OpenVPN
Open-Source VPN Protocol
The workhorse VPN protocol that defined the category for two decades. Highly configurable and battle-tested, its standout trick is a TCP mode that disguises itself as ordinary HTTPS to slip through almost any firewall.
OpenVPN is a mature, open-source VPN protocol that builds an encrypted tunnel using the well-established OpenSSL library. For many years it was the default choice for commercial VPN apps and corporate remote access, thanks to its flexibility, broad platform support, and strong, configurable security. Newer protocols like WireGuard have since overtaken it on raw speed, but OpenVPN remains widely used and has one feature that keeps it relevant.
UDP or TCP — the key choice
OpenVPN's defining flexibility is that it runs over either transport:
| Mode | Best for | Trade-off |
|---|---|---|
| OpenVPN over UDP | Everyday use — faster, lower latency | May be blocked on locked-down networks |
| OpenVPN over TCP (port 443) | Evading firewalls — looks like HTTPS | Slower due to TCP-in-TCP overhead |
The TCP-on-443 trick is OpenVPN's superpower: because it is indistinguishable from normal encrypted web traffic, it gets through restrictive firewalls and captive networks that block other VPN protocols outright.
Strengths and weaknesses
Strengths: a long, well-scrutinised track record; highly configurable ciphers and options; runs almost everywhere; and the firewall-friendly TCP mode. Weaknesses: a large, complex codebase that is harder to audit; slower performance and higher CPU use than WireGuard; and more involved configuration. The very flexibility that makes it powerful also makes it heavier and more error-prone to set up by hand — which is why most people use it through a VPN provider's app rather than raw config files.
OpenVPN vs WireGuard vs IPsec
Among the three mainstream protocols, the rough division is: WireGuard for speed and simplicity, IPsec for standards-based and site-to-site corporate setups, and OpenVPN for maximum compatibility and firewall evasion. None is universally "best" — the right choice depends on whether you prioritise throughput, the need to bypass blocking, or integration with existing infrastructure.
Does it slow your connection?
Like any VPN protocol, OpenVPN adds encryption overhead and routes traffic through an extra server, so some speed loss is normal — typically more than WireGuard because of its heavier processing, and more again in TCP mode. On a fast connection the difference is often unnoticeable for browsing; on slower links or for large transfers it is more visible. If speed matters and your network does not block it, UDP mode (or switching to WireGuard) recovers most of the loss.