Measured comparison, 2026
WireGuard vs OpenVPN. Measured, not repeated.
Most comparisons are written to sell you a VPN app. This one is for running your own: we put both on the same machine and measured.
With UDP blocked: WireGuard never connected. OpenVPN on TCP 443 did.
The short answer
Pick WireGuard for your own VPN unless one of three things applies: the networks you use block UDP, you need username and password logins, or a device can’t run WireGuard. Then use OpenVPN, or run both on one server.
In our test at a 50 ms round trip, WireGuard connected in 130 ms, OpenVPN in 268 ms over UDP and 605 ms over TCP. With UDP blocked, only OpenVPN on TCP 443 got through.
Search “WireGuard vs OpenVPN” and you’ll mostly read VPN apps explaining their own protocol choice. Big speed numbers, no method.
We wanted numbers for a different question: which one should you run on your own server?
So we measured. Same machine, same simulated distance, minimal working configs for both. Connect time, bytes added to each packet, what happens on a network that blocks UDP, and how much there is to set up.
One result surprised us: OpenVPN added fewer bytes per packet than WireGuard.
In this guide you’ll learn
- The short verdict, and the three cases where OpenVPN wins
- A picker: four questions, one answer for your situation
- Our measurements: connect time, packet size, blocked UDP
- Speed and security, without the marketing
- Minimal setups for both, tested
- Running both on one server
Chapter 1
The short answer
Both are secure when set up properly. The differences that decide it are practical.
| WireGuard | OpenVPN 2.6 | |
|---|---|---|
| Transport | UDP only | UDP or TCP (any port, including 443) |
| Time to connect (median) | 130 ms | 268 ms UDP, 605 ms TCP |
| Bytes added to a 1,028-byte packet | 72 (60 + padding) | 52 UDP, 78 TCP |
| Works when UDP is blocked | No | Yes, over TCP |
| What each device needs | One short config file | CA certificate, own certificate and key, tls-crypt key, config |
| Logins | Keys only | Certificates, plus passwords or directory via plugins |
| Encryption | One fixed set, no negotiation | Negotiated; 2.6 defaults to AES-GCM or ChaCha20-Poly1305 |
| Where it runs on Linux | In the kernel since 5.6 (2020) | User space; optional kernel offload (DCO) |
Either way, the best VPN is the one you run yourself: your server, your keys, your exit country. A Lite 2 runs either protocol in any of 15 countries, billed by the hour.
Chapter 2
Which one is right for you?
Answer for the people and networks that will actually use your VPN.
Our answer
WireGuard.
- It connected in 130 ms in our test, about half of OpenVPN’s 268 ms over UDP at the same distance. Phones reconnect often, so that adds up.
- One short file per device instead of a certificate authority.
Times from our test on one machine with a 50 ms round trip, October 2026. Set up WireGuard, with our script builder
Run it on your own server: a Lite 2 handles it easily, in any of 15 countries, billed by the hour. Deploy a Lite 2
Chapter 3
What we measured
Ubuntu 24.04, OpenVPN 2.6.19 and kernel WireGuard. Server and client on one machine, linked through a simulated 25 ms each way, so the timings reflect distance rather than CPU.
| Runs (ms) | Median | |
|---|---|---|
| WireGuard | 130, 134, 129, 130, 130 | 130 ms |
| OpenVPN, UDP | 268, 267, 263, 270, 269 | 268 ms |
| OpenVPN, TCP 443 | 651, 563, 605, 611, 604 | 605 ms |
Why: WireGuard’s handshake is two messages, one round trip. OpenVPN runs a TLS handshake first, and over TCP adds TCP’s own handshake underneath. At 50 ms, every extra round trip shows.
| Sent as | Added | |
|---|---|---|
| WireGuard | 1,100 bytes | 72 (60 fixed + 12 padding) |
| OpenVPN UDP, AES-256-GCM | 1,080 bytes | 52 |
| OpenVPN TCP | 1,106 bytes | 78 |
WireGuard pads each packet to a multiple of 16 bytes, so how much it adds varies. Either way the difference is a few percent of a full packet, which you won’t notice. We include it because “WireGuard has less overhead” is repeated everywhere, and per packet it wasn’t true here.
