KovraProtocol comparisons usually rank speed, list cipher names, and stop. That produces a clean answer — WireGuard wins — and misses the metric that decides real outcomes: whether the connection is allowed to exist on the network you are actually sitting on. Here are all three protocols on both axes.
OpenVPN: the compatible one
Released in 2001, roughly half a million lines of code including its OpenSSL dependency, runs in user space, speaks both UDP and TCP, and exists for every platform anyone has ever shipped. Two decades of deployment mean it works with hardware routers, ancient systems and enterprise authentication schemes nothing else supports.
The costs are structural. User-space processing and per-packet overhead make it the slowest of the three. Over TCP it suffers TCP-in-TCP meltdown: when the outer connection retransmits, the inner one does too, and throughput collapses under loss. And the handshake is recognizable — the opcode layout is documented, so DPI identifies it on any port, including 443.
WireGuard: the fast one
About 4,000 lines in the Linux kernel, a fixed modern cipher suite (ChaCha20-Poly1305, Curve25519, BLAKE2s) with no negotiation, UDP only. The result is fast connections, near-instant handshakes, excellent battery behaviour on mobile, and roaming that survives network changes without reconnecting. The small codebase is also why it has the most credible audit story of the three: there is little room to hide a mistake.
Two caveats. First, the design keeps a static internal IP for each peer in server memory, so a provider must layer something on top to avoid that becoming a persistent identifier — a solved problem, but one to ask about, as covered in verifying no-logs claims. Second, and more consequential: the handshake initiation packet has a fixed message type, fixed length and fixed field positions. It is one of the easiest protocols on the internet to fingerprint, which is why WireGuard is the first thing filtered networks drop.
VLESS with Reality: the invisible one
VLESS is a deliberately thin transport from the Xray project: no encryption of its own, because it expects to run inside TLS, and no redundant framing. Reality is the transport layer that makes it interesting — the server borrows the certificate chain of a real, popular website, so an observer sees a normal TLS 1.3 session with a real certificate and normal traffic patterns. Probing the server as a censor does returns the actual borrowed website.
Performance sits close to WireGuard: the encryption is the same class of modern AEAD, and the extra cost is one TLS handshake at connection setup. It also supports hybrid post-quantum key exchange (X25519 combined with ML-KEM-768), which matters for anyone concerned about recorded traffic being decrypted later. The trade is ecosystem maturity: fewer clients, no kernel implementation, and configuration that assumes a modern app rather than a router checkbox. Details in the VLESS Reality guide.
The comparison table
| OpenVPN | WireGuard | VLESS + Reality | |
|---|---|---|---|
| Throughput | Moderate | Highest | High |
| Connection time | Seconds | Instant | Sub-second |
| Battery on mobile | Worst | Best | Good |
| Codebase size | ~500k lines | ~4k lines | Small, Go implementation |
| DPI fingerprint | Recognizable | Trivially recognizable | Indistinguishable from HTTPS |
| Works behind national firewalls | Rarely | Rarely | Yes |
| Post-quantum option | No | Via preshared keys only | Yes, ML-KEM hybrid |
| Router and legacy support | Excellent | Good | Limited |
| Audit history | Long | Strong | Younger |
Choosing by situation, not by benchmark
- Home network, unfiltered, you want maximum speed: WireGuard. Nothing else is faster and the audit story is the best available.
- Old router, corporate gateway, exotic platform: OpenVPN, because it is the only one that will run there.
- Censored, throttled or probed network: VLESS with Reality. This is the only category where the other two simply do not connect — see what works in China and Shadowsocks versus Reality.
- Mobile, constantly switching between Wi-Fi and cellular: WireGuard for roaming, Reality if the networks are also filtered.
- Long-term confidentiality against recorded traffic: a hybrid post-quantum key exchange, which today means Reality.
What the protocol does not decide
Whether the provider keeps logs. Whether payment ties the account to your identity. Whether the kill switch actually blocks traffic when the tunnel drops. Whether DNS resolves inside the tunnel. Those are provider and client questions, and they cause far more real-world exposure than any cipher choice — the checks are in the leak test guide and the no-logs verification checklist.
The one-line version
WireGuard is the best protocol on a network that permits VPNs. OpenVPN is the one that runs everywhere. VLESS with Reality is the one that works where the other two are blocked — and for a growing number of users, that is the only comparison that matters.