Which VPN protocol is the fastest
For maximum speed, start with WireGuard. OpenVPN in UDP mode is also suitable for streaming, and speed and latency measurements on your line will determine the winner.
VPN Protocols: How They Differ and Which to Choose
A virtual private network (VPN) creates a secure tunnel between your device and a server. The protocol sets the rules for establishing and encrypting that tunnel and for packaging its packets. The right choice depends on the network: one option may be faster at home, while another connects better in a hotel.
Protocol and transport: two different settings
The transport carries the tunnel's packets. That is why OpenVPN UDP and OpenVPN TCP belong to the same family but behave differently.
- User Datagram Protocol (UDP): sends packets without waiting for delivery confirmation at this layer. It usually gives lower latency than TCP, especially on lossy networks; it suits video, calls and gaming.
- Transmission Control Protocol (TCP): verifies delivery and retransmits lost data. Connections over TCP are more likely to pass strict network filters, but retransmission waits can increase latency.
- QUIC: runs over UDP and provides secure connections. Hysteria2 is built on it; if UDP is fully blocked, this option is unavailable too.
- Transport Layer Security (TLS): encrypts the connection and verifies the server's authenticity. This protective layer operates on top of the transport and complements it.
TCP by itself does not strengthen encryption. For more on latency and network restrictions, see our comparison of UDP and TCP for VPN.
Which protocols appear in apps
VLESS and Hysteria2 are proxy protocols: they pass connections through an intermediate server. Compatible clients allow you to use them for your device's traffic.
| Protocol | Transport | Strength and when to choose it | Limitation |
|---|---|---|---|
| WireGuard | UDP only | First manual choice for gaming, video and mobile networks; supports network address changes | Does not disguise traffic, does not work over TCP |
| OpenVPN | UDP or TCP | UDP by default, TCP when UDP is unavailable; flexible configuration | Speed depends on the implementation and profile; TCP may add more packet latency |
| IKEv2/IPsec | IPsec | Built into operating system clients; network switching with the MOBIKE extension | Some networks restrict IPsec; MOBIKE is needed on both sides |
| VLESS in Xray | RAW/TCP, gRPC, XHTTP and other variants | Connections with different transport methods and external protection | The VLESS name alone does not confirm encryption |
| Hysteria2 | QUIC over UDP | An option to test on lossy lines | Depends on UDP availability; the advantage on your network needs to be verified |
| L2TP/IPsec | — | Compatibility with legacy infrastructure | L2TP itself does not encrypt; pairings with IKEv1 are outdated |
| PPTP | — | Do not choose for a new connection | Broken cryptographic protection |
The Internet Key Exchange version 2 (IKEv2) protocol negotiates keys, while Internet Protocol Security (IPsec) is a set of protocols that protects packets. The Mobility and Multi-homing extension (MOBIKE) helps maintain the connection when you change networks.
The Layer 2 Tunnelling Protocol (L2TP) provides no encryption of its own. Its pairings with IPsec and the older IKEv1 are outdated; this does not apply to the whole IPsec family. Do not use the Point-to-Point Tunnelling Protocol (PPTP) to protect traffic.
Xray is a software platform that implements VLESS. The former TCP transport is called RAW in its documentation. gRPC and XHTTP are other ways of carrying data; the server must support whichever option you select.
Speed and stability
It is reasonable to test WireGuard first, but its superiority on your network is not guaranteed. Hysteria2 is designed, among other things, for lossy lines; its traffic is intended to resemble HTTP/3. That does not guarantee invisibility or high speed. Speed factors and comparison methods are covered in our article on choosing the fastest VPN protocol.
On mobile networks, check how WireGuard or IKEv2/IPsec with MOBIKE copes with switching between networks.
What to check about connection security
WireGuard uses a fixed cryptographic suite with ChaCha20-Poly1305. OpenVPN negotiates the cipher: the default list in version 2.6 includes the Advanced Encryption Standard (AES) in the AES-256-GCM and AES-128-GCM variants and, where available, ChaCha20-Poly1305.
Plain VLESS needs an external protection layer such as TLS or REALITY. A mere "VLESS" label does not confirm encryption.
The UK's National Cyber Security Centre (NCSC) notes that, all else being equal, the risks of using IPsec and TLS VPNs differ little. That conclusion comes from its guidance for organisations; consumer services are not ranked there. Check your settings and keep your client up to date. Algorithms and outdated options are covered in our article on encryption and the security of protocols.
What to try on your network
Switching protocols helps when there is an incompatibility with the network. It will not fix an overloaded server or a weak radio signal.
| Situation | What to try | What to assess |
|---|---|---|
| Home video or online gaming | WireGuard, then OpenVPN UDP | Video buffering, latency and stuttering in the game |
| Switching between Wi-Fi and mobile network | WireGuard or IKEv2/IPsec with MOBIKE | Whether transmission resumes after the network changes |
| UDP is unavailable | OpenVPN TCP or VLESS over TCP with TLS/REALITY protection | Whether the connection is established and pages load |
| Lossy line with UDP available | Hysteria2 | Whether pauses and dropouts become less frequent |
| Public Wi-Fi with a sign-in page | Complete the network sign-in first, then enable the VPN | Whether traffic passes through the secure connection |
An example scenario: at home WireGuard works, but in a hotel the connection fails to establish because UDP is restricted. Switching to OpenVPN TCP may restore access; with a full UDP block, Hysteria2 will not connect either.
For switching between different types of connection, I recommend CitadelVPN: all plans include VLESS tcp/gRPC/xhttp and Hysteria2, while MAX adds WireGuard/OpenVPN configurations, including for compatible routers. Check that the profile you need is compatible with your client, and for a router, confirm the model and firmware. The availability of each connection depends on the network.
Frequently asked questions about settings
Should I keep automatic mode or choose manually?
Adaptive in OpenVPN Connect selects the transport only from the options recorded in the profile. Switch to manual selection if the connection fails to establish or keeps dropping; in other apps, the capabilities of automatic mode may differ.
Do VLESS and Hysteria2 protect all of the device's traffic?
Only if the client routes that traffic through the secure connection. This may use a virtual network interface (TUN) or the system VPN mode; a plain proxy setting in one app does not cover the rest of your programs.
Which VPN protocol is the best?
There is no single best option. The Electronic Frontier Foundation (EFF) counts WireGuard and OpenVPN among the widespread options, but does not vouch for VPN services or their ratings. What matters when choosing is how the connection performs on your network.
How to make the decision and check the result
Start with automatic mode or WireGuard. If UDP is unavailable, try OpenVPN TCP or secured VLESS over TCP. For a lossy line with UDP available, test Hysteria2. Exclude PPTP and IKEv1.
Check whether the connection establishes and whether traffic flows without interruptions. To switch, use our guide to changing the VPN protocol: the setting may be in the app's preferences or in the list of individual profiles.