Compare IPsec, OpenVPN, and WireGuard

Three protocol families dominate real deployments. They are not three flavors of the same thing. They have different shapes.

IPsec is a family of standards for protecting IP traffic. IKE negotiates peers, algorithms, and keys. It lives in operating system kernels and in network hardware, which makes it the usual answer when two organizations connect routers from different vendors. The cost is surface area: many components, many possible algorithm combinations, and debugging sessions that involve reading two vendors’ logs side by side.

OpenVPN is a userspace VPN that uses TLS and can run over UDP or TCP. The TCP option matters in practice: on networks that block unfamiliar UDP, OpenVPN on TCP port 443 looks like ordinary HTTPS and often gets through. Configuration revolves around certificates and a long list of directives. It is mature and portable, and its userspace design costs some throughput.

WireGuard presents a small encrypted network interface built around public-key peers and UDP. There is no algorithm negotiation — the protocol fixes one modern set of cryptographic primitives. It runs inside the Linux kernel, roaming between networks is built in, and a working configuration fits on one screen.

IPsec      standards family, IKE negotiation, kernel and hardware support
OpenVPN    TLS-based, UDP or TCP (even 443), certificates, userspace
WireGuard  fixed modern crypto, UDP only, public-key peers, tiny config

Those shapes decide real outcomes. Need to interoperate with a partner’s firewall appliance? That points to IPsec. Need to work from networks that strangle UDP? OpenVPN over TCP. Building your own infrastructure and want the smallest thing you can fully understand? WireGuard — and it is what we build in this course.

WireGuard’s UDP-only design is also its clearest limitation. On a network that blocks UDP entirely, the handshake never completes, and no configuration change on your side fixes that.

The protocol affects deployment, compatibility, roaming, debugging, and policy. The name alone does not decide whether the complete setup is safe. A flawless protocol with a careless peer list is still an open door.