VPN protocols compared: WireGuard, OpenVPN, AnyConnect, Hysteria2

• Whether it works on a restricted network. Many campus, office and hotel networks limit UDP and pass only TCP with TLS, the same traffic as opening a website. UDP-based protocols slow down or drop there; TLS-based ones carry on.
• How fast it is when packets are lost. Mobile data, old-building broadband and cross-border links lose packets often, and the way a protocol copes decides real speed on such links.
• How much battery it uses. The lighter the protocol and the fewer keep-alive packets it sends, the less power it draws; repeated reconnecting costs the most.
• Which devices can run it. Some protocols have a client built into nearly every system, router and NAS; others exist only as phone and desktop apps.
• One more point matters as much as the protocol itself: whether there is an alternative once it is detected. A service with a single protocol has nowhere to go when that protocol is disrupted.

• What it is: an open-source VPN protocol more than twenty years old; one .ovpn file carries everything needed to connect.
• Strengths: the widest support, with clients built into most router firmware, NAS systems and Linux servers; it runs over UDP or TCP.
• Weaknesses: heavier than newer protocols and harder on a phone battery; its handshake has a fixed signature that restrictive networks can recognise.
• Suits: routers, NAS boxes and servers that must connect at boot and run unattended. See How to use OpenVPN and when to choose it.

• What it is: a newer open-source VPN protocol with a small codebase, included in the Linux kernel, with clients for every mainstream system.
• Strengths: quick to connect, low encryption overhead, easy on the battery; the connection picks itself up when you move from Wi‑Fi to mobile data.
• Weaknesses: UDP only, so it fails or crawls where UDP is limited; its packet format is fixed and easy to recognise.
• Built on it: Tailscale adds account login and device-to-device reachability on top of WireGuard, producing a log-in-once, always-on mesh — see What the Private Network (Tailscale) Is.
• WireGuard vs OpenVPN: on a clean network WireGuard is faster and lighter; OpenVPN leads on device support and on being able to run over TCP.

• What it is: Cisco’s enterprise VPN protocol; the client is now called Cisco Secure Client. Open-source implementations exist: OpenConnect for the client and ocserv for the server.
• Strengths: traffic runs over standard TLS and looks from outside like a visit to an HTTPS site, so it keeps working on campus and office networks that limit UDP; you enter only an address, a username and a password, with nothing to import; companies worldwide rely on it for remote work, so clients are available on every platform.
• Weaknesses: once connected, the whole device takes the route, and keeping local sites direct needs separate split routing; on lossy links it is slower than a protocol designed for loss.
• Suits: campus and office networks, iPhones, older devices. More in Does AnyConnect work in China?

• What it is: an open-source proxy protocol built on QUIC, the UDP-based transport that HTTP/3 uses.
• Strengths: it handles packet loss deliberately and is the fastest of this group on mobile data, old-building broadband and cross-border links; its traffic resembles ordinary HTTP/3.
• Weaknesses: it uses UDP, so it slows or drops where UDP is limited; it needs a client that supports it, such as Hiddify and the sing-box family.
• Suits: your own phone and computer, a preference for speed, a lossy network. Import steps are in the Hiddify subscription guide.

v2ray is a proxy tool, not one protocol. The protocols it and similar tools support — VMess, VLESS, Trojan and others — share an idea with the plain HTTPS proxy: wrap proxy traffic in TLS so it looks like a visit to an HTTPS site. Most nodes in an “airport” subscription are of this kind; see VPN vs proxy subscriptions vs accelerators.

• Strengths: TCP with TLS gets through restricted networks; a single program can be proxied without touching the rest of the device.
• Weaknesses: these are proxies, not tunnels, so client rules decide what is proxied, and a wrong rule shows up as some sites failing to load; clients differ in the formats they accept.
• The simplest member is an HTTPS proxy in the browser: one extension, no client to install and no connection state — see What a Web Proxy Is and When to Use One.

One LeoTun account has six connection methods running on different protocols. Disruption to one is independent of the others, so when one struggles you switch to another on the same account.

• Cisco: Cisco AnyConnect, over TLS. First choice where UDP is limited. See the Cisco section.
• OpenVPN: prefers UDP and falls back to TCP automatically when UDP is limited. See the OpenVPN section.
• Private network: Tailscale, based on WireGuard. Log in once and stay online; devices on one account reach each other. See the private-network section.
• Hiddify: the Hiddify client with the hysteria2 protocol. Fastest on lossy links. See the Hiddify section.
• Web proxy: an encrypted HTTPS proxy that covers the browser only. See the web-proxy section.
• Router: the firmware makes the choice and updates itself; you log in and use it, with no protocol to pick. See the router section.
• For choosing by device, network and purpose, see Which connection method fits which scenario; for the order to switch in when something fails, see the troubleshooting checklist.