Compare IPsec, OpenVPN, and WireGuard

Three protocol families dominate real VPN deployments. They are not three flavors of the same thing. Each has a different shape, and the shape decides what it is good at.

IPsec is a family of standards for protecting IP traffic. A protocol called IKE negotiates the peers, the algorithms, and the keys. IPsec lives inside operating system kernels and inside network hardware. That makes it the usual answer when two organizations connect routers from different vendors. The cost is surface area: many components, many possible algorithm combinations, and debugging sessions where you read two vendors’ logs side by side.

OpenVPN runs in userspace and uses TLS, the same protocol behind HTTPS. It can run over UDP or TCP. The TCP option matters in practice. On networks that block unfamiliar UDP, OpenVPN on TCP port 443 looks like ordinary HTTPS and often gets through. Configuration revolves around certificates and a long list of directives. It is mature and portable, and the userspace design costs some throughput.

WireGuard gives you a small encrypted network interface built around public-key peers and UDP. There is no algorithm negotiation. The protocol fixes one modern set of cryptographic primitives, so there is nothing to misconfigure there. It runs inside the Linux kernel, roaming between networks is built in, and a working configuration fits on one screen.

Here is the short version:

IPsec      standards family, IKE negotiation, kernel and hardware support
OpenVPN    TLS-based, UDP or TCP (even 443), certificates, userspace
WireGuard  fixed modern crypto, UDP only, public-key peers, tiny config

Those shapes decide real outcomes. Need to connect to a partner’s firewall appliance? That points to IPsec. Need to work from networks that strangle UDP? OpenVPN over TCP. Building your own infrastructure and want the smallest thing you can fully understand? WireGuard. That is what we build in this course.

WireGuard’s UDP-only design is also its clearest limitation. On a network that blocks UDP entirely, the handshake never completes. No configuration change on your side fixes that. You can see the symptom right away:

sudo wg show wg0 latest-handshakes
# xTIBA5rboUvnH4htodjb6e697QjLERt1NAB4mZqp8Dg=   0

A 0 means no handshake ever happened. On a hotel network that filters UDP, this is exactly what you get, and the fix is a different network or a different protocol.

One last point. The protocol affects deployment, compatibility, roaming, debugging, and policy. It does not decide whether the complete setup is safe. A flawless protocol with a careless peer list is still an open door, and we will spend a whole lesson on that list.