are either outdated or full of vulnerabilities. There’s no good reason to use any other VPN protocol besides these three. 

    To be honest, one protocol is enough to provide a good VPN service, but due to the differences in compatibility for routers and different operating systems, we provide all three.

    Experience VPN protocols in action

    After this deep dive, you know everything about VPN protocols a user might need. To get the most secure VPN possible, it’s important to choose a protocol suited to your needs. We recommend using WireGuard or IKEv2 for general use and OpenVPN if you need to set up a VPN on your router. Good news: Surfshark offers all three!

    Put theory into practice
    Try the best VPN protocol for you
    Surfshark

    FAQ

    What protocol should I use for a VPN?

    Most VPNs will automatically choose the most suitable protocol for your connection, so you don’t have to worry about making this decision. Still, it’s always best to test them yourself. 

    What type of VPN is best?

    The best VPN is a reliable service that doesn’t log your online activity and has the resources to keep up with the newest security innovations. 

    What is the latest VPN protocol?

    WireGuard is the latest VPN protocol. It’s also well-regarded for being fast and secure.

    Is UDP good for a VPN?

    Yes. UDP is one of the best protocols for a VPN as it’s stable, reliable, and offers good speeds.

    What are the three most common VPN protocols?

    WireGuard, OpenVPN, and IKEv2/IPSEC are three of the best VPN protocols available today. That’s why they’re also the most popular among premium VPN providers.