For a decade, “set up a VPN on your firewall” meant OpenVPN. Then WireGuard arrived, got merged into the Linux kernel, gained native support on OPNsense and pfSense, and rapidly became the default recommendation for homelab remote access. That shift is real and largely correct — but “WireGuard won, delete OpenVPN” is too simple. The two protocols make genuinely different tradeoffs, and there are still situations where OpenVPN is the better tool.
This compares the two as you’d actually deploy them on a firewall (this is about the protocols; for OPNsense-vs-pfSense WireGuard ergonomics specifically, see the WireGuard section of our OPNsense vs pfSense comparison).
TL;DR
| WireGuard | OpenVPN | |
|---|---|---|
| Protocol age / maturity | Newer, kernel-integrated | Long-established, battle-tested |
| Codebase size | Small (easier to audit) | Large |
| Throughput on equal hardware | Generally higher | Lower (more overhead) |
| CPU model | Single-thread-sensitive | AES-NI helps; multi-threaded options |
| Transport | UDP only | UDP or TCP |
| NAT / restrictive-network traversal | Good (UDP) | Better (can run over TCP/443) |
| Connection model | Stateless, rekeys on a timer | Session-based |
| Auth model | Static key pairs | Certificates, optional user/pass, MFA-friendly |
| Per-user revocation | Manual (remove peer key) | Mature PKI (revoke a cert) |
| Roaming (changing networks) | Excellent | Good |
| Client availability | Excellent, lightweight | Excellent, ubiquitous |
Short version: WireGuard is the right default for most homelab remote access and site-to-site. Keep OpenVPN in your pocket for restrictive networks (where TCP/443 camouflage matters) and for deployments that need certificate-based PKI with clean per-user revocation.
Performance
WireGuard’s design — a lean codebase, modern fixed cryptography (no cipher negotiation), and kernel integration — gives it lower overhead and generally higher throughput than OpenVPN on the same hardware. OpenVPN carries more protocol overhead and historically ran largely single-threaded in its classic configuration (newer OpenVPN versions and DCO — Data Channel Offload — improve this considerably, which is worth knowing if you’re comparing modern builds).
The practical caveat we always repeat: VPN throughput on a firewall tracks CPU performance more than the protocol label. WireGuard is single-thread-sensitive; OpenVPN benefits from AES-NI hardware acceleration for its data channel. On a weak CPU, neither will saturate a fast link. We deliberately don’t publish fixed Mbps figures here as if universal — they depend on the CPU, MTU, the link, and the client. For sizing the hardware, see our firewall hardware tiers guide.
NAT traversal and restrictive networks
This is OpenVPN’s standout remaining advantage. WireGuard is UDP only. That’s fine on most home and mobile networks, but some restrictive environments — hotel Wi-Fi, corporate guest networks, captive portals — block or throttle arbitrary UDP while letting TCP/443 through because it’s indistinguishable from normal HTTPS.
OpenVPN can run over TCP on port 443 via --proto tcp (OpenVPN 2.6 reference manual), making it blend in with web traffic and punch through networks that block UDP. If your use case is “I need to reliably reach home from any sketchy network on the planet,” OpenVPN-over-TCP/443 is more likely to just work. (There are WireGuard-over-TCP wrappers and obfuscation tools, but that’s added complexity OpenVPN gives you natively.)
For normal home/mobile use, WireGuard’s UDP is not a problem. Its handshake is initiated on demand and rekeys on a timer rather than on session teardown (WireGuard protocol documentation), so a client that goes quiet and comes back does not renegotiate a session first.
Authentication and revocation
The auth models differ meaningfully:
- WireGuard uses static public/private key pairs per peer. It’s simple and secure, but there’s no built-in PKI. Revoking access to a device means removing its peer entry from the server. For a handful of your own devices, this is trivial. For many users, manual key management gets tedious.
- OpenVPN uses a certificate-based PKI. You can issue per-user certificates, layer username/password and TOTP/MFA on top, and revoke a single user’s certificate cleanly through a certificate revocation list, which OpenVPN reads with
--crl-verify(OpenVPN 2.6 reference manual). For multi-user deployments where people come and go, this is a real operational advantage.
If your VPN serves an organization or a household where you want auditable, individually revocable access with optional MFA, OpenVPN’s model is more mature. If it’s your three personal devices, WireGuard’s key-per-device simplicity is fine.
Roaming and reliability
WireGuard handles network changes without a reconnect step. The server updates a peer’s endpoint from the source address of the most recent authenticated packet, so a client that moves from Wi-Fi to cellular keeps the same session once it sends one packet from the new address, and the documentation states outright that you do not need to ask it to reconnect (WireGuard protocol documentation). OpenVPN is session-oriented and renegotiates on transport change, which is reliable but slower. For a phone that changes networks several times a day, that difference is the one users notice.
Security posture
Both are considered secure when configured correctly. WireGuard’s small codebase (a few thousand lines versus OpenVPN’s much larger surface) is genuinely easier to audit and reason about, and it uses a fixed, modern cryptographic suite with no negotiation to misconfigure. OpenVPN is highly configurable, which is powerful but also means there are more ways to set it up suboptimally (weak ciphers, bad options). OpenVPN’s longevity means it’s been heavily scrutinized and hardened over many years.
Neither protocol is the weak link in a typical homelab; your key/cert hygiene and firewall rules are.
Client experience
- WireGuard clients are lightweight and available on all major platforms; config import via a small file or QR code is fast, and the apps are simple.
- OpenVPN clients are equally ubiquitous and well-supported, if a bit heavier; the
.ovpnprofile format is universally understood.
Both are good. WireGuard’s clients expose fewer settings, which follows from the protocol: there is no cipher negotiation to configure, only a key pair, an endpoint, and allowed IPs.
Which should you run?
Default to WireGuard if:
- This is personal/homelab remote access for a manageable number of your own devices.
- You want the best throughput-per-CPU and the smoothest roaming.
- Your clients connect from normal home/mobile networks.
Choose (or keep) OpenVPN if:
- You need to traverse restrictive networks that block UDP — TCP/443 is your escape hatch.
- You need certificate-based PKI with per-user MFA and clean revocation.
- You have an existing, working OpenVPN deployment with no pain — there’s no urgent reason to rip it out.
Plenty of setups run both: WireGuard as the primary tunnel, OpenVPN-over-TCP/443 as the break-glass fallback for hostile networks. On a firewall that supports both natively, that belt-and-suspenders approach costs little. Setup walkthroughs and platform-specific notes are collected under our firewall VPN guides.
Bottom line
WireGuard deserves its status as the modern homelab default — faster on equal hardware, simpler, with excellent roaming. But OpenVPN isn’t legacy cruft; its TCP/443 camouflage and mature certificate PKI are real capabilities WireGuard doesn’t natively match. Pick WireGuard first, and reach for OpenVPN when restrictive networks or multi-user PKI requirements make its strengths matter.
Further reading
Related across the network
- Tailscale Throughput: Why It’s Slow and How to Fix It — tailscaleguide.com
- How to Set Up OPNsense as a VPN Server: WireGuard, OpenVPN — opnsenselab.com
