The one-line answer
Use WireGuard unless something stops you. Everything below is the explanation and the exceptions.
WireGuard
Released in 2016 and merged into the Linux kernel in 2020. Around 4,000 lines of code against OpenVPN’s several hundred thousand, which makes it easier to audit and much faster. It connects in a fraction of a second, resumes instantly after a network change, and uses noticeably less battery on a phone.
Providers ship it under their own names. NordVPN’s NordLynx wraps it in a double-NAT layer so the server does not have to store a static IP against your account, which was the original privacy objection to WireGuard. ExpressVPN’s Lightway is a separate implementation with the same design goals, now written in Rust and open source. Proton, Mullvad, PIA, Surfshark and Windscribe offer plain WireGuard.
Expect to keep 80–95% of your line speed on a nearby server. Measure it on your own connection with the speed test: run it with the VPN off, then on.
OpenVPN
The old standard, from 2001, still supported everywhere. Two modes matter.
UDP is the faster one and the one to use if you use OpenVPN at all. TCP on port 443 is slower but looks like ordinary HTTPS traffic to a firewall, which is why it gets through school, workplace, hotel and airline networks that block everything else. If a VPN will not connect on a restricted network, this is the setting to change.
OpenVPN is not insecure. It is just slower, heavier on battery, and slower to reconnect than WireGuard, which matters most on a phone that changes networks all day.
IKEv2/IPsec
Built into iOS, macOS and Windows, so it works without an app. Its strength is roaming: it re-establishes the tunnel quickly when a phone moves between Wi-Fi and cellular. Its weakness is that firewalls block its ports easily and it is trivially fingerprinted. Reasonable as a manual configuration on a phone; not the choice on a restricted network.
Obfuscated protocols
These wrap the tunnel so that deep packet inspection cannot recognise a VPN handshake. They are slower than plain WireGuard and they are the only thing that works where a government inspects traffic:
| Provider | Mode | Notes |
|---|---|---|
| ExpressVPN | Lightway with obfuscation | Automatic; nothing to configure |
| NordVPN | Obfuscated servers, NordWhisper | Must be enabled manually; OpenVPN-based |
| Proton VPN | Stealth | Built for Iran and Russia; also alternative routing |
| Surfshark | Camouflage, NoBorders | NoBorders detects the network and switches |
| Mullvad | Shadowsocks bridges | Manual setup, very resilient |
If you are travelling to China, Iran, Russia, Turkey or the UAE, turn the relevant mode on before you leave. The provider’s website is blocked in all five, so a setting you cannot reach is a setting you do not have.
What not to use
PPTP. Its encryption was broken more than a decade ago. Nothing should offer it; a few cheap providers still do.
L2TP/IPsec. Dated, slower than IKEv2, and with no advantage over anything above.
Changing the protocol
Every app keeps this in Settings → Protocol or Connection. The default is usually “automatic”, which picks WireGuard and falls back on failure. Switch it manually when: the connection is slow (choose WireGuard), it will not connect on a restricted network (OpenVPN TCP 443), or you are behind a national firewall (the obfuscated mode). Those three cases cover nearly every protocol-related problem, and the connection troubleshooting guide covers the rest.