What is a VPN protocol?
A VPN protocol is the set of rules deciding how the tunnel is built and secured — how your device and the server authenticate each other, agree on keys, and package traffic. WireGuard, OpenVPN and IKEv2 are the ones in use, and they differ far more in speed and in what networks allow than in encryption strength.
What a protocol is responsible for
The tunnel is the encrypted path. The protocol is the set of rules for building and maintaining it: how your device proves who it is, how the two ends agree on keys without anyone watching learning them, how each packet is wrapped, and what happens when the connection drops.
People choose protocols expecting to choose a level of security. That is not really the axis. Every protocol in current use has cryptography nobody breaks — the differences that matter in practice are speed, how they behave when your network changes, and whether a restrictive network will carry them at all.
The four that matter
| Protocol | Strength | Weakness | Use when |
|---|---|---|---|
| WireGuard | Fastest; ~4,000 lines of auditable code; excellent on battery | UDP only; unmistakable to inspection | Default, unless something is blocking it |
| OpenVPN | Runs everywhere; TCP/443 crosses restrictive networks | Slower; TCP mode collapses on a lossy link | Hotel and conference Wi-Fi that allows only web traffic |
| IKEv2/IPsec | Survives switching from Wi-Fi to mobile data; native on iOS | Fixed well-known ports, blocked first | Phones that move between networks constantly |
| Obfuscated | Passes networks that detect and drop VPN traffic | Slower, sometimes considerably | Nothing else connects |
And one to recognise and refuse: PPTP. Its encryption has been practically breakable since 2012 — not as a research result but as a service you can rent — and current versions of Windows, macOS and iOS have removed or disabled it. If a device offers you nothing else, treat that connection as unencrypted.
The protocol recommender asks five questions and gives a reasoned answer, including "you do not need the stealthy one" when that is the truth.
Why TCP over TCP is a trap
Worth understanding, because "use TCP, it's more reliable" sounds obviously correct and produces a connection that collapses.
TCP guarantees delivery by retransmitting lost packets. Run a TCP connection inside another TCP connection and both layers retransmit the same loss, each one making the other's congestion control worse. On a clean link you barely notice. On a lossy mobile connection, throughput falls off a cliff.
It is called TCP meltdown, and it is the reason UDP is the correct choice whenever UDP is available — and why OpenVPN's TCP mode is a way through a restrictive network rather than a default to leave on.
Where obfuscation fits
A conventional protocol is not weak on a filtered network. It is recognisable. WireGuard has a fixed handshake structure with no cover story; deep-packet inspection identifies it in the first few bytes and drops the connection. Nothing about the encryption failed.
Obfuscated designs exist to remove that signature. The better ones also survive active probing, where a censor connects to a suspected server to see how it answers — a server that responds strangely under probing is identified regardless of how its traffic looks in transit.
JaguarVPN's two options split along exactly this line: Aurora is the fast default, and MIRAGE is the one for networks that filter — slower on purpose, because camouflage costs round trips. If your connection works, the fast one is the right answer and the stealthy one is a cost with no benefit.
The setting that matters more than the protocol
Protocol choice gets far more attention than it deserves relative to the kill switch, which gets almost none. A tunnel that drops without one puts you back on the bare network mid-session, silently, at exactly the moment you are least likely to be watching.
No protocol prevents that. It is a client setting, and it is the single most consequential one in the app.
Related questions
Which VPN protocol is the most secure?
Practically all of the current ones, which is why this is the wrong question to optimise. WireGuard, OpenVPN and IKEv2 all use modern cryptography that nobody breaks — attacks land on implementations and configurations, not on the ciphers. What actually differs between them is speed, battery use, and whether a restrictive network lets them through. The genuinely insecure options are PPTP, which has been practically breakable since 2012, and L2TP without IPsec.
Is WireGuard better than OpenVPN?
Faster and far smaller, yes — around 4,000 lines of code against hundreds of thousands, which is small enough to have been reviewed properly. But it is UDP-only and has a distinctive handshake, so a network that blocks UDP or inspects traffic will stop it, while OpenVPN over TCP port 443 often gets through. Neither is better in general; WireGuard is the right default and OpenVPN is the fallback that works when the default does not.
What is an obfuscated protocol and do I need one?
A design whose goal is that traffic analysis finds nothing worth blocking, for networks where VPNs themselves are what is being filtered. You need one only if conventional protocols fail to connect where you are — obfuscation costs speed and buys nothing on a network that is not filtering. It is also not stronger encryption: the confidentiality is identical, and what you are paying for is that the connection does not announce itself.
Why does my app switch protocols automatically?
Because the best choice depends on the network, and the network changes. A client that starts with a fast protocol and falls back when it fails will connect in more places than one that makes you diagnose the failure. Automatic selection is usually the right default. It is worth being able to override, though, for the case where you already know your network filters and would rather start with what works than wait through two failures first.