UDP blocked on the client’s side: WireGuard never connected, because it doesn’t do TCP at all. OpenVPN on TCP 443 connected in 611 ms.
Chapter 4
Speed and security, without the marketing
Both have strong encryption by default. They differ in how much they let you, or an attacker, change.
- WireGuard has one fixed set of algorithms: Curve25519, ChaCha20-Poly1305 and BLAKE2s inside the Noise framework. Nothing to negotiate, so nothing to downgrade, and nothing to misconfigure.
- OpenVPN negotiates. Version 2.6 defaults to AES-256-GCM, AES-128-GCM and ChaCha20-Poly1305. Flexible, and the defaults are good; old configs with old ciphers are the risk.
- Speed: WireGuard is designed to be considerably faster than OpenVPN. It has lived in the Linux kernel since 5.6, while classic OpenVPN copies every packet through a user-space program. OpenVPN 2.6 can offload data to the kernel too (DCO). Expect WireGuard to be faster on the same server.
- Known limits: WireGuard doesn’t try to disguise itself as other traffic, and isn’t post-quantum secure by default. Where a network blocks VPNs, OpenVPN on TCP 443 is your fallback.
MythWireGuard always uses less data.
Per packet, OpenVPN over UDP added 52 bytes and WireGuard 72 in our test. WireGuard does stay silent when idle unless you set a keepalive.
MythOpenVPN is more private.
On your own server, both see the same thing: which device connected and from which IP. Privacy depends on who runs the server, and here that’s you.
MythTCP is the safer choice.
It’s the fallback. It took over twice as long to connect as UDP in our test, and tunnelling TCP inside TCP can behave badly on lossy networks.
Chapter 5
Minimal setups, side by side
These are the configs we tested: reaching the VPN network from one device. Real setups add the firewall and routing steps.
WireGuard: one file each side
Seven lines on the server, seven on the device. Our WireGuard tutorial writes the full setup, firewall included, as one tested script.
OpenVPN: a certificate authority first
Create the certificates
sudo apt install openvpn easy-rsa make-cadir ~/vpn-ca && cd ~/vpn-ca ./easyrsa init-pki ./easyrsa build-ca ./easyrsa build-server-full server nopass ./easyrsa build-client-full phone nopass openvpn --genkey secret ta.key
That’s a 19-file PKI folder from easy-rsa.
build-cahas nonopasshere, so it asks for a passphrase: keep it. Keep this folder off the VPN server if you can.Server config, 12 lines
port 1194 proto udp dev tun ca ca.crt cert server.crt key server.key dh none tls-crypt ta.key server 10.9.0.0 255.255.255.0 topology subnet keepalive 10 60 verb 3
Device config, 11 lines plus four files
client dev tun proto udp remote 203.0.113.10 1194 nobind remote-cert-tls server ca ca.crt cert phone.crt key phone.key tls-crypt ta.key verb 3
For TCP on port 443, change proto udp to proto tcp and the port on both sides, as we did. To send all traffic through it, the server also needs push "redirect-gateway def1", a DNS push, forwarding and NAT; we didn’t test that part for OpenVPN.
Chapter 6
Running both on one server
They don’t conflict: different ports, different interfaces, different VPN networks.
| WireGuard | OpenVPN fallback | |
|---|---|---|
| Port | 51820/udp | 443/tcp |
| Interface | wg0 | tun0 |
| VPN network | 10.8.0.0/24 | 10.9.0.0/24 |
| ufw | allow 51820/udp, route allow in on wg0 | allow 443/tcp, route allow in on tun0 |
Now it’s your move
For a VPN you run yourself, WireGuard is the easy default: faster to connect, less to set up, harder to misconfigure. OpenVPN earns its place when the network or your logins need it.
Ready? Our WireGuard tutorial sets up the server and every device in one script. Deploy a Lite 2, paste it, and your own VPN is up once the server is ready (usually within 15 minutes).