VPN Protocols Explained: WireGuard, OpenVPN, IKEv2, SSTP, and Which to Use

Open the settings menu in almost any VPN app, and you’ll find a dropdown with four or five acronyms in it, without much explanation, and a default option already selected. Most people leave it at that, which is usually the right call. 

However, it stops being the right call the moment a connection won’t establish, a network starts blocking things, or a phone loses the encrypted tunnel every time it leaves the house.

What Is a VPN Protocol?

A VPN protocol is the set of rules and algorithms that controls how your device establishes a connection to a VPN server, how your data is encrypted in transit, and how that VPN connection is maintained. 

Different VPN protocols make different trade-offs between browsing speed, security, device compatibility, and battery usage. Most VPN apps pick one protocol as the default and let users switch if the default stops working.

VPN protocols and encryption are separate things, which is a common source of confusion. The protocol decides how the tunnel is built and managed; the cipher (encryption) decides how the data inside it is scrambled (encrypted). A fuller walkthrough of that process sits in this explainer on how VPN encryption works.

The Trade-off Behind Every Protocol

Every VPN protocol in this article is answering the same question with a different priority.

Speed comes from doing less: fewer negotiated options, less code in the path, processing as close to the kernel as possible. Compatibility comes from doing more: supporting multiple transports, multiple ciphers, multiple authentication systems, and older hardware that nobody wants to support but plenty of people still use. 

A VPN protocol optimized for one priority is structurally worse at the other, which is why the fastest protocol available is also the easiest to block, and the most blockable-resistant option is also the slowest.

This is why most VPN providers offer at least one VPN protocol: giving you agency to decide on what you need.

The Main VPN Protocols

Out of the six VPN protocols available, two are considered standard. One is a strong option for smartphones. Two have narrow, specific use cases. The last one should never be used.

WireGuard: Fast, Modern, Default

WireGuard is the newest VPN protocol and the current default for most privacy-focused providers. It runs inside the operating system kernel with approximately 4,000 lines of code (far less than the alternatives), which makes it both fast and realistically reviewable. 

WireGuard’s encryption is ChaCha20 paired with Poly1305, transport is UDP only, and the result is higher throughput, lower latency, and better battery life than anything older. 

Mysterium VPN's WireGuard protocol implementation covers the specifics.

• Use when: everyday browsing, streaming, gaming, and any stable network.

OpenVPN: Established, Firewall-Friendly

OpenVPN is the most widely deployed VPN protocol and has the longest track record of any option here. It supports both UDP, which is faster, and TCP, which is more compatible. 

OpenVPN’s key advantage is TCP port 443, the same port every HTTPS site uses, which lets it pass through firewalls that block VPN-specific ports without also breaking normal web browsing. 

Encryption is typically AES-256 encryption. It’s heavier than WireGuard and considerably more configurable, and the full comparison is in this WireGuard vs OpenVPN guide.

• Use when: WireGuard is blocked, or on restrictive and corporate networks.

IKEv2/IPSec: Mobile Roaming

IKEv2, paired with IPSec, is built for phones. Its MOBIKE extension lets a tunnel survive a change of network, so a session continues uninterrupted when a device moves from Wi-Fi to mobile data. Browsing speed sits between the two protocols above: faster than OpenVPN, but behind WireGuard. 

Encryption is AES-based. Its fixed ports, 500 and 4500, make it straightforward to identify and block on restrictive networks. The detailed comparison is available in our WireGuard vs IKEv2 breakdown.

• Use when: switching between Wi-Fi and cellular repeatedly throughout the day.

SSTP: Windows Firewall Traversal

SSTP (Secure Socket Tunneling Protocol) was developed by Microsoft and is built into Windows. It runs over SSL/TLS on TCP port 443, which gives it the same firewall advantage OpenVPN has over TCP.

The limitation is reach: it’s effectively Windows-only in practice, and few consumer VPN providers support it. Mysterium VPN doesn’t.

• Use when: inside a Windows-specific corporate environment with no WireGuard or OpenVPN option available.

L2TP/IPSec: Legacy, Avoid If Possible

L2TP provides the tunnel, and IPSec provides the encryption, and the double encapsulation costs speed. It was a common default on older devices and in built-in operating system VPN clients, which is the main reason it still appears in menus. 

There’s no known critical flaw, but it’s outperformed by WireGuard, OpenVPN, and IKEv2 in every category that matters, and most VPN providers are phasing it out.

• Use when: nothing else is available on a legacy device.

PPTP: Obsolete, Don’t Use

PPTP (Point-to-Point Tunneling Protocol) dates from the 1990s, and its encryption is broken. The MS-CHAPv2 authentication it relies on has known, demonstrated, exploitable weaknesses.

It’s fast only because it barely protects anything. A provider offering PPTP nowadays is telling you something about its overall approach to your security.

• Use when: never.

Proprietary Protocols You'll See in App Settings

Two more names turn up in VPN apps and aren’t on the list above, because they’re not separate protocols. 

1. NordVPN's NordLynx is built on WireGuard with an added layer for handling IP assignment. 
2. ExpressVPN's Lightway is a protocol the company developed in-house and has published as open source. 

Both sit in the same design space as WireGuard: small codebase, modern ciphers, fast handshakes.

The practical takeaway is that a settings menu listing a branded protocol name is usually offering one of the six above with a modification, not a seventh option with different properties.

VPN Protocol Comparison Table

Which Protocol Should You Use?

Three scenarios cover almost everyone.

1. By default, use WireGuard: It’s the fastest, has the smallest codebase, and is the right answer for everyday browsing, streaming, and gaming on a stable connection.
2. If WireGuard is blocked, switch to OpenVPN: It resembles ordinary HTTPS traffic and passes through most networks that filter VPN protocols by port.
3. If the network changes constantly, consider IKEv2: MOBIKE keeps the tunnel alive across Wi-Fi and cellular transitions, which no other protocol here does as cleanly.

Never use PPTP for anything that matters.

What Protocol Does Mysterium VPN Use?

Mysterium VPN uses WireGuard as our default protocol, chosen for its speed, small codebase, and modern cryptographic design. 

OpenVPN was recently added as a fallback for networks where WireGuard's UDP traffic is blocked, and it’s available on Windows, Mac, iOS, and Linux, though not on Android. 

Switching between them is easily done in the app's settings. 

Readers who want both protocols on one subscription covering 15 devices with a single account can get Mysterium VPN for $2.29/mo.