VPN Protocols Explained: Types, Best Uses and Service Support

A VPN protocol is the set of rules an app and its server follow to build the tunnel: key exchange, encryption, and the transport underneath, UDP or TCP. That determines speed, stability on bad links and what a firewall or DPI filter sees. For raw speed pick WireGuard, for a device with only a built-in client pick IKEv2, for a network that hunts VPNs pick a disguised transport like VLESS with Reality, and avoid PPTP everywhere.

Three protocol families and what each is for

Classic tunnels: WireGuard, OpenVPN, IKEv2 and the legacy options

WireGuard uses a small codebase, modern cryptography and UDP only, and rotates session keys every few minutes, which gives perfect forward secrecy (WireGuard's own protocol description). OpenVPN is heavier but runs on UDP or TCP; on TCP 443 it resembles web traffic, though DPI can still fingerprint its handshake (services supporting OpenVPN). IKEv2 uses UDP 500 and 4500, reconnects quickly when a phone switches networks, and is built into Windows, macOS, iOS and Android. L2TP/IPsec, SSTP and SoftEther matter for old routers; PPTP is legacy with broken encryption.

Censorship-resistant transports: VLESS Reality, Trojan, Hysteria2, Shadowsocks

These make VPN traffic look like ordinary HTTPS or noise so deep packet inspection cannot single it out. VLESS with Reality borrows the TLS handshake of a real website, Trojan poses as a normal HTTPS server over TCP with TLS, and Hysteria2 and TUIC run over QUIC (UDP), which helps on lossy links, but they fail on networks that block UDP. These transports usually need a third-party client such as v2rayNG plus a config link or QR code.

Providers' own protocols: what NordLynx, Lightway or Hydra actually are

Several are built on WireGuard: NordLynx uses it directly, and Proton's Stealth wraps it in TLS. Others, such as ExpressVPN's Lightway and Hotspot Shield's Hydra (also used by Betternet and Bitdefender VPN), are separate designs, and some brands do not describe theirs at all. See the ranking of services with their own protocol.

How many of the 377 services support each protocol

Counts come from the main VPNRadarLab ranking; the hub table above is larger because it also lists clients and panels.

The table leaves out L2TP/IPsec, SSTP, SoftEther, VMess, Trojan, AmneziaWG and obfs4; their counts in the main ranking are L2TP/IPsec 63, SSTP 19, VMess 17, SoftEther 11, Trojan 11, AmneziaWG 9 and obfs4 6. Context: 273 of 377 list a classic tunnel, only 66 list a censorship-resistant protocol, and 50 do not list any protocol, which means the protocol is not stated, not that it is missing.

Picking a protocol by task

• Speed, gaming, streaming: WireGuard, including WireGuard-based designs like NordLynx.
• Wi-Fi that drops VPNs at a hotel or office: OpenVPN over TCP 443 first, then the provider's obfuscation mode; the kill switch stops leaks when the tunnel drops.
• Country-level filtering: VLESS with Reality or Trojan; Hysteria2 if the link is unstable and UDP gets through.
• A smart TV, router or work laptop that allows no app: IKEv2 or a manual OpenVPN config.

How protocols move the security and bypass sub-scores

Security, 20% of the overall score with 14 points available, awards 1.5 for WireGuard or a provider's own protocol alike, 1 for post-quantum encryption and 0.5 for perfect forward secrecy; OpenVPN alone adds no protocol points, and PPTP as the sole option costs 2. Of the 10.5 points in the bypass sub-score (15% weight), the censorship-resistant protocols supply 7, with VLESS Reality weighted highest at 1.5 and the others earning less, while an obfuscation or stealth mode adds a separate 2. Medians across all 377: 3.3 with at least one hiding protocol, 1.9 with an obfuscation toggle only, 0.0 with neither, and 6.2 for the 11 services carrying three or more. Only 9 of 377 score 5 or higher and 173 score zero. VPNRadarLab scores only what providers publish; it does not run speed or blocking tests.

FAQ

What is the most secure VPN protocol?

WireGuard or a properly configured OpenVPN. The provider's logging policy matters more than the cipher.

Is a VPN TCP or UDP?

Mostly UDP: WireGuard, Hysteria2 and TUIC are UDP-based, and IKEv2 uses UDP too. OpenVPN can run over TCP when UDP is blocked.

Does a proprietary protocol mean better security?

The score gives it the same 1.5 points as WireGuard without checking how good it is, so look for a technical description and audits yourself.

Short answer

WireGuard for speed, IKEv2 for built-in clients, OpenVPN over TCP 443 for fussy networks, VLESS Reality or Trojan for real censorship. Classic tunnels dominate the ranking; hiding transports are rare, and that scarcity explains their weight in the bypass score.