VPN protocols compared

Updated 21 September 2026 · How we research

Protocol choice decides how fast a tunnel feels, whether it survives a network change, and whether a restrictive firewall lets it through at all. There is no single best option, which is why most clients ship several.

Choose a ZoogVPN protocol by priority

Availability can vary by platform. Confirm the current app before publishing platform-specific claims.

What matters most for this connection?

Start with the user's network, device and threat model—not a universal “best” protocol.

Speed and daily use
WireGuard
Modern, low-overhead option for streaming, gaming and general use.
Mobile stability
IKEv2 / IPsec
Useful when devices move between Wi-Fi and cellular networks.
Balanced compatibility
OpenVPN UDP
Established option balancing security, speed and compatibility.
Reliability / firewalls
OpenVPN TCP
More retransmission overhead, but often steadier on difficult networks.
Traffic obfuscation
Shadow
ZoogVPN option intended for restrictive or filtered networks.
TLS-based access
ZoogTLS
Specialized option documented for restricted environments.

Source basis: ZoogVPN Help Center protocol guide. Treat performance labels as vendor guidance until independently tested.

Choose by constraint first: what will the network allow? Then optimise for speed.

The main protocols

General protocol characteristics, independent of any single provider.

Protocol	Transport	Cryptography	Best suited to	Weakness
WireGuard	UDP only	ChaCha20-Poly1305, Curve25519, BLAKE2s — a fixed suite with no negotiation	Everyday use, streaming, gaming, battery-sensitive mobile use	Blocked wherever UDP is filtered; no built-in obfuscation
OpenVPN (UDP)	UDP	TLS control channel; AES-GCM or ChaCha20-Poly1305 data channel	A balanced default with wide router support	Higher CPU cost and slower handshakes than WireGuard
OpenVPN (TCP)	TCP, commonly port 443	Same as OpenVPN UDP	Hostile or heavily filtered networks	TCP-over-TCP can collapse throughput on lossy links
IKEv2/IPsec	UDP 500 and 4500	IKEv2 key exchange with an ESP data channel, typically AES-GCM	Phones moving between Wi-Fi and cellular	Fixed ports are easy to block; no obfuscation
Obfuscated transports	Usually TCP 443	A standard tunnel wrapped so it resembles ordinary TLS	Networks that actively block VPNs	Slower, and never guaranteed against active probing

How to choose

Default: WireGuard, unless something stops it working.
Phone that keeps switching networks: IKEv2/IPsec, which uses MOBIKE to survive an address change without rebuilding the tunnel.
Restrictive Wi-Fi that blocks UDP: OpenVPN TCP on port 443.
Network that actively blocks VPNs: an obfuscated transport — see obfuscation.
Whole-home coverage: whichever protocol your router firmware supports — see router setup.

What ZoogVPN offers

ZoogVPN's published protocol list, retrieved from its help centre on 21 September 2026.

Protocol	Platforms (per ZoogVPN)	ZoogVPN's stated use case
WireGuard	Windows, macOS, iOS, Android, Linux, routers	Speed and modern use cases such as streaming and gaming
IKEv2/IPsec	Windows, macOS, iOS, Android, Linux	Mobile users and keeping a connection alive while switching networks
OpenVPN (UDP)	Windows, macOS, iOS, Android, Linux, routers	Balanced speed and security; torrenting and streaming
OpenVPN (TCP)	Windows, macOS, iOS, Android, Linux, routers	Stable connections in firewalled environments
Shadow	Windows, macOS, iOS, Android	Bypassing censorship in highly restricted regions
ZoogTLS	Windows only	Accessing restricted content in heavily filtered networks such as Iran

According to ZoogVPN

ZoogVPN describes Shadow as designed for bypassing censorship in highly restricted regions, and ZoogTLS as a Windows-only option aimed at heavily filtered networks. Both are proprietary, so their internals are not publicly specified and we cannot assess them against an open standard.

Deeper comparisons: WireGuard vs OpenVPN, OpenVPN TCP vs UDP, IKEv2/IPsec, Shadow and ZoogTLS.

Frequently asked questions

Which VPN protocol is usually quickest?

WireGuard is generally quickest because it has a small codebase, a single fixed cipher suite and a one round-trip handshake. Actual speed depends far more on server distance and network conditions than on the protocol alone.

Which protocol should I use on public Wi-Fi?

WireGuard first. If the network blocks UDP, switch to OpenVPN TCP on port 443, which is hard to distinguish from ordinary HTTPS traffic.

Is WireGuard less private than OpenVPN?

WireGuard keeps peer information in memory by design, so providers add their own address-management layer on top. This is an implementation question for each provider rather than a flaw in the protocol.