VPN Protocols Explained: WireGuard, OpenVPN, IKEv2 and Stealth Mode

Every VPN connection runs on a protocol: a set of rules that decides how your device and the VPN server prove who they are, agree on encryption keys, and package your data for the journey. The protocol affects your speed, battery life, stability when switching networks, and whether the connection gets through restrictive firewalls at all.

Most VPN apps, including PD-Proxy, let you pick the protocol yourself. This guide explains what the main options actually do, covers the cryptography in plain English, compares them side by side, and ends with clear advice on which protocol to select in the PD-Proxy app for each situation.

What a VPN protocol actually does

A VPN protocol has two main jobs, usually handled by two separate parts:

• The handshake (control channel). When you connect, your device and the server authenticate each other and agree on fresh session keys using key-exchange cryptography. This is where certificates, public keys and Diffie-Hellman exchanges come in.
• The data channel. Once keys are agreed, every packet you send is encrypted and authenticated with a fast symmetric cipher, wrapped in a new packet addressed to the VPN server, and sent over UDP or TCP.

A good protocol does both securely, efficiently and with as little complexity as possible, because complexity is where bugs hide. If you are new to VPNs in general, start with why you should use a VPN and come back here for the technical details.

The cryptography in plain English

Symmetric ciphers: AES-256-GCM and ChaCha20-Poly1305

Your actual data is encrypted with a symmetric cipher, where both sides share the same key. Two ciphers dominate modern VPNs, and both are AEAD ciphers (authenticated encryption with associated data), meaning they encrypt the data and also detect any tampering in a single step.

• AES-256-GCM is the industry standard. Most modern desktop and phone processors have hardware AES instructions, which make it extremely fast.
• ChaCha20-Poly1305 is designed to be fast in software, without special hardware. It performs very well on devices without AES acceleration and is resistant to timing side-channel attacks by design.

Both are considered secure. The practical difference is performance on particular hardware, not safety.

Key exchange and authentication

Before any data flows, both sides need a shared secret that an eavesdropper cannot compute. Protocols use Diffie-Hellman key exchange for this, today almost always the elliptic-curve variant (ECDH), with curves such as Curve25519. Authentication proves you are talking to the genuine server rather than an impostor, using certificates (OpenVPN, IKEv2) or pre-shared public keys (WireGuard).

Perfect forward secrecy

Perfect forward secrecy (PFS) means that each session uses temporary (ephemeral) keys that are discarded afterwards. Even if an attacker records your encrypted traffic today and somehow steals a server's long-term private key next year, they still cannot decrypt the recorded sessions, because the session keys were never derived from that long-term key alone. WireGuard, OpenVPN with modern TLS settings, and IKEv2 all provide forward secrecy and periodically re-key during long connections.

UDP vs TCP

The encrypted packets travel inside UDP or TCP:

• UDP sends packets without waiting for acknowledgements. It is faster and has lower latency, which suits VPNs because the traffic inside the tunnel (for example your web browser's TCP connections) already handles retransmission.
• TCP guarantees delivery and order. It gets through more firewalls, especially on port 443, but running TCP traffic inside a TCP tunnel can cause the "TCP meltdown" effect: when packets are lost, both layers retransmit, and throughput can collapse on poor connections.

Rule of thumb: use UDP whenever it works, and fall back to TCP when a network blocks or throttles UDP.

WireGuard

WireGuard is the newest of the mainstream protocols and has quickly become the default choice for many users. It was designed to be small, fast and easy to audit: its core is only a few thousand lines of code, compared with the far larger codebases of OpenVPN and IPsec implementations. It has been part of the Linux kernel since version 5.6 and is available on all major platforms.

