WireGuard vs OpenVPN
WireGuard vs OpenVPN on a VPS
WireGuard is about 4,000 lines of kernel code with modern fixed cryptography; OpenVPN is roughly 100,000 lines in userspace with configurable ciphers. WireGuard is faster, reconnects instantly and is far easier to audit. OpenVPN survives on one advantage: it can run over TCP port 443 and look like ordinary TLS, which matters where UDP is blocked or VPNs are filtered.
| Dimension | WireGuard | OpenVPN |
|---|---|---|
| Throughput on 1 vCPU | ~900 Mbit/s | ~250 Mbit/s |
| Codebase size | ~4,000 lines | ~100,000 lines |
| Where it runs | Kernel space | User space |
| Transport | UDP only | UDP or TCP |
| Obfuscation | Needs a wrapper | TCP/443 looks like TLS |
| Handshake | Roughly instant | Seconds |
| Configuration | A dozen lines | Certificates and a long config |
Which should you choose?
WireGuard
Use WireGuard by default. It is faster, simpler and easier to reason about.
OpenVPN
Use OpenVPN where UDP is blocked or where VPN traffic must be indistinguishable from HTTPS.
Frequently asked questions
Is WireGuard faster than OpenVPN?
Substantially — typically three to four times the throughput on the same hardware, because it runs in kernel space with a fixed modern cipher suite.
Can WireGuard be blocked?
Yes. Its handshake is identifiable and it is UDP-only, so networks that filter aggressively can block it. Wrap it in something like udp2raw, or fall back to OpenVPN over TCP/443.