OpenVPN is an open-source VPN protocol launched in 2001 by James Yonan, the dominant VPN protocol for two decades before the rise of WireGuard. Built on the OpenSSL library, supports a wide range of cipher suites, runs over either UDP or TCP, and is highly configurable. Used by virtually every major commercial VPN provider as a primary or fallback protocol, plus extensive enterprise-VPN deployments and open-source self-hosted setups.
What it means in practice
OpenVPN’s structural position in 2026: mature, widely-supported, configurable, and slower than WireGuard in throughput and connection-establishment time. The protocol’s flexibility is both a strength (supports virtually every authentication method, cipher choice, and deployment topology) and a complication (the configuration space is large enough that misconfiguration is a real concern). Performance-wise, OpenVPN over UDP achieves throughput in the 200-500 Mbps range typical for consumer VPN connections; WireGuard frequently doubles this. The protocol’s deep ecosystem support means OpenVPN remains the right answer for environments where WireGuard is not available (some corporate firewall environments, some legacy systems, some clients), and the censorship-resistance profile is different from WireGuard (OpenVPN over TCP-443 looks more like normal HTTPS than WireGuard does, useful in some censorship-circumvention contexts).
Where it shows up
Available on: every major commercial VPN provider (Mullvad, Proton VPN, NordVPN, ExpressVPN, dozens of others as a protocol option, sometimes as the default for older client versions), enterprise VPN deployments (Cisco AnyConnect uses OpenVPN-equivalent protocols, plus dedicated OpenVPN Server deployments), self-hosted personal VPNs (Algo VPN, Streisand, OpenVPN Access Server), and the long tail of niche use cases where WireGuard is not yet supported. The Predaxia operational position: for new deployments, WireGuard is structurally the better default (faster, simpler protocol surface, easier to audit); OpenVPN remains the right answer for compatibility-driven scenarios and for the censorship-circumvention case where TCP-443 mode helps disguise the traffic.
What you can change today
If your VPN client offers protocol choice, prefer WireGuard for general use (speed, modern protocol design) with OpenVPN as fallback for environments where WireGuard fails. Mullvad: Settings, Tunnel protocol, set to WireGuard with OpenVPN fallback. Proton VPN: Settings, Connection, Protocol, choose Stealth (WireGuard with obfuscation) or WireGuard. For self-hosted setups: Algo VPN (algo-vpn.org) deploys WireGuard by default with optional OpenVPN; Streisand (streisand.io) supports both with broader protocol coverage for censorship circumvention. The choice between protocols is rarely operationally consequential for most users; for those in censorship-heavy environments, the OpenVPN-over-TCP-443 option may be the difference between connecting and not.