Choosing between AmneziaWG, WireGuard, and OpenVPN

WireGuard as the base architecture

WireGuard creates a layer-three interface and maps tunnel addresses to public keys. Its official specification lists Noise_IK, Curve25519, ChaCha20-Poly1305, BLAKE2s, SipHash24, and HKDF. Every outer packet uses UDP. The protocol rotates session keys and maintains compact peer state.

The focused model supports auditability and straightforward deployment. WireGuard excludes user provisioning, configuration delivery, and obfuscation. Its Known Limitations page places camouflage in an upper layer. That boundary does not weaken encryption; it defines project scope.

WireGuard fits controlled networks where operators need a system tunnel and UDP works. A network that classifies its fixed format or restricts UDP requires an extra layer or another transport. Base WireGuard does not offer a TCP mode.

What AmneziaWG 3.1 adds

AmneziaWG changes observable WireGuard fields. Version 3.0 supports H1 - H4 ranges, S1 - S4 prefixes, and I1 - I5 signature packets. J parameters define the count and size of junk packets. Amnezia lists DNS and QUIC as examples of patterns a configuration can resemble.

The cryptographic foundation follows WireGuard, but a standard WireGuard client cannot parse Amnezia-specific fields. Use AmneziaVPN 5.0.1.5 or newer or a compatible native client. Version 3.0 requires a fresh configuration rather than an in-place Legacy upgrade.

More fields create more failure modes. Overlapping H ranges, mismatched settings, or a packet beyond MTU can stop the connection. Masking addresses some classifiers but does not hide the server address or bypass a blanket UDP ban.

How OpenVPN differs

OpenVPN 2.6 supports TUN and TAP, TLS authentication, certificates, UDP, and TCP. In TLS mode, the control channel negotiates keys while the data channel transports tunnel traffic. tls-auth and tls-crypt can authenticate or conceal parts of control traffic. The feature set supports PKI, user authentication, proxies, and many platforms.

Official OpenVPN documentation recommends UDP for performance. TCP helps where UDP is unavailable, but TCP-over-TCP creates competing retransmission and congestion-control layers. Loss can amplify latency. Port TCP 443 improves firewall compatibility but does not make OpenVPN an HTTPS implementation.

The option set raises operational cost. Teams manage a CA, certificates, revocation, cipher negotiation, and client versions. That cost can make sense in organisations with existing PKI and compatibility requirements.

Security and trust models

WireGuard and AmneziaWG use peer keys and cryptokey routing. A leaked client PrivateKey requires peer revocation and replacement. AWG masking parameters cannot protect a stolen key. One profile per device limits revocation scope.

OpenVPN commonly uses a CA and client certificates in TLS mode. Operators revoke a certificate through a CRL and protect the root CA key. tls-auth or tls-crypt adds a shared control-channel secret that needs its own lifecycle.

Algorithm lists do not describe deployment security. An obsolete client, exposed admin panel, copied key, or wrong route can compromise any option. Current official sources and an auditable configuration matter more than a generic “most secure VPN” label.

Performance, MTU, and loss

WireGuard has kernel and userspace implementations around a compact UDP design. AmneziaWG adds fields and service packets, but official sources do not provide one performance-loss percentage for every platform. OpenVPN results depend on crypto libraries, data-channel mode, platform, and outer transport.

MTU affects all three. Encapsulation reduces available payload size. Fragmentation or broken path MTU discovery can stall large responses. An AWG signature packet beyond MTU may fragment before the handshake.

Test on equal servers, routes, and time windows. Record two-way throughput, p50/p95 RTT, loss, CPU, handshake time, and recovery after a network change. For OpenVPN TCP, add a lossy scenario to observe TCP-over-TCP behavior. One Mbps result cannot describe the user experience.

A practical decision matrix

Choose WireGuard for controlled networks that permit UDP and need a compact IP tunnel. Trial AmneziaWG 3.1 where fixed WireGuard features cause trouble and compatible clients are acceptable. Consider OpenVPN where PKI, established enterprise integration, proxy support, or TCP fallback takes priority.

Score operating systems, central revocation, transport policy, TUN or TAP, proxy needs, team skill, observability, and fallback. Test each eligible option with target carriers before issuing it to a user base.

Primary sources: and the OpenVPN 2.6 manual at OpenVPN’s Configuration guide explains its preference for UDP and the TCP-over-TCP tradeoff.

Add issuance and revocation to the matrix. WireGuard and AWG should use one peer per device, with the private key retained by the client. OpenVPN deployments should document certificate issuance, expiration, CRL handling, and root CA protection. Shared credentials prevent targeted revocation in every model.

Check DNS and IPv6 behavior after the tunnel connects. A successful handshake can coexist with DNS leakage or an IPv6 route outside the tunnel. Record resolvers, AllowedIPs or pushed routes, failure behavior, and expected exclusions. These results belong to service configuration rather than the cipher list.

Plan upgrades and rollback. AWG 3.1 introduces a client-version floor and new profiles when moving from Legacy. OpenVPN releases can change accepted TLS and data-channel settings. WireGuard key rotation still needs coordination. Run migration, revocation, and rollback with a test group.

Support cost completes the decision. Engineers need a short path through handshake, routing, DNS, and MTU checks. A protocol with theoretical benefits can produce longer outages if the team lacks logs and recovery access. Score diagnostic time and a safe fallback alongside transport features.

Run a single-user revocation drill before release. Remove a WireGuard or AWG peer, update the OpenVPN CRL, and confirm that unrelated devices retain access. Issue replacement credentials and verify the audit record. This exercise tests the operating model instead of the protocol brochure. Repeat it for a lost phone and an expired certificate. The runbook should name the owner, revocation target time, and user notification channel. These controls cover risks that throughput tables and cipher lists cannot show. Record the result and test date in the release log.