A VPN protocol is code that runs with high privileges and parses data from the open internet. The less of it there is, the less there is to get wrong.
That was the pitch of the original WireGuard paper. Its authors wrote that they implemented the protocol for Linux "in less than 4,000 lines of code", excluding cryptographic primitives, and that this makes it easy to audit and verify. They contrast it with OpenVPN, which the paper describes as a user-space daemon that supports the entire plethora of TLS functionality and is therefore "enormously complex".
This post is for developers who use a VPN every day and want to know what that difference means in practice: what the config looks like, what you gain, and where the older option still wins.
In this post: Comparison · Config · OpenVPN · Commercial clients · FAQ
What you are actually comparing
The paper compares WireGuard with IPsec and OpenVPN on three axes: simplicity, performance and cryptography.
| Axis | WireGuard | OpenVPN |
|---|---|---|
| Code size | Under 4,000 lines for the Linux implementation, excluding crypto primitives | Full TLS stack, including certificate parsing |
| Where it runs | Linux kernel implementation | User-space daemon |
| Transport | UDP | UDP or TCP, including port 443 |
| Cryptography | Fixed modern primitives, no cipher negotiation | Negotiated through TLS |
| Identity | Public keys | Certificates and a CA |
Code size. The paper's figure is under 4,000 lines for the Linux implementation, excluding crypto primitives. OpenVPN carries the full TLS stack, including certificate parsing, and runs as a user-space daemon.
Performance. The authors benchmarked WireGuard against IPsec and OpenVPN with iperf3 and reported that WireGuard won on both throughput and ping. They explain the OpenVPN gap by its user-space design, which adds copying between kernel and user space. These are the authors' numbers from the paper, so treat them as a starting point and measure on your own link.
Cryptography. WireGuard's site lists a fixed set of modern primitives, including ChaCha20, Poly1305 and Curve25519. There is no cipher negotiation, so there is no downgrade path to a weak suite. If a primitive is ever broken, the protocol version changes rather than a setting.
What a config looks like
The WireGuard quickstart shows the low-level tools, and wg-quick automates the rest. A client config with placeholder keys looks like this:
[Interface]
PrivateKey = <client-private-key>
Address = 10.0.0.2/32
DNS = 10.0.0.1
[Peer]
PublicKey = <server-public-key>
Endpoint = vpn.example.com:51820
AllowedIPs = 0.0.0.0/0, ::/0
PersistentKeepalive = 25
Bring it up and check it:
sudo wg-quick up wg0
sudo wg show
Three details that matter:
-
AllowedIPs = 0.0.0.0/0, ::/0sends all traffic through the tunnel. A narrower value gives you a split setup for just one subnet, which is how many teams reach a private network. -
PersistentKeepalive = 25keeps the mapping alive through NAT. The quickstart suggests 25 seconds as a sensible value. - Keys are the identity. A peer is a public key. You do not run a CA or revoke certificates; you remove a peer from the config.
Where OpenVPN is still the right tool
WireGuard runs over UDP. That is fine at home and at the office, and it fails on some hotel, airport and corporate networks that only let TCP on port 443 through.
OpenVPN can run over TCP, including port 443, so it looks like ordinary HTTPS to a basic firewall. It is slower there, because TCP inside TCP behaves badly on lossy links, but a slow tunnel beats no tunnel. It also has mature tooling for certificate-based setups, which some organizations already depend on.
So the rule I use: WireGuard by default, OpenVPN when UDP is blocked.
What to look for in a commercial VPN client
If you do not run your own server, you pick a provider, and the protocol list is one of the few things you can check from outside.
- Default protocol. It should be WireGuard unless you have a reason otherwise.
- A fallback. At least one TCP-capable option for hostile networks.
- Many devices per account. One config per device is the WireGuard model, so check the device limit.
Atomic VPN lists WireGuard as its default, with OpenVPN and IKEv2/IPsec as alternatives. The apps are available for Windows, macOS and Android, and iOS is listed as coming soon. If you are on a network that eats UDP, switching protocol in the app is the first thing to try before you blame the provider.
One caution that applies to every provider: a small protocol codebase says nothing about what a company logs. The protocol protects the tunnel. The privacy policy decides what happens at the other end.
FAQ
Is WireGuard more secure than OpenVPN?
It has a much smaller codebase and no cipher negotiation, which reduces attack surface. Neither protocol is secure if the provider logs your traffic.
Does WireGuard work on Windows, macOS and Android?
Yes, WireGuard has clients for all three, and commercial VPN apps usually bundle it.
Why is WireGuard faster?
The paper attributes the OpenVPN gap to user-space overhead and reports better throughput and latency in its own benchmark. Your results depend on your link.
Why does WireGuard fail on some Wi-Fi networks?
It uses UDP. Networks that only allow TCP 443 block it. Use OpenVPN over TCP there.
Do I need to run my own WireGuard server?
No. You can use a provider. Self-hosting gives you control over the endpoint and logging, and costs you the maintenance.
What does AllowedIPs do?
It is both a routing table and an access list for the peer. 0.0.0.0/0 routes all IPv4 traffic through the tunnel.
Bottom line
If your network allows UDP, use WireGuard and spend your time on something other than tunnel configuration. If it does not, keep OpenVPN over TCP 443 as the fallback. Either way, check the protocol you actually connected with, because the default in the app is only a default.
Want WireGuard without running your own server? See the protocols on atomicvpn.io.
Which protocol do you run by default, and what made you switch? Tell me in the comments.
Top comments (0)