TCP vs UDP for VPN: Which to Use and When

For a VPN, use UDP by default and switch to TCP only when a network is blocking you. UDP is faster and lower-latency; TCP is more reliable and can disguise your VPN as normal web traffic on port 443. That one-line rule covers almost everyone — this guide explains why it works.

TCP and UDP are the two ways data moves across the internet, and your VPN protocol rides on one of them. WireGuard uses only UDP; OpenVPN can use either; IKEv2 uses UDP. Our main guide to VPN protocols covers which uses what.

The core difference

UDP is 'fire and forget': it sends packets without waiting for the other side to confirm they arrived. That makes it fast and low-latency, at the cost of occasionally losing a packet. TCP is 'confirmed delivery': it numbers every packet, waits for acknowledgements, and re-sends anything that goes missing. That makes it reliable but slower, because of all the waiting and re-sending.

For a VPN carrying video, downloads or web browsing, UDP's speed is almost always the better trade — an occasional lost packet is invisible, while the delay from TCP's confirmations is not.

Why UDP is the default for VPNs

Modern VPN protocols default to UDP because speed and latency matter most for everyday use. WireGuard is UDP-only by design; OpenVPN's UDP mode (port 1194) is its faster setting; IKEv2 uses UDP on ports 500 and 4500. If you care about the fastest possible connection, UDP is the transport you want underneath.

When to switch to TCP

TCP earns its place in one situation: getting past a network that blocks VPNs. Running OpenVPN over TCP on port 443 makes your VPN traffic look like ordinary HTTPS — the same connection every secure website uses. A network can't block port 443 without breaking the web for everyone, so TCP 443 slips through where UDP is stopped. The cost is speed, so use it only when you have to.

The TCP-over-TCP problem

There is a specific reason not to use TCP unless you need it: the 'TCP-over-TCP meltdown'. Most of what you do online already uses TCP. When you tunnel that TCP traffic inside another TCP connection, both layers try to guarantee delivery at once — and when the network hiccups, they both start re-sending, piling retransmission on retransmission. The result can be a connection that stalls badly under packet loss. UDP tunnels avoid this because the outer layer doesn't second-guess the inner one.

This is also why you should never use TCP for gaming — the re-send delay is exactly what hurts fast games, as covered in the best protocol for gaming and streaming.

The simple rule

Leave your VPN on UDP for everything normal — browsing, streaming, gaming, downloads. Switch to TCP on port 443 only when a network is blocking you, and switch back afterwards. If you're on WireGuard, there's usually no TCP toggle at all; your provider's obfuscation feature or a fallback to OpenVPN handles blocks instead. See our full guide to which VPN protocol to use for how this fits together.

What TCP and UDP actually are

TCP and UDP are the two "transport" protocols that carry almost all internet traffic, and they sit underneath your VPN protocol rather than replacing it. TCP (Transmission Control Protocol) is the careful courier: it opens a connection with a handshake, numbers every packet, and won't move on until each one is confirmed delivered, re-sending anything lost. That reliability is why the web, email and file transfers use it.

UDP (User Datagram Protocol) is the fast courier: it fires packets off without a handshake and without waiting for confirmation. If one goes missing, it's simply gone. That sounds worse, but for live traffic — voice, video, games and, it turns out, most VPN use — speed and low latency matter more than perfect delivery, and a single lost packet is invisible. Your VPN protocol rides on one of these two, which is what the TCP-versus-UDP choice really means.

How to switch, and what the ports mean

In practice, switching is a menu choice. If your app runs OpenVPN, you'll usually see "OpenVPN (UDP)" and "OpenVPN (TCP)" as separate options; pick UDP normally and TCP when blocked. On WireGuard there's typically no TCP toggle at all, because WireGuard is UDP-only — instead you rely on the app's obfuscation setting or a fallback to OpenVPN to get through blocks.

The port numbers you'll see are worth decoding. Port 1194 is OpenVPN's traditional UDP port. Port 443 is the HTTPS port every secure website uses, which is why routing OpenVPN over TCP 443 is so effective at hiding VPN traffic in plain sight. Ports 500 and 4500 belong to IKEv2/IPsec, and because they're fixed and recognisable, they're also the easiest for a network to block. WireGuard's default is UDP 51820.

You don't need to memorise any of that, but it explains the pattern: protocols on well-known, fixed ports are easy to identify and block, while traffic disguised on port 443 blends into normal browsing. That single fact is why OpenVPN over TCP 443 remains the reliable last resort when everything faster has been shut out.

For nearly everyone, then, the TCP-versus-UDP question barely needs asking: your app already defaults to UDP through a modern protocol, which is correct. The knowledge only becomes useful the day a connection won't establish on a locked-down network — that's your cue to reach for TCP on port 443 and accept a slower but working link. Treat UDP as the setting and TCP as the escape hatch, and you'll always pick right. And if you're ever unsure whether a slow connection is a TCP-versus-UDP issue at all, it usually isn't — a distant or overloaded server explains far more sluggish VPN sessions than the transport choice ever does.