WireGuard vs OpenVPN: Which One You Go Self-Host?

Di short answer

WireGuard vs OpenVPN, for one person wey dey run VPN server for im own VPS, no be close contest: choose WireGuard. E smaller, e dey run inside Linux kernel, e connects within fraction of one second, and working client config na about ten lines. OpenVPN still get four real jobs, and if none of dem concern you, you no need am.

Those four jobs na to comot from network wey dey allow only TCP port 443, connect to existing certificate authority, authenticate named users with password or second factor, and bridge for Layer 2. Everything below na evidence behind this recommendation, plus the exact point wey each exception start to apply to you.

Why WireGuard win for people wey dey host their own servers

The codebase small reach make person fit read am. The WireGuard project put the protocol implementation for around 4,000 lines of code. OpenVPN don reach six figures once you count the OpenSSL library wey e depend on for every cryptographic operation. Size matter because every line na attack surface, and neither you nor your reviewer go read 100,000 lines. You fit read 4,000.

E dey run for the kernel. WireGuard don dey mainline Linux since 5.6, so Ubuntu 24.04 and Debian 13 ship am with nothing to compile. Packets dey encrypted where dem already dey, for kernel space, without copying dem go userspace process and come back. Check am before anything else:

sudo modprobe wireguard && echo ok

For KVM VPS, output na ok. For container virtualisation wey dey share the host kernel, like OpenVZ or LXC, e fail with Operation not supported, because you no fit load module into kernel wey no be your own.

Nothing dey negotiate. WireGuard get one fixed cipher suite: ChaCha20-Poly1305 for data, with Curve25519 keys. No version dey to downgrade, and no option dey wey you fit set wrong. OpenVPN dey negotiate the cipher and the TLS (transport layer security) version with each client. That one give flexibility, but na there misconfiguration fit enter. Server wey dem leave with data-ciphers AES-256-GCM:AES-128-CBC go happily fall back to CBC cipher for client wey no offer anything better, and nothing for the log go call am problem.

The port no dey answer. WireGuard packet wey fail its message authentication check dey drop without any reply, so nmap -sU -p 51820 dey return open|filtered whether anything dey listen or not. OpenVPN server for TCP mode dey complete TCP handshake before e decide say you no welcome. That one enough to show scanner say something dey there. OpenVPN over UDP with tls-crypt nearly quiet reach, so this argument dey against running OpenVPN for TCP, not against OpenVPN itself.

Roaming no cost anything. WireGuard peer dey identify by its public key, not by its address. Your laptop move from house go mobile hotspot, send one handshake from the new address, and the server update the endpoint wey e dey reply to. Nothing reconnect because nothing ever connect. OpenVPN fit do something similar with float, but the client normally tear down and rebuild full TLS session. Na why the pause when you open the lid dey noticeable for OpenVPN, but e no dey happen for WireGuard.

Speed in 2026: di gap don narrow

For many years, di correct argument about speed be say OpenVPN copy every packet enter userspace, encrypt am there, then copy am back, while WireGuard no ever comot from kernel. That one no be the complete picture again, and any comparison wey ignore am don old.

OpenVPN 2.7 release for February 2026 with support for upstream ovpn kernel module, wey dem merge into Linux 6.16. This na DCO (data channel offload): control channel remain for userspace, while bulk data path move enter kernel, similar to wetin WireGuard don always do. For kernel and OpenVPN wey new enough to use am, throughput dey the same class, no be say one dey far ahead of the other. Check wetin you actually get:

uname -r
openvpn --version | head -n 1
modinfo ovpn 2>/dev/null | head -n 3

As of July 2026, stock Ubuntu 24.04 LTS dey ship OpenVPN 2.6, no be 2.7, and ovpn module need 2.7. For that release, you fit get offload only through the older openvpn-dco-dkms package. E build out-of-tree module against the kernel wey dey run, so e go rebuild whenever you upgrade kernel. Na extra moving part be that, and WireGuard no get am.

Read the fine print for DCO before you count am as reason to remain. E support Layer 3 tunnels only. E accept only AEAD ciphers (authenticated encryption with associated data: AES-GCM or ChaCha20-Poly1305). E no support compression. For server, e work only with topology subnet. All these restrictions remove some of the flexibility wey originally make OpenVPN useful. Fast OpenVPN na OpenVPN wey dem configure to look like WireGuard.

No trust any person published throughput number, including the one for this page. For VPS, CPU allowance or network allowance usually be the limit, no be the protocol. Measure your own with iperf3 running across the tunnel, then run am again outside the tunnel, and compare both results.

Where OpenVPN still dey useful

You need to pass through TCP port 443. WireGuard na UDP only, by design, and no TCP mode dey come. Hotel network or corporate proxy wey dey allow only TCP 443 go pass OpenVPN wey you configure with proto tcp-server and port 443, because that traffic look like normal TLS session. WireGuard need wrapper like wstunnel or udp2raw to cross the same network. That one mean say you get one more process to run and keep patched. Note the conflict: if web server already dey hold TCP 443 for that IP address, one of them must move.

You already dey run certificate authority. OpenVPN dey authenticate with X.509 certificates, so e fit enter PKI (public key infrastructure) wey you already dey operate. Certificates expire by themselves, and you revoke one by adding am to certificate revocation list wey the server dey read through crl-verify. WireGuard get no certificates, no expiry and no revocation list. To remove peer, you edit the server config and reload am. For ten peers, that one no hard. For four hundred, with audit requirement, the certificate model dey do real work for you.

