The historical context
OpenVPN was created by James Yonan in 2001 as an open-source alternative to commercial VPN solutions. By 2010 it had become the de-facto standard for commercial consumer VPN providers, and stayed that way for over a decade. Mullvad, NordVPN, ExpressVPN, Surfshark, every name brand β all of them shipped OpenVPN as their primary protocol until ~2020.
The arrival of WireGuard around 2019-2020 changed the landscape. Most providers now use WireGuard as default and OpenVPN as a fallback. It's a quieter role for a still-vital piece of software.
How OpenVPN works
OpenVPN is more complex than WireGuard, but the basic operation is similar:
- The client connects to the server (UDP or TCP).
- They perform a TLS handshake to authenticate each other (uses certificates, optionally combined with username/password).
- They negotiate a session key.
- Packets get encrypted and tunneled.
The differences from WireGuard:
- Negotiated cipher: OpenVPN doesn't hardcode a cipher suite β it negotiates between client and server. Typically AES-256-GCM or ChaCha20-Poly1305 these days.
- Authentication options: certificates, username/password, pre-shared keys, two-factor β OpenVPN supports all of them.
- TCP or UDP: OpenVPN can run over either. TCP is slower but pierces more networks.
- Userspace implementation: runs as a normal process on most platforms (Linux kernel module exists but isn't standard).
- Configurable everything: routes, DNS, MTU, ping, compression β OpenVPN exposes hundreds of configuration options.
TCP vs UDP modes
UDP mode
The default for performance. UDP doesn't require acknowledgment of every packet, which means lower latency and higher throughput. The trade-off is that UDP is a first-class citizen on the internet (used by DNS, gaming, video streaming) but some restrictive networks block it.
TCP mode
OpenVPN's secret weapon. TCP traffic looks like normal HTTPS, and is allowed by almost every firewall on the planet. If a network blocks UDP, OpenVPN-over-TCP usually still works. Performance cost: 20-40% throughput reduction and higher latency.
The classic configuration: TCP port 443 (the same port HTTPS uses). On the wire, this looks indistinguishable from regular web traffic. Useful when:
- You're on a corporate network that blocks non-HTTPS outbound traffic.
- You're on hotel/airport WiFi that's overly restrictive.
- You're in a country with deep packet inspection but you're not specifically the target.
Note: TCP-over-TCP can have performance issues called "TCP meltdown" β both the outer (network) TCP and the inner (application) TCP try to retransmit at the same time on packet loss, causing exponential backoff. In practice it's fine for normal web browsing but can be rough for large file transfers.
Performance
Comparing OpenVPN-UDP vs WireGuard on identical hardware and connections:
| Metric | OpenVPN (UDP) | WireGuard |
|---|---|---|
| Throughput | 250-400 Mbps | 900+ Mbps |
| Handshake | 50-500ms | 5-50ms |
| Battery (mobile) | Moderate | Low |
| CPU usage | Higher | Lower |
| UDP block resistance | Better (TCP mode) | Worse (UDP only) |
| Configuration complexity | High | Low |
Security
OpenVPN has a strong security track record but its larger code base (~70,000 lines) means a wider attack surface. Notable CVEs over the years:
- CVE-2017-12166 β buffer overflow in older versions, patched within days.
- CVE-2020-15078 β authentication bypass in certain configurations, also quickly patched.
No catastrophic incidents, no recurring patterns of systemic flaws. OpenVPN has been formally audited multiple times (notably by Cure53 in 2017 for OSTIF). The protocol is considered solid.
Key thing for users: use a recent OpenVPN client (3.x branch as of 2026). Older versions may have unpatched vulnerabilities.
When to use OpenVPN over WireGuard
- UDP is blocked. Some corporate networks, restrictive hotel WiFi, certain censored regions. OpenVPN-TCP gets through.
- You need TCP-port-443 stealth. If you want VPN traffic to look like normal HTTPS at a casual inspection level.
- WireGuard is misbehaving on your network. MTU issues, weird NAT, ISP-level interference β sometimes OpenVPN works when WireGuard doesn't, for non-obvious reasons.
- Compatibility requirements. Older routers and embedded devices may only support OpenVPN.
OpenVPN at ClownVPN
Our Android app ships both WireGuard and OpenVPN. WireGuard is the default; you can switch to OpenVPN in Settings β Protocol. We support both UDP and TCP modes for OpenVPN.
If your WireGuard connection is unstable or slow, switching to OpenVPN-TCP is the standard troubleshooting step.