In March 2020, Linus Torvalds merged WireGuard into Linux kernel 5.6, calling it a work of art compared to the sprawling codebases of legacy VPN tunnels.

Architecture and Codebase: 4,000 Lines vs 600,000 Lines

A VPN protocol’s security footprint and execution speed depend heavily on its underlying code complexity. Unnecessary complexity introduces security bugs, increases maintenance friction, and slows down cryptographic audits.

WireGuard operates under a design philosophy of radical minimalism. Its core codebase comprises roughly 4,000 lines of C code. A single security researcher can audit the entire codebase over a weekend. By running directly inside the Linux kernel space, WireGuard eliminates context switching between user space and kernel space during packet transmission.

OpenVPN, created by James Yonan in 2001, sits at the opposite end of the spectrum. Including its mandatory OpenSSL cryptographic dependencies, the codebase spans anywhere from 70,000 to over 600,000 lines. OpenVPN runs in user space, forcing every data packet to traverse multiple system calls and context switches before leaving the network interface.

IKEv2 (Internet Key Exchange version 2, defined in RFC 7296) was developed jointly by Microsoft and Cisco. Designed to pair with IPsec for payload encryption, IKEv2 lives directly within OS network stacks, balancing performance with native platform availability.

L2TP (Layer 2 Tunneling Protocol, defined in RFC 3193) provides zero encryption on its own. It relies entirely on IPsec wrappers. This double-encapsulation design packs data into two separate headers, inflating packet overhead and degrading transmission throughput.

This fundamental difference in code footprint manifests directly in real-world bandwidth tests.

Throughput and Latency Benchmarks

Testing these four protocols across a symmetric 1Gbps fiber connection reveals massive disparities in bandwidth capacity and CPU efficiency.

WireGuard: Consistently achieves 800 to 950 Mbps throughput, adding less than 3ms of latency overhead. Its low CPU utilization makes it the gold standard for high-bandwidth tasks like 4K streaming and gaming.
IKEv2/IPsec: Reaches 600 to 800 Mbps under optimal conditions. Its standout feature is the MOBIKE protocol (RFC 4555), which maintains established tunnels when swapping network interfaces—such as moving from Wi-Fi to a cellular 5G tower—in under 100 milliseconds.
OpenVPN (UDP): Caps out between 200 and 400 Mbps on modern consumer hardware. While adequate for web browsing, it saturates CPU cores quickly when handling multi-gigabit workloads.
L2TP/IPsec: Struggles to exceed 150 Mbps due to double-encapsulation processing overhead.

To understand why these encryption engines strain processing cores differently, it helps to review the core mechanics of how VPN tunnels work.

Performance means little without strong mathematical guarantees protecting your data payload.

Cryptographic Standards and Security Vulnerabilities

Legacy VPN protocols embrace cryptographic agility, allowing client and server endpoints to negotiate encryption algorithms on the fly. WireGuard deliberately abandons this flexibility in favor of cryptographic versioning.