OpenVPN

What is OpenVPN?

OpenVPN is the open-source VPN that carried a generation of remote access: tunnels built on TLS, running over UDP or — its signature trick — TCP port 443, where it slips through firewalls and captive portals that break IPsec. Two decades of ubiquity mean clients exist for everything, every router vendor embeds it, and its configuration language can express almost any topology, certificate scheme, or routing policy you can imagine.

Strengths that keep it deployed

Middlebox traversal: when the network between you and home is actively hostile (hotel Wi-Fi, national firewalls, corporate proxies), TCP/443 OpenVPN connects where slicker protocols fail. Operational maturity: PKI tooling, RADIUS/LDAP hooks, per-client config, and a commercial ecosystem (Access Server) for enterprises that want support contracts. Flexibility: site-to-site, road-warrior, bridged Ethernet — it does all of it, documented by twenty years of forum posts.

Why WireGuard is winning anyway

The comparison is stark: WireGuard is ~4k lines of kernel code against OpenVPN’s userspace bulk, connects in a round trip where OpenVPN’s TLS negotiation takes several, roams networks without dropping, and typically doubles throughput on the same hardware. OpenVPN’s TCP mode also suffers the classic TCP-over-TCP meltdown under loss — two congestion-control loops fighting — so its best trick is also its worst performance mode. New deployments now default to WireGuard unless firewall traversal or entrenched tooling dictates otherwise; OpenVPN increasingly plays the compatibility fallback.

What people get wrong

• Choosing TCP mode by default “because it always connects” — accept its meltdown behavior knowingly, prefer UDP when possible.
• Static keys and eternal certificates: OpenVPN’s flexibility includes insecure configurations; short-lived certs and revocation discipline still apply.
• Measuring throughput single-threaded — classic OpenVPN is largely single-core; benchmark accordingly before blaming the network.

Primary source: OpenVPN documentation

Why WireGuard Is Displacing It

OpenVPN’s flexibility comes from a large, mature codebase supporting many configuration options, authentication methods, and network traversal techniques accumulated over two decades — but that same flexibility and age mean a larger codebase to audit for security and generally slower connection setup and lower throughput than more modern alternatives. WireGuard, a considerably newer VPN protocol, achieves comparable or better security with a dramatically smaller codebase (roughly 4,000 lines of code versus OpenVPN’s hundreds of thousands), simpler configuration, and measurably better performance in most benchmarks — advantages significant enough that WireGuard has been merged directly into the Linux kernel and is increasingly the default choice for new VPN deployments, while OpenVPN remains common in legacy deployments and situations requiring its specific compatibility or configuration flexibility.