WireGuard
A modern VPN protocol, around 4,000 lines of code, designed to be small enough to audit properly.
Glossary
OpenVPN
What is OpenVPN?
OpenVPN is the long-established open-source VPN protocol, slower than WireGuard but more configurable and more widely supported. It runs over TCP port 443 if configured to, which defeats filtering that works by port number, and on a restrictive network it often works where WireGuard does not.
Why it matters
It runs over TCP port 443 if configured to, which defeats filtering that works by port number, and on a restrictive network it often works where WireGuard does not.
What most explanations leave out
Running on 443 is not the same as looking like HTTPS. OpenVPN wraps its TLS control channel in its own header with a fixed opcode and a distinctive handshake, so deep packet inspection identifies it on any port â which is why China and Iran block it there routinely. Port 443 buys you nothing against inspection; obfuscation does. Separately, its codebase is orders of magnitude larger than WireGuard’s, meaning more surface area but also two decades of scrutiny, and a provider shipping only WireGuard has removed your fallback on hostile networks.
Related terms
Obfuscation
Disguising VPN traffic so it resembles ordinary encrypted web traffic to a system inspecting the connection.
VPN protocol
The set of rules governing how the tunnel is established and how data is encrypted inside it.
Referenced from
Questions
- What is OpenVPN?
- The long-established open-source VPN protocol, slower than WireGuard but more configurable and more widely supported.
- Why does OpenVPN matter when choosing a VPN?
- It runs over TCP port 443 if configured to, which defeats filtering that works by port number, and on a restrictive network it often works where WireGuard does not.
- What do most explanations of OpenVPN leave out?
- Running on 443 is not the same as looking like HTTPS. OpenVPN wraps its TLS control channel in its own header with a fixed opcode and a distinctive handshake, so deep packet inspection identifies it on any port â which is why China and Iran block it there routinely. Port 443 buys you nothing against inspection; obfuscation does. Separately, its codebase is orders of magnitude larger than WireGuard’s, meaning more surface area but also two decades of scrutiny, and a provider shipping only WireGuard has removed your fallback on hostile networks.
Terms are defined here because they appear in our scoring rubric or in provider reviews, not to fill a glossary.