OpenVPN Explained: The VPN Protocol That Gets Through

OpenVPN is the veteran of consumer VPN protocols: open source since 2001, audited many times over, and trusted precisely because it is old and well understood. It is no longer the fastest option, but it has one talent nothing else matches — it can slip past networks that block VPNs. This guide explains how it works and when to reach for it.

If WireGuard is the modern default, OpenVPN is the reliable backup you keep one tap away for the moments the default can't connect.

What is OpenVPN?

OpenVPN is an open-source VPN protocol and application created by James Yonan and first released in 2001. For most of the last two decades it was the default choice for privacy-focused VPNs, and it remains one of the most compatible protocols in existence — it runs on practically every operating system and router.

Its trust comes from age and scrutiny. OpenVPN has been the subject of several independent security audits, and being open source means anyone can inspect it. When people say a protocol is "battle-tested", OpenVPN is the one they usually mean.

How OpenVPN works

OpenVPN builds an encrypted tunnel using the OpenSSL library, the same well-tested cryptography toolkit behind much of the secure web. It authenticates the connection with certificates, negotiates a cipher, and then carries your traffic inside that tunnel. Because it leans on OpenSSL, it supports a wide range of ciphers rather than a single fixed set.

That flexibility is a double-edged sword. It makes OpenVPN adaptable, but it also means a larger, more complex codebase — hundreds of thousands of lines once you include its dependencies — which is part of why it is slower and harder to audit fully than WireGuard.

TCP or UDP: OpenVPN's key choice

OpenVPN can run over either UDP or TCP, and this is its defining feature. Over UDP (default port 1194) it is faster and lower-latency, which is how you should run it day to day. Over TCP — usually on port 443, the port every HTTPS website uses — its traffic looks like ordinary encrypted web browsing, so it slips past firewalls that block VPNs. The full trade-off is in TCP vs UDP for VPN.

The catch with TCP mode is the "TCP-over-TCP meltdown": running a reliable, acknowledgement-based protocol inside another reliable protocol can trigger redundant retransmissions and stall your connection. So the rule is simple — use UDP unless something is blocking you, then switch to TCP 443 and accept the slowdown.

What encryption OpenVPN uses

OpenVPN typically defaults to AES-256-GCM, a strong, hardware-accelerated cipher, and since version 2.5 it can also use ChaCha20-Poly1305 — handy on devices without AES hardware. Because OpenVPN negotiates its cipher rather than fixing one, a reputable provider's job is to make sure it only ever agrees to strong, modern settings. Our encryption guide explains why the choice between those two ciphers depends on your device, not on one being "stronger".

Why OpenVPN is slower than WireGuard

OpenVPN is slower for concrete reasons: a much larger codebase, more overhead per packet, and the fact that it usually runs as a separate program rather than inside the kernel. None of that makes it insecure — it just makes it heavier. For most people the speed gap is the main reason to prefer WireGuard for everyday use, as we lay out in WireGuard vs OpenVPN.

Should you use OpenVPN?

For where OpenVPN sits against every other option, see our guide to which VPN protocol to use.

OpenVPN on routers and older devices

One place OpenVPN still shines is compatibility. It runs on almost anything — old routers, network-attached storage boxes, single-board computers and operating systems that never got a WireGuard client. If you want to protect an entire home network by configuring the VPN on the router itself, OpenVPN is frequently the option with the widest support, even if WireGuard is faster where both are available. That long tail of device support is a direct result of its age and open-source licence.

It also comes in two forms worth knowing about. The community edition is the free, open-source version that consumer VPNs build on. OpenVPN Access Server is a commercial product aimed at businesses that want to run their own VPN server with a support contract. For choosing a consumer VPN, you only ever interact with the community protocol, bundled inside your provider's app.

Why OpenVPN is still trusted after 20 years

OpenVPN's longevity is a feature, not a liability. Two decades of real-world use and multiple independent security audits mean its weaknesses are well understood and long since patched — there are few surprises left in code that has been picked over for that long. When security professionals want a protocol whose behaviour is completely predictable, OpenVPN is often the answer. That reputation is exactly why, even as WireGuard takes over the everyday role, no serious provider has dropped OpenVPN. It remains the dependable fallback the whole industry keeps on hand.

The way to think about OpenVPN in 2026 is as the seatbelt you're glad is there. You may run WireGuard almost all the time, but the day a restrictive network locks everything else out, OpenVPN on TCP 443 is what gets you connected. That's a role worth keeping, not retiring — a slower, heavier protocol that simply refuses to be blocked. Set your app to WireGuard, know where the OpenVPN switch is, and you have the best of both.