VPN technology, explained properly
Understand VPN protocols before you pick a VPN
Tunnels, ciphers, kill switches and leaks — explained from the specifications, with ZoogVPN as the worked example throughout. No invented speed tests, no scores we cannot justify.
Updated 21 September 2026 · How we research
Specifications first
Protocol behaviour comes from published specifications and documentation, not from vendor marketing copy.
No invented evidence
We publish no speed figures, scores, audit verdicts or server counts we have not verified. Gaps are stated, not filled.
Vendor claims are labelled
Where a fact comes only from a provider's own documentation, we attribute it explicitly and date it.
How a VPN connection actually works
Every VPN builds an encrypted tunnel from your device to a server you choose, then forwards your traffic from there. What differs between products is which protocol builds that tunnel, which cipher protects it, and what happens when it fails.
Pick a protocol for your situation
Many connection problems people blame on a VPN turn out to be protocol mismatches. UDP-based protocols are usually the quickest, but some networks block UDP entirely; a TCP transport on port 443 gets through most networks at some cost in speed; and IKEv2/IPsec is the one designed to survive a phone changing networks.
WireGuard
Fastest, UDP only, fixed modern cipher suite.
- Transport
- UDP only
- Cryptography
- ChaCha20-Poly1305, Curve25519, BLAKE2s — a fixed suite with no negotiation
- Best suited to
- Everyday use, streaming, gaming, battery-sensitive mobile use
OpenVPN
The configurable fallback that passes restrictive firewalls.
- Transport
- UDP
- Over TCP
- TCP, commonly port 443
- Cryptography
- TLS control channel; AES-GCM or ChaCha20-Poly1305 data channel
- Best suited to
- A balanced default with wide router support
IKEv2/IPsec
Survives moving between Wi-Fi and cellular.
- Transport
- UDP 500 and 4500
- Cryptography
- IKEv2 key exchange with an ESP data channel, typically AES-GCM
- Best suited to
- Phones moving between Wi-Fi and cellular
Failure handling
Kill switches and leak protection decide what happens when the tunnel drops.
Test yoursThe full line-up — transports, cipher suites and trade-offs side by side — is in VPN protocols compared.
Our primary recommendation
We use ZoogVPN as the worked example across this site because its published protocol line-up covers the widest range of network conditions among the five providers reviewed here: two UDP options, a TCP fallback, a mobility protocol and two in-house transports for restricted networks. That breadth is what makes it useful for explaining the technology, and it is also why we recommend it first.
ZoogVPN's published protocol matrix, retrieved from its help centre on 21 September 2026.
| Protocol | Platforms (per ZoogVPN) | ZoogVPN's stated use case |
|---|---|---|
| WireGuard | Windows, macOS, iOS, Android, Linux, routers | Speed and modern use cases such as streaming and gaming |
| IKEv2/IPsec | Windows, macOS, iOS, Android, Linux | Mobile users and keeping a connection alive while switching networks |
| OpenVPN (UDP) | Windows, macOS, iOS, Android, Linux, routers | Balanced speed and security; torrenting and streaming |
| OpenVPN (TCP) | Windows, macOS, iOS, Android, Linux, routers | Stable connections in firewalled environments |
| Shadow | Windows, macOS, iOS, Android | Bypassing censorship in highly restricted regions |
| ZoogTLS | Windows only | Accessing restricted content in heavily filtered networks such as Iran |
Save 82%Six protocols across Windows, macOS, iOS, Android, Linux and routers, with kill-switch support listed on all four major consumer platforms.
2-year plans
Affiliate link — we may earn a commission at no extra cost to you. See our affiliate disclosure. Pricing shown as published on VPN Sherlock; confirm current terms at checkout.
Full detail, including what we could not verify, is in the ZoogVPN review.
Providers we cover
Commercial terms exactly as published on VPN Sherlock. No speed or score columns, because we have not run the tests that would justify them.
| # | VPN | Best for | Key features | Protocols | Devices | Price | Learn more |
|---|---|---|---|---|---|---|---|
| 1 | | Best overall | Six published protocols — the widest range among the five compared here | 6 (incl. Shadow, ZoogTLS) | Unlimited | $2.49/month | Get dealRead review |
| 2 |  Proton VPN | Clearest obfuscation | The only provider here that publishes how its obfuscation protocol is built | 3 (incl. Stealth) | 10 | $4.99/month | Get dealRead review |
| 3 |  PureVPN | Most devices covered | Native Apple TV and Fire Stick apps, which removes the usual reason to configure a router | 3 (WireGuard, OpenVPN, IKEv2) | 10 | $3.24/month | Get dealRead review |
| 4 |  | Most obfuscation options | Two proprietary transports, one of them available at router level. No IKEv2 | 4 (incl. OpenWeb, StealthVPN) | 5 | $5.00/month | Get dealRead review |
| 5 |  Windscribe | Most flexible | Manual config generation for all three protocols, plus a free tier you can evaluate first | 3 (OpenVPN, IKEv2, WireGuard) | Unlimited | $3.00/month | Get dealRead review |
How we research
Why there are no scores on this site
Start here
- VPN technology hub — the whole stack, layer by layer.
- How a VPN works — tunnelling and what your ISP still sees.
- How to test a VPN — verify leaks and kill switches in about fifteen minutes.
- Best VPN for the USA — five providers compared on protocols, not scores.
Protocol comparison
WireGuard vs OpenVPN: Speed, Firewalls, Privacy
How WireGuard and OpenVPN differ in codebase, cipher negotiation, transport and roaming, and which one to pick on a restrictive network.
Read the guideTechnical guide
VPN Encryption: Ciphers, Keys and Forward Secrecy
What AES-256-GCM, ChaCha20-Poly1305 and Curve25519 do inside a VPN tunnel, why forward secrecy matters, and what encryption cannot protect you from.
Read the guidePractical tool
How to Test a VPN: Leak and Kill Switch Checks
A reproducible fifteen-minute routine covering IP and DNS leaks, IPv6 and WebRTC, kill-switch failure modes and how to record results honestly.
Read the guide