You need named users, no be keys alone. OpenVPN fit hand authentication to external system with auth-user-pass-verify or plugin like openvpn-plugin-auth-pam.so. Na so people dey add LDAP or one-time-password second factor. WireGuard get no concept of user at all. A key either dey inside the config or e no dey there. If your requirement be say "Sara must enter code from her phone", WireGuard no fit express that by itself.

You need Layer 2, or client for something ancient. OpenVPN with dev tap dey bridge Ethernet frames. This one matter for broadcast protocols and old LAN games. WireGuard na Layer 3 only, and e go always remain so. OpenVPN still get clients for hardware and operating systems wey no go ever see WireGuard app. Both reasons dey reduce, and dev tap no compatible with DCO, so you go use the slow path when you choose the bridge.

Wetin the two setups really dey cost you

WireGuard identity na one command. The parentheses matter because dem set the file mode before the key dey exist:

(umask 077; wg genkey > private.key)
wg pubkey < private.key > public.key

The OpenVPN equivalent na certificate authority wey you go own for as long as the VPN dey exist:

sudo apt install -y easy-rsa
make-cadir ~/openvpn-ca
cd ~/openvpn-ca
./easyrsa init-pki
./easyrsa build-ca
./easyrsa gen-req server nopass
./easyrsa sign-req server server

Neither list unfair. The CA gives you expiry and revocation, but e costs you a private key wey you must protect for years, renewal wey you must remember, and rebuild if you lose am. If you no dey use wetin e gives you, you dey pay for nothing. The complete WireGuard procedure, including forwarding, NAT (network address translation) and handshake failures wey fit waste one afternoon, dey inside the guide for self-hosting a WireGuard VPN on your VPS.

Wetin each one dey ask from your firewall

WireGuard need exactly one inbound rule, for UDP on the port wey dey inside ListenPort:

sudo ufw allow 51820/udp
sudo ufw status verbose

OpenVPN need UDP 1194 by default, or TCP 443 if na dat path you choose. Both still need IP forwarding turned on and a source NAT rule, because Linux box dey drop packets wey no address am. Na this same part apply to both protocols, and na here most reports of "the tunnel connects but there is no internet" dey come from. If ufw new to you, start with the basics of the ufw firewall on a VPS, and remember say most providers dey run another network firewall for their control panel: rule wey you add for the server no go do anything if packet no ever reach the server. Understanding wetin port be and how Linux dey listen on one go make both checks faster.

How to choose, in one paragraph

Run WireGuard unless you fit sabi the specific thing wey e no fit do for you. If you need TCP 443 to escape a restrictive network, run OpenVPN there, and consider running both: dem use different ports and fit coexist for one server without conflict. If you need per-user accounts or a second factor, no dey force WireGuard to handle am. Put an identity layer above am instead. A self-hosted Headscale control server dey use WireGuard underneath and add the account model, key distribution and device approval wey plain WireGuard leave for you.

OpenVPN na WireGuard Migration without outage

No conversion dey happen. OpenVPN PKI no fit turn into WireGuard keys, because WireGuard no get certificates wey you fit convert. Every client go get fresh key pair, and you go generate am the same way you generate the server own.

Migrate dem in parallel instead of switching at once. WireGuard for UDP 51820 and OpenVPN for 1194 fit run for the same box at the same time. So bring up wg0, confirm am with sudo wg show by listing recent latest handshake, then move clients one after another. When OpenVPN peer list stop to change, stop the service with sudo systemctl disable --now openvpn-server@server. Keep the CA files until you sure say everything dey okay, because you no fit rebuild revoked client with CA wey you don delete.

One thing wey genuinely no dey carry across na your username and password accounts, plus the revocation trail wey follow dem. Decide where you go keep dem before you switch off the old server, no be after.

FAQ

WireGuard dey faster pass OpenVPN?

For normal Ubuntu 24.04 server, yes, and e fast well-well, because WireGuard dey encrypt for kernel while OpenVPN 2.6 dey pass every packet through userspace process. With OpenVPN 2.7 and the ovpn kernel module from Linux 6.16, data path dey also for kernel, so both dey for the same class. Use iperf3 across the tunnel measure your own speed instead of trusting number from blog, because for VPS, na usually your CPU or bandwidth allowance be the limit.

WireGuard fit run over TCP port 443?

E no fit run by itself. WireGuard na UDP only by design, and dem no plan TCP mode. To pass through network wey allow only TCP 443, you wrap am inside tunnel like wstunnel or udp2raw. This one add process wey you go run and patch for both ends. If na this restriction you dey face normally, OpenVPN with proto tcp-server and port 443 na the simpler answer.

OpenVPN insecure now?

No. Current OpenVPN with AEAD cipher like AES-256-GCM and tls-crypt enabled na reliable VPN. The reason to choose WireGuard dey come from another thing: OpenVPN carry much more code and many more options, so e give tired administrator plenty ways to configure am wrongly. Fewer choices mean fewer wrong configurations.

Which one I suppose choose for personal VPN on VPS?

WireGuard. One key pair for each device, one config file of about ten lines, one UDP port wey dey open, and handshake wey dey finish before you notice say e don start. Choose OpenVPN only if you dey connect regularly from networks wey block UDP, or if you must fit inside certificate authority or user directory wey already dey exist.