WireGuard: the default
Around 4,000 lines of code, which is small enough to be reviewed properly — a meaningful property in security software. It is faster than the alternatives in most conditions and reconnects almost instantly after a network change.
Its one design quirk matters for commercial VPNs: it keeps the client address on the server while a session is active. Providers work around this with an added layer, and that layer is usually the part not published. It is worth knowing which approach your provider takes.
OpenVPN: the fallback that gets through
Configured over TCP port 443, OpenVPN traffic resembles ordinary HTTPS. On a network that blocks by protocol signature rather than by address, this is frequently the difference between a working connection and none.
It is slower and heavier on battery. Keep it available and do not use it by default. A provider that ships only WireGuard has removed your fallback.
IKEv2: the mobile case
IKEv2 handles network transitions well, which is why it persists on mobile despite being older. If you switch between cellular and Wi-Fi constantly and hate re-establishing the tunnel, it is a reasonable choice.
WireGuard has largely closed this gap, so IKEv2 is now a preference rather than a requirement.
Obfuscated modes
Providers ship these under names like Stealth or Scramble. They wrap the tunnel so that inspection equipment sees something resembling ordinary TLS.
They cost throughput and add latency, so they belong as an option rather than a default. In a small number of countries they are the deciding feature, which is why they appear in our country briefs rather than in the main ranking.
Avoid
- Leaving the client on "automatic" and never checking what it selected
- Using an obfuscated mode everywhere because it sounds more secure — it is not more private, only harder to detect
- Choosing a provider on protocol list length; three good options beat seven mediocre ones