NordLynx, Lightway & Proprietary VPN Protocols Explained

Several VPN providers ship their own protocols with names like NordLynx, Lightway and Catapult Hydra. A proprietary protocol is one a single company builds and controls, rather than an open standard like WireGuard or OpenVPN. Some are excellent; others ask you to trust a black box. This guide explains the main ones and how to judge them.

The quick test we use throughout our guide to VPN protocols: a proprietary protocol built openly on a trusted base, or independently audited, earns trust; a closed one you simply have to take on faith.

NordLynx (NordVPN)

NordLynx, from NordVPN (an affiliate link — it doesn't change our view), is WireGuard with a privacy layer added. It keeps WireGuard's speed and modern cryptography, then solves WireGuard's one weakness: the static-IP privacy caveat. NordLynx uses a 'double NAT' system where every user shares one internal address and authentication happens through a separate secure system, so the server never stores a record linking you to an address.

Because it is built on WireGuard, NordLynx is easy to trust: you know exactly what is underneath, and the addition is a documented privacy improvement rather than a mystery. It is the model example of a proprietary protocol done right.

Lightway (ExpressVPN)

Lightway, from ExpressVPN (also an affiliate link), is a lean protocol the company built to be fast and light, using the well-established wolfSSL cryptography library. Crucially, ExpressVPN open-sourced Lightway's core code, so it isn't a black box. According to the company, it rewrote Lightway in the memory-safe language Rust and released that version publicly in February 2025.

Independent auditors reviewed the new Lightway code in 2024 — the security firms Praetorian and Cure53 — and, per ExpressVPN, found no critical issues, with the minor ones fixed and re-checked. Lightway supports both UDP and TCP and, again per ExpressVPN, includes post-quantum protection. Open source plus outside audits is exactly what makes a proprietary protocol trustworthy.

Catapult Hydra and the closed options

Catapult Hydra, used by Hotspot Shield and its parent's other apps, is a proprietary protocol built for speed — particularly over long distances. The difference from NordLynx and Lightway is transparency: Catapult Hydra is closed-source, so outside researchers can't inspect how it works. That doesn't make it insecure, but it means you're trusting the company's word rather than reviewable code.

The pattern to watch: proprietary protocols that are open source (Lightway) or built on an open base (NordLynx) are as trustworthy as the standards. Fully closed protocols ask for more faith — fine for casual speed, weaker for privacy that matters.

Are proprietary protocols better than WireGuard?

Mostly they are WireGuard, tuned. NordLynx is WireGuard with a privacy layer; Lightway is an independent design in the same fast, modern spirit. Neither is dramatically faster than plain WireGuard — the real gains come from the provider's servers and network. So don't choose a VPN for its protocol's name; choose it on speed, price and an audited no-logs record, and treat a good proprietary protocol as a nice bonus.

It's also worth naming the providers that keep things simple with standards: Mullvad and Proton VPN run standard WireGuard openly, and neither pays us anything to say so. Sometimes the least flashy choice is the most transparent one.

The bottom line

NordLynx and Lightway are trustworthy proprietary protocols because you can see what's inside them; Catapult Hydra and other closed options require more faith. Either way, the protocol is rarely the deciding factor between good VPNs. For where they sit against the standards, see our guide to which VPN protocol to use.

Other providers' protocols

Most other big names lean on the standards rather than inventing a protocol. Surfshark offers WireGuard, OpenVPN and IKEv2 directly (that's an affiliate link, and it doesn't shape our view). Private Internet Access and CyberGhost do the same, giving you plain WireGuard rather than a branded variant. Choosing one of these means you know exactly what you're running, which is its own kind of reassurance.

A related feature to know is Proton VPN's Stealth, which isn't a new encryption protocol so much as an obfuscation layer that hides the fact you're using a VPN on networks that try to block them. Several providers offer something similar under different names. It solves a different problem from the core protocol — getting through censorship rather than encrypting faster — and it's worth having if you travel to restrictive networks.

Should a protocol change which VPN you buy?

Rarely. A great proprietary protocol is a signal that a provider invests in its technology, but it shouldn't be the deciding factor. NordLynx and Lightway are both excellent, yet a plain-WireGuard provider with a better price, a stronger audited no-logs record or servers nearer you may serve you better. The protocol sets the technical ceiling; the provider decides whether you actually reach it.

The trap to avoid is letting a branded protocol name do your evaluating for you. "Fastest protocol in the world" is a marketing line every provider can write; an independent audit and a transparent codebase are things only some can point to. Weigh the protocol as one input, then judge the provider on evidence you can check.

If you take one thing away, make it this: a proprietary protocol is only as trustworthy as what you can verify about it. NordLynx earns trust by being WireGuard underneath; Lightway earns it by being open source and independently audited. Both are genuinely good. A closed protocol you can't inspect isn't automatically bad, but it asks you to trust a claim rather than check one — so weight it lightly, and let the provider's audited privacy record carry the real decision. The best proprietary protocols don't reinvent security; they take a proven open foundation and improve one specific thing, in the open, where anyone can confirm they did it right.