How WireGuard works

• Fixed, modern cryptography. Curve25519 for key exchange, ChaCha20-Poly1305 for encryption, BLAKE2s for hashing and HKDF for key derivation. There is no cipher negotiation, so there are no weak options to downgrade to.
• A fast handshake based on the Noise protocol framework, completing in a single round trip. Session keys are rotated automatically every few minutes, providing forward secrecy.
• UDP only. WireGuard does not run over TCP. On networks that block UDP it will not connect without an additional wrapper.
• Silent by design. A WireGuard server does not respond to packets that are not properly authenticated, which makes it hard to discover by scanning.

Strengths and trade-offs

WireGuard typically delivers the highest throughput and lowest latency, connects almost instantly and uses little battery, which makes it excellent on phones as well as desktops. Its original design associates each user's public key with a fixed internal IP address on the server; privacy-focused providers address this by assigning addresses dynamically and not retaining them after the session. Its main practical limitation is the lack of TCP support on restrictive networks.

OpenVPN

OpenVPN has been the workhorse of the VPN industry for around two decades. It is open source, heavily audited and runs on almost anything.

How OpenVPN works

• TLS-based control channel. OpenVPN uses TLS (via a library such as OpenSSL) for authentication and key exchange, with certificates and ephemeral ECDH keys for forward secrecy.
• Configurable data channel. Modern versions negotiate AEAD ciphers such as AES-256-GCM or ChaCha20-Poly1305. PD-Proxy uses AES-256-GCM.
• UDP or TCP. OpenVPN can run on either, on any port. Its registered default is UDP 1194, and TCP on port 443 is commonly used to pass through firewalls.
• Extra protections such as a TLS authentication key that drops unauthenticated packets before they reach the TLS stack, reducing exposure to scanning and denial-of-service.

Strengths and trade-offs

OpenVPN's flexibility and track record make it a dependable choice, especially OpenVPN TCP on networks where nothing else gets through. It is generally slower than WireGuard, because it runs in user space and carries more protocol overhead, and connecting takes a little longer. On mobile it reconnects less gracefully when you switch networks.

IKEv2/IPsec

IKEv2 (Internet Key Exchange version 2) handles authentication and key negotiation, while IPsec (specifically ESP, Encapsulating Security Payload) encrypts the data. Together they form a standards-based protocol suite that is built into Windows, macOS, iOS and many Android devices.

How IKEv2/IPsec works

• Key exchange runs over UDP port 500, and traffic switches to UDP port 4500 when NAT traversal is needed, which is the case on most home and public networks.
• Modern configurations use AES-GCM ciphers and ephemeral Diffie-Hellman groups (including elliptic curves) for forward secrecy.
• MOBIKE (the IKEv2 mobility and multihoming extension) lets an established tunnel move to a new IP address without a full reconnection.

Strengths and trade-offs

MOBIKE is IKEv2's standout feature: when your phone hops from home Wi-Fi to mobile data on the way out the door, the VPN stays up with barely a pause. IKEv2 is also fast and power-efficient. The downsides are that it uses fixed UDP ports, so it is easy for firewalls to block, and implementations vary more between vendors than WireGuard's single reference design.

Legacy protocols: PPTP and L2TP/IPsec

PPTP: do not use it

PPTP (Point-to-Point Tunnelling Protocol) dates from the 1990s. Its common authentication method, MS-CHAPv2, has been shown to be crackable, and its MPPE encryption relies on the RC4 stream cipher, which has well-known weaknesses. An attacker who captures a PPTP handshake can recover the credentials and decrypt the session. PPTP is also absent from current Apple operating systems. It offers no meaningful security today, which is why PD-Proxy does not offer it.

L2TP/IPsec: outdated

L2TP (Layer 2 Tunnelling Protocol) provides no encryption itself; it relies on IPsec wrapped around it. When configured well it is not broken, but it double-encapsulates traffic, which adds overhead, uses fixed ports (UDP 500, 4500 and 1701) that are easy to block, and is frequently deployed with a shared pre-shared key published for all users of a service, which weakens its protection against impersonation. IKEv2/IPsec does everything L2TP/IPsec does, better, so there is little reason to choose L2TP today.

