The protocol decides how a VPN encrypts traffic, how fast it runs, how much battery it uses, and — the key question in 2026 — whether it gets through filtering systems at all. We compare WireGuard, OpenVPN, VLESS and Xray, Shadowsocks, MeduzaVPN ULTRA and other protocols and explain which one to choose for a given task.
What a VPN protocol is and why it matters
A protocol is a set of rules by which the client and server establish a connection, encrypt data and package it into packets. It decides four practical qualities: speed, latency and battery use, compatibility with devices, and how the traffic looks to the carrier’s equipment.
Until recently, that last point could be ignored. Now, in a number of countries including Russia, carriers use deep packet inspection (DPI) and restrict connections that look like a VPN. So there’s no longer a “best protocol” independent of the network: something that works perfectly at home might not connect on a mobile network. For the general basics, see the article what a VPN is.
Protocol and transport aren’t the same thing
Many protocols support several transports: the same VLESS can run over TCP with TLS, over WebSocket, or over gRPC, while WireGuard only runs over UDP. The transport decides which ports the packets travel through and in what form. When a carrier restricts UDP entirely, no amount of disguise saves a UDP protocol, while a TCP transport on port 443 gets through. So when choosing, look at the pair “protocol + transport,” not just the name.
Protocol comparison table
The ratings below reflect a typical 2026 experience; results can differ on a specific network. All of the protocols listed are available on a MeduzaVPN personal server.
| Protocol | Speed | Resistance to filtering | Battery | Platforms |
|---|---|---|---|---|
| MeduzaVPN ULTRA | High | Very high | Moderate use | iOS, Android, macOS, Windows, Linux, TV |
| MeduzaVPN | Very high | High | Low use | All apps, routers |
| VLESS / Xray (REALITY) | High | Very high | Moderate use | All apps, routers |
| Shadowsocks / Outline | High | Medium | Low use | All apps, routers, older devices |
| WireGuard | Very high | Low | Low use | All apps, routers |
| OpenVPN | Medium | Low | High use | All apps, routers, corporate gateways |
| IKEv2 / IPsec | High | Low | Low use | Built into iOS, macOS, Windows |
| Hysteria | Very high on lossy channels | Medium | Moderate use | Mobile and desktop apps |
| SoftEther | Medium | Medium | High use | Windows, Linux, routers |
| SOCKS5 | High | Low (no encryption) | Minimal use | Individual apps |
Classic protocols: WireGuard, OpenVPN, IKEv2
WireGuard
WireGuard is the most modern of the classic protocols: around four thousand lines of code, ChaCha20 and Curve25519 cryptography, running over UDP. It sets up a connection fast, barely uses any battery, and survives a switch from Wi-Fi to mobile data instantly. Its weak point is a recognisable handshake that DPI spots without much trouble.
OpenVPN
OpenVPN is older and heavier: a TLS handshake, more overhead, running in user space. In return it supports a TCP mode that gets through strict corporate firewalls, and it runs on almost any hardware. For everyday use on a phone it uses noticeably more battery than WireGuard.
IKEv2 / IPsec
IKEv2 is built into iOS, macOS and Windows, so it needs no third-party app. It’s fast and survives network changes well, but it uses fixed ports 500 and 4500 with a known packet format. On filtered networks it’s one of the first protocols to stop connecting.
Protocols with disguise: ULTRA, VLESS, Shadowsocks
MeduzaVPN ULTRA
ULTRA is MeduzaVPN’s own protocol, built for modern filtering systems. It has no persistent signatures, changes its parameters between sessions, and its packet lengths and timing resemble ordinary web browsing. The app picks the settings automatically — you just need to select the protocol from the list.
MeduzaVPN
The MeduzaVPN protocol is an obfuscated version of a classic UDP tunnel: the handshake is hidden, and variable-length noise is added to the packets. It keeps WireGuard’s speed and efficiency but has none of its recognisable traits. A good choice for home Wi-Fi and routers where filtering is moderate.
VLESS and Xray with REALITY
VLESS is a lightweight protocol with no encryption of its own, relying on TLS instead. In the Xray core it’s paired with the REALITY transport: the client uses a real browser fingerprint, and the server responds like a real, large website during verification. To DPI, this connection is indistinguishable from ordinary HTTPS. V2Ray is the previous generation of the same family, compatible with VLESS but without REALITY.
Shadowsocks and Outline
Shadowsocks encrypts the stream with no headers at all, so DPI has no obvious signature to look for. It’s undemanding on resources and runs even on weak routers. Outline is the same Shadowsocks with a convenient key scheme. Some networks have learned to restrict it by statistical patterns, so by 2026 it’s more often used as a fallback.
Special cases: Hysteria, SoftEther, SOCKS5
Hysteria runs over QUIC and manages congestion aggressively, so it wins out on channels with packet loss: satellite internet, congested cell towers, Wi-Fi on trains. Where UDP is restricted, it won’t connect.
SoftEther wraps traffic in HTTPS and is useful on networks where only port 443 over TCP is allowed. It’s heavier than the others and rarely needed on a phone, but it helps on corporate and hotel networks.
SOCKS5 isn’t a VPN — it’s a proxy. It doesn’t create a system-wide tunnel and doesn’t encrypt traffic on its own, but it lets you route a single program through the server: a browser, a torrent client, a messenger. On a MeduzaVPN personal server, SOCKS5 is available as an add-on to the main protocols.
Which protocol to choose
- Mobile network in Russia or another country with filtering: start with MeduzaVPN ULTRA, with VLESS and REALITY as a fallback.
- Home Wi-Fi with moderate filtering: the MeduzaVPN protocol gives maximum speed; switch to ULTRA if it fails.
- An unrestricted network (travelling to another country, corporate access): WireGuard, as the fastest and most efficient option.
- A router or an older device: Shadowsocks or WireGuard — they need the fewest resources.
- A network where only TCP 443 is allowed: VLESS, SoftEther, or OpenVPN in TