A virtual private network (VPN) routes traffic through a secure connection to a server. The protocol defines the rules of that connection. To choose an initial option, use the overview of VPN protocols; here we look at where to change the setting and how to check whether it helps.
When it is worth changing the protocol
Start by checking your internet connection without the VPN. If websites do not open even after you disconnect, restore your normal connection first. Changing the protocol will not fix that problem.
| What is happening | What to try |
|---|---|
| The VPN will not connect, ordinary internet works | Automatic selection or another supported protocol |
| The connection drops when switching from Wi-Fi to mobile data | Another available protocol, re-testing the same transition |
| Low speed on one server | Another server, then another protocol under comparable conditions |
| The connection works steadily | Keep the current setting |
Automatic selection picks an option to suit the current network, within the capabilities of the client and server. In the settings it may be called "Auto", while manual selection is called "Manual". Manual mode is useful when you are investigating a specific fault. It does not, by itself, speed up the connection.
Where to find the setting in your client
On Android, iOS, Windows and macOS, the path depends on the app. Start with the Settings, Protocol or Connection sections. There is no single menu common to all clients.
| Client type | Where to switch | What changes | What to check |
|---|---|---|---|
| OpenVPN Connect | Menu → Settings → VPN Protocol | The transport, or its automatic selection | Whether a connection is established |
| WireGuard | List of profiles | The server and profile parameters | Whether the new profile works |
| Subscription client | List of connections after an update | A ready-made configuration, sometimes the protocol | Which connection is selected |
| Windows 11 built-in VPN | Connection properties → edit | The VPN type | Whether it matches the server settings |
OpenVPN Connect: choose Adaptive, TCP or UDP
In OpenVPN Connect the switch changes the OpenVPN transport, that is, the way packets are sent. The User Datagram Protocol (UDP) sends them without built-in delivery confirmation. The Transmission Control Protocol (TCP) checks delivery and retransmits lost data.
- Disconnect the current connection.
- Open the menu icon → Settings → VPN Protocol.
- Select Adaptive, TCP or UDP.
- Start the connection again.
These names are confirmed by the OpenVPN Connect documentation for Android, iOS and Windows. For another client, check its own settings.
- Adaptive: chooses the transport from the options recorded in the service's profile. Start with it; it will not add an option that is absent from the profile.
- UDP: try this if a connection over TCP is slow and the server supports UDP.
- TCP: try this if UDP does not connect on the current network and the server accepts TCP.
According to the OpenVPN Connect documentation, the Connection Timeout — the connection attempt time — is 10 seconds by default. This is a limit on how long to wait for a connection, not an assessment of its speed. The reasons for choosing a transport are covered separately in the comparison of UDP and TCP.
WireGuard: change the profile or the client
WireGuard works over UDP only. You cannot switch it to TCP in the settings: this is a limitation of the protocol itself.
Choose another profile issued by the service if you want to test a different server. To move to OpenVPN you will need the corresponding configuration and a compatible client. Renaming a profile or changing the port does not turn WireGuard into a different protocol.
VLESS and Hysteria2: choose a connection from your subscription
In clients such as v2rayNG and Hiddify, the parameters often arrive in ready-made connections. Here VLESS and Hysteria2 denote the protocols the client uses to carry traffic through the server. Instead of a general switch, you choose a different configuration.
If your service works through a subscription, you can switch by changing the connection in a compatible client. In CitadelVPN, your account provides a subscription link and separate VLESS links for a compatible client. A subscription lets you load a list of connections without manually entering the parameters of each server.
- Copy the subscription link from your account.
- Add it to a compatible client.
- Update the list of connections.
- Select a different connection.
- Reconnect.
For example, you can choose Hysteria2 instead of VLESS if that option is present in your subscription and supported by the client. A different server name does not, by itself, mean a different protocol. Button names vary; if the setting does not work, send CitadelVPN support the client's name, the platform and the error message. Support will help with the connection.
Windows 11: specify the type the server supports
For an existing connection, open "Settings" → "Network & internet" → VPN, select the connection, then "Advanced options" → "Edit". For a new one, use "Add VPN" and the provider "Windows (built-in)".
In the "VPN type" field, select the option given in your service's instructions or by your administrator. According to Microsoft's guidance, it must match the server. Save the settings and reconnect. On a work device, change VPN settings in line with your employer's rules.
How to check whether the switch helped
- Wait for the "Connected" status in the client.
- Open the website or app you need.
- Repeat the action during which the fault occurred: for example, switching to mobile data.
- Compare speed and latency using the protocol testing method on the same network and, where possible, the same server.
Change one parameter at a time. If you simultaneously choose a different protocol, a different server country and a different network, the cause of the improvement will remain unclear.
Do not switch to the outdated Point-to-Point Tunnelling Protocol (PPTP) or the Layer 2 Tunnelling Protocol (L2TP) for the sake of speed. PPTP has known security problems, and L2TP does not encrypt traffic on its own. Arbitrarily weakening protection does not help you compare connections properly.
Frequently asked questions
Do I need to reconnect manually after changing the setting?
A new connection is necessary. Some clients restart it themselves; if yours does not, disconnect and reconnect manually.
Which client should I choose for a VLESS subscription?
On Android, v2rayNG will do; for several platforms you can choose Hiddify. Before installing, check support for the specific connection from your subscription: compatibility with VLESS does not guarantee support for all its other variants.
I have changed the protocol, but websites still do not open. What should I do?
Try another server and check your internet connection without the VPN. The cause may lie with the server, the network or the Domain Name System (DNS), which converts a website's address into a network address. Report the connection status and the exact error message to support.
Which setting to keep
Keep the option that lets the service you need open without the earlier fault coming back. In OpenVPN Connect, start with Adaptive; test UDP or TCP manually only for a specific problem. In WireGuard, change the profile; in a subscription client, choose a ready-made connection; and in the built-in Windows VPN, use the type specified by the service. If your internet does not work without the VPN, restore the network first.