WireGuard: the default
Around 4,000 lines of code, which is small enough to be reviewed properly — a meaningful property in security software. It is faster than the alternatives in most conditions and reconnects almost instantly after a network change.
Its one design quirk matters for commercial VPNs: it keeps the client address on the server while a session is active. Providers work around this with an added layer, and that layer is usually the part not published. It is worth knowing which approach your provider takes.
OpenVPN: the fallback that gets through
Configured over TCP port 443, OpenVPN gets past filtering that blocks by port. It does not get past deep packet inspection: OpenVPN has a fixed opcode at a known offset and a TLS fingerprint no browser produces, and it is identified on port 443 routinely. Defeating inspection needs an obfuscation mode, not a port change.
It is slower and heavier on battery. Keep it available and do not use it by default. A provider that ships only WireGuard has removed your fallback.
IKEv2: the mobile case
IKEv2 handles network transitions well, which is why it persists on mobile despite being older. If you switch between cellular and Wi-Fi constantly and hate re-establishing the tunnel, it is a reasonable choice.
WireGuard has largely closed this gap, so IKEv2 is now a preference rather than a requirement.
Obfuscated modes
Providers ship these under names like Stealth or Scramble. They wrap the tunnel so that inspection equipment sees something resembling ordinary TLS.
They cost throughput and add latency, so they belong as an option rather than a default. In a small number of countries they are the deciding feature, which is why they appear in our country briefs rather than in the main ranking.
Avoid
- Leaving the client on "automatic" and never checking what it selected
- Using an obfuscated mode everywhere because it sounds more secure — it is not more private, only harder to detect
- Choosing a provider on protocol list length; three good options beat seven mediocre ones