WireGuard Replaces OpenVPN and IPsec

Jason Donenfeld created WireGuard in 2015 to replace what he considered "outdated" protocols like OpenVPN and IPsec. The project merged into the Linux kernel in version 5.6 in March 2020, marking its transition from an experimental tool to production-grade infrastructure. By December 2025, Mullvad announced it would go WireGuard-only, completing the migration of its desktop apps away from OpenVPN in early 2026. This shift confirms that the industry has decisively moved toward the newer protocol for new deployments.

Kernel-Space Performance and Simplicity

WireGuard operates as a kernel module, processing packets directly in kernel space to eliminate the latency and CPU overhead of user-space daemons. Its codebase is approximately 4,000 lines of C, a fraction of OpenVPN’s roughly 70,000 lines or IPsec’s 400,000 lines, which makes the entire system auditable by a single individual rather than a large team. The protocol uses a fixed cryptographic suite including ChaCha20-Poly1305 for encryption, Curve25519 for key exchange, and BLAKE2s for hashing, removing the risk of misconfigured cipher suites. In a Neuburg test lab using OPNsense firewalls on Supermicro hardware, WireGuard achieved 9.32 Gbit/s in single-stream TCP tests, while OpenVPN with Data Channel Offload managed only 7.84 Gbit/s. Without DCO, OpenVPN throughput dropped to 1.91 Gbit/s, proving that the older protocol is no longer competitive without significant optimization.

The connection handshake also favors WireGuard significantly. It completes in 1.5 round-trips using the Noise Protocol Framework, whereas OpenVPN requires 6 to 8 round-trips for its TLS negotiation, often taking 6 to 8 seconds under normal conditions. For mobile users switching between Wi-Fi and cellular data, this means instant reconnection with WireGuard versus visible packet loss with OpenVPN. You know you need to check your AllowedIPs configuration because it acts as both a routing table and an access control list, a dual role that trips up nearly every newcomer.

Residual Niche for Legacy Systems

Despite the clear performance gap, OpenVPN retains specific advantages in hostile network environments where UDP traffic is blocked. It can tunnel over TCP port 443, making it indistinguishable from HTTPS traffic to basic deep packet inspection systems, a capability WireGuard lacks without adding complex overlays like udp2raw. Organizations with strict compliance requirements for X.509 certificates or legacy endpoints that do not support modern public-key authentication still rely on OpenVPN’s mature certificate infrastructure. An August 2025 MDPI study running both protocols in Microsoft Azure found OpenVPN edging out WireGuard on TCP throughput at 290.77 Mbps versus 281.76 Mbps, though both converged near 880 Mbps over UDP.

WireGuard does have inherent privacy issues that require provider-specific solutions. By default, it stores connected client IP addresses on the server indefinitely, which conflicts with no-logs policies. Providers like NordVPN address this with a "double NAT system" that assigns dynamic local IPs, while others simply erase logs after the session ends. The protocol’s stateless design means there is no established session to time out, but it also exposes metadata if the implementation is not carefully managed. As of April 2026, WireGuard is available natively on Linux, Windows, macOS, iOS, Android, and FreeBSD, with version 1.0.20260223 as the current stable build. The question remains whether the slight performance gains justify the operational complexity for enterprises that must maintain parallel OpenVPN stacks for legacy devices.