WireGuard and OpenVPN are VPN protocols that create encrypted tunnels. WireGuard is newer, with a small codebase, fixed modern cryptography and fast connections over UDP. OpenVPN is older and more flexible: it supports TCP, many configurations and can run on port 443 to pass restrictive firewalls.
How it works
WireGuard
- Designed by Jason Donenfeld and merged into the Linux kernel in 2020.
- Around 4,000 lines of code, small enough to audit thoroughly.
- One fixed set of modern algorithms: Curve25519 for key exchange, ChaCha20-Poly1305 for encryption, BLAKE2s for hashing. No negotiation, so no weak options.
- Peers are identified by public keys, like SSH. It runs over UDP only.
- Reconnects almost instantly when your network changes, which suits laptops and phones.
OpenVPN
- Around since 2001, widely supported by routers, firewalls and VPN providers.
- Uses TLS (via OpenSSL) for the handshake, with many configurable ciphers and options.
- Runs over UDP or TCP. TCP on port 443 looks like HTTPS traffic to simple firewalls, which helps on restrictive networks.
- Larger codebase and more configuration, so more room for mistakes.
Which to choose
For a commercial VPN or your own server, WireGuard is usually faster and simpler. Use OpenVPN when a network blocks UDP, when you need TCP/443, or when existing infrastructure requires it.
Side by side
| WireGuard | OpenVPN | |
|---|---|---|
| Released | 2016 (kernel 2020) | 2001 |
| Code size | About 4,000 lines | Tens of thousands, plus OpenSSL |
| Transport | UDP | UDP or TCP |
| Cryptography | Fixed, modern | Configurable via TLS |
| Speed | Usually faster | Slower, especially over TCP |
| Roaming | Seamless | Reconnects |
| Getting past firewalls | Harder (UDP only) | Easier (TCP 443) |
Examples
- A VPN app offering “WireGuard” (or its own variant, like NordLynx) usually connects faster and drains less battery than its OpenVPN option.
- On a hotel network that blocks UDP, switching the VPN to OpenVPN over TCP 443 often gets through.
On a Mac
macOS has no built-in WireGuard or OpenVPN client: use the official WireGuard app from the Mac App Store, your VPN provider's app, or an OpenVPN client such as Tunnelblick. Active VPNs appear as utun interfaces in ifconfig, and in System Settings › VPN when they use Apple's network extension framework.
See it in the app
LightAtom's connections view shows the VPN app's tunnel connection to its server, and the Map where that server is.
Frequently asked questions
Is WireGuard more secure than OpenVPN?
Both are secure when configured well. WireGuard's small codebase and fixed modern cryptography leave less room for mistakes; OpenVPN's flexibility means more ways to configure it weakly.
Is WireGuard faster than OpenVPN?
Usually yes, especially on mobile devices and fast connections, thanks to its lean design and kernel-level implementations.
Why would I still use OpenVPN?
When a network blocks UDP, when you need it to look like HTTPS on TCP 443, or when your router or company only supports OpenVPN.
What is WireGuard?
A modern VPN protocol built for simplicity and speed, using public keys and state-of-the-art cryptography over UDP.