Privacy tooling
What is OpenVPN?
OpenVPN is a mature userspace VPN protocol with configurable ciphers that can run over TCP or UDP. Its remaining advantage over WireGuard is that it can run over TCP port 443 and closely resemble ordinary TLS, which matters where VPN traffic is filtered.
Why OpenVPN matters
Its remaining advantage over WireGuard is that it can run over TCP port 443 and closely resemble ordinary TLS, which matters where VPN traffic is filtered.
OpenVPN in practice
Running OpenVPN on a KVM instance means owning the whole TLS stack. You configure cipher suites in the server conf, choose TCP or UDP per port, and manage the CA yourself — one expired certificate silently breaks every client. On an unmetered port-443 listener it still costs per-connection CPU, and a misconfigured keepalive can strand users mid-session. Test each cipher change against a live client before rolling it out.
What people get wrong about OpenVPN
People assume OpenVPN is inherently private because it is encrypted. The encryption only protects the tunnel — your server logs, DNS leaks, and route pushes still expose metadata. Correct: OpenVPN's privacy depends on your full configuration, from tls-auth to disabling redirect-gateway leaks, not on the protocol alone.
OpenVPN — common questions
Does OpenVPN work over port 443?
Yes, it runs over TCP port 443 and resembles ordinary TLS, which helps where VPN traffic is filtered. You configure the port and proto in the server config, and clients connect as if to a normal web server. This is its main advantage over WireGuard.
Which is faster, OpenVPN or WireGuard?
WireGuard is generally faster because it is newer and simpler. OpenVPN's userspace implementation and TLS handshake add CPU overhead per connection, but the difference only matters on high-throughput links or many simultaneous users. On a single low-traffic connection you may not notice it.
More from privacy tooling
- WireGuard
- WireGuard is a VPN protocol implemented in about 4,000 lines of kernel code with a fixed modern cipher suite.
- Tor
- Tor routes traffic through three volunteer-operated relays chosen so that no single relay knows both the origin and the destination.
- Tor exit node
- A Tor exit node is the final relay in a circuit, which connects to the destination and therefore appears to be the source of the traffic.
- Onion service
- An onion service is a service reachable only through Tor, whose address is derived from its public key rather than registered with any authority.
- SOCKS5
- SOCKS5 is a proxy protocol that forwards arbitrary TCP and UDP traffic, with optional authentication.
- Shadowsocks
- Shadowsocks is an encrypted proxy protocol designed to be difficult to identify by traffic analysis.
- No-logs policy
- A no-logs policy is a commitment not to retain records of user activity such as connection metadata, netflow or DNS queries.