WireGuard won the protocol argument some time ago, and mostly deservedly. But the numbers people quote for it are usually from a lab test on a LAN, and the gap on a real consumer connection is smaller and more nuanced than the headline suggests.
Speed
Across all ten providers in our current top ten, on identical servers, WireGuard averaged 11% faster than OpenVPN UDP. On nearby servers the gap narrowed to 7% because both protocols were bumping against the line rate rather than the CPU. On long-haul routes it widened to 19%, where WireGuard's smaller handshake and lower overhead per packet start to matter.
Against OpenVPN over TCP the gap is enormous — 40% and up — but that is not a fair comparison. Nobody should be running OpenVPN TCP unless a network is forcing them to.
Reconnection
This is where WireGuard's advantage is least disputed and most underrated. Median time to usable connection after a network change: 0.4 seconds for WireGuard, 3.8 seconds for OpenVPN. If you move between Wi-Fi and cellular a lot, that difference is more noticeable day to day than any speed figure.
The privacy caveat
Vanilla WireGuard keeps a static IP address assigned to your public key on the server for the session, which is state that OpenVPN does not need to hold. Providers work around this with a layer on top — double-NAT, rotating assignment, or a proprietary wrapper such as NordVPN's NordLynx. Every provider in our top ten that ships WireGuard does something here, but the implementations differ and only some publish exactly what theirs does.
If a provider offers WireGuard and cannot tell you how they handle the key-to-IP mapping, that is a fair question to ask support before you buy.
What we run
WireGuard, on every machine, unless a network blocks it — at which point obfuscated OpenVPN over TCP 443 is the fallback that gets through. That is also the configuration we recommend to readers, and it is why we score providers who ship both protocols higher than providers who ship one.
When OpenVPN is still the right answer
On restrictive networks. WireGuard runs over UDP and is relatively easy to identify and block, which is why hotel, corporate and school networks frequently stop it. Obfuscated OpenVPN over TCP 443 is indistinguishable from ordinary HTTPS traffic at a glance and gets through almost everywhere.
That is not a small caveat. It is the reason we score providers who ship both protocols higher than providers who ship only one, and the reason we would not personally use a WireGuard-only provider as our sole VPN if we travelled regularly.
Battery and CPU
WireGuard's smaller codebase and lower per-packet overhead translate into measurably less CPU work, which matters on phones. In our mobile testing the difference in battery drain over a sustained session was noticeable, though smaller than the difference between having a VPN on at all and having it off.
What about IKEv2?
Still useful on iOS specifically, where it is well integrated at the operating system level and handles network handover cleanly. It is slower than WireGuard and its implementations vary more in quality, so we treat it as a fallback rather than a first choice.
WireGuard by default, obfuscated OpenVPN when a network forces it. That is the configuration we run and the one we recommend.
