🔐 Protocols

What Is OpenVPN?

OpenVPN is the veteran VPN protocol trusted for two decades. Learn how it works, TCP vs UDP, and whether you should still use it in 2026.

Updated July 2026 · 7 min read
Protocols

OpenVPN is an open-source VPN protocol that has been the industry standard since 2001. It's mature, extremely well audited, and works on virtually every operating system and router — but it's now being overtaken by WireGuard for pure speed.

7 min read Updated July 2026 6 sections

How OpenVPN works

OpenVPN uses the OpenSSL library to create an encrypted tunnel between your device and a VPN server. It negotiates keys via TLS (the same handshake HTTPS uses) and then wraps IP packets in an encrypted UDP or TCP stream.

Because it runs entirely in user space and supports a huge range of ciphers and options, OpenVPN is far more flexible — and far heavier — than newer protocols.

Encryption and security

Modern OpenVPN configurations use AES-256-GCM for symmetric encryption, RSA-4096 or ECDH for key exchange, and SHA-256 or SHA-512 for authentication. Perfect Forward Secrecy is standard, so a compromised long-term key can't decrypt past sessions.

It has been publicly audited multiple times and remains one of the most trusted crypto tools in the world.

OpenVPN over UDP vs TCP

OpenVPN can run over two transport protocols with different tradeoffs:

  • 1
    UDP (default)
    Faster and lower latency — ideal for streaming, gaming and general browsing.
  • 2
    TCP (port 443)
    Looks like HTTPS traffic and gets through most firewalls, but slower due to double retransmission.

OpenVPN vs WireGuard

WireGuard wins on speed, battery use and code simplicity. OpenVPN wins on maturity, feature breadth (per-user auth, TAP interfaces, complex routing) and compatibility with older systems and restrictive networks.

For consumer VPNs in 2026, WireGuard is the everyday choice. OpenVPN remains the reliable fallback when WireGuard is blocked or when compatibility is critical.

When OpenVPN is still the right choice

Reach for OpenVPN when:

  • 1
    Your network blocks UDP
    OpenVPN TCP over port 443 usually gets through.
  • 2
    You need router support
    Almost every VPN-capable router speaks OpenVPN.
  • 3
    You want maximum bypass
    OpenVPN is trivially wrappable in obfuscation (Stunnel, obfsproxy).
  • 4
    You're on legacy hardware
    WireGuard needs modern kernels; OpenVPN runs anywhere.

Which VPNs support OpenVPN

Essentially all of them. Every major provider — NordVPN, ExpressVPN, Surfshark, ProtonVPN, CyberGhost, Private Internet Access, Mullvad, IVPN — ships OpenVPN alongside their newer protocol. It's the safe default when nothing else connects.

Frequently asked questions

QIs OpenVPN still secure in 2026?

Yes — with modern configuration (AES-256-GCM, TLS 1.3) it remains one of the most trusted protocols.

QShould I use OpenVPN or WireGuard?

WireGuard for everyday use; OpenVPN when you need firewall bypass or compatibility.

QIs OpenVPN slower?

Yes, roughly 20–40% slower than WireGuard, and it uses more battery on mobile.

QIs OpenVPN free?

Yes, the protocol and reference implementation are fully open source under GPLv2.

Related guides

Keep going down the rabbit hole 🐇

Protocols
What Is WireGuard?
How-to
How to Set Up and Use a VPN
How-to
How to Check Your VPN Is Working

Ready to pick a VPN?

Compare the providers we have tested against every criterion in this guide.

See top VPNs