Obfuscation and stealth modes

Some networks actively block VPNs. Hotels, universities, workplaces and some countries use deep packet inspection (DPI) to recognise VPN protocols by their packet patterns and handshake signatures, then block or throttle them. WireGuard, OpenVPN and IKEv2 are all identifiable to a determined DPI system.

Obfuscation disguises VPN traffic as something ordinary. PD-Proxy's Stealth mode runs the tunnel over TCP port 443, the port used by HTTPS, and wraps it so that the traffic resembles a normal encrypted web connection. Because blocking port 443 would break the web for everyone, stealth traffic usually gets through where standard protocols fail.

• Use Stealth when standard protocols fail to connect, disconnect repeatedly, or are unusually slow on a particular network.
• Expect some overhead: it runs over TCP and adds a wrapping layer, so it is usually slower than WireGuard on the same connection.
• Follow local law and network rules. Obfuscation helps with technical restrictions; it does not change what is permitted where you are.

Protocol comparison table

Which protocol to choose in the PD-Proxy app

The PD-Proxy apps for Windows, macOS, Linux, Android and iOS offer WireGuard, OpenVPN (UDP and TCP), IKEv2/IPsec and Stealth mode. Here is how to choose:

• Everyday use at home or at work: WireGuard. It gives the best balance of speed, security and battery life.
• Streaming and gaming: WireGuard on a nearby server, or one of our streaming and gaming servers, for the lowest latency.
• Phones on the move: WireGuard or IKEv2. If your connection drops when switching between Wi-Fi and mobile data, try IKEv2.
• Public Wi-Fi in cafés and hotels: WireGuard, with auto-connect and the kill switch enabled through Wi-Fi Protection. If it will not connect, try OpenVPN TCP, then Stealth.
• Corporate, school or hotel networks that block VPNs: Stealth mode, or OpenVPN TCP as a second option.
• Unstable or lossy connections: OpenVPN UDP can be more forgiving than TCP-based options; avoid TCP-over-TCP where possible.
• When something seems off: switch protocol and server, then re-check with a DNS and IP leak test.

If speed is your main concern, protocol is only one factor; server distance, load and your local network matter too. Our article on how to make your VPN faster walks through the rest. Free users can try all protocols on the demo servers, while Premium unlocks all 40+ locations with unlimited bandwidth.

Frequently asked questions

Is WireGuard more secure than OpenVPN?

Both are considered secure when properly implemented. WireGuard's advantage is simplicity: a small codebase with a fixed set of modern algorithms is easier to audit and leaves no room for weak cipher choices. OpenVPN's advantage is maturity and flexibility, including TCP support.

Is AES-256 better than ChaCha20?

Neither is meaningfully "stronger" in practice; both are trusted, modern ciphers with 256-bit keys. AES-256-GCM is faster on hardware with AES acceleration, while ChaCha20-Poly1305 is faster on devices without it.

Why does my VPN connect on mobile data but not on hotel Wi-Fi?

The hotel network is probably blocking UDP or the specific ports your protocol uses. Switch to OpenVPN TCP or Stealth mode, which run on TCP and, in Stealth's case, on port 443.

Should I use UDP or TCP?

Use UDP by default because it is faster and has lower latency. Choose TCP only when UDP is blocked or unreliable on the network you are using.

Why doesn't PD-Proxy offer PPTP?

Because PPTP's authentication and encryption are known to be breakable. Offering it would give users a false sense of security. WireGuard, OpenVPN and IKEv2 are faster or comparable, and far more secure.

Conclusion

You do not need to be a cryptographer to choose a VPN protocol. Start with WireGuard for speed and simplicity, switch to IKEv2 if you want seamless roaming on a phone, use OpenVPN TCP or Stealth when a network gets in the way, and leave PPTP and L2TP in the past. All the modern options use strong ciphers and perfect forward secrecy; the right choice simply depends on your device and the network you are on.

Want to try them yourself? Create a free PD-Proxy account, install the app and switch protocols in settings to see which one works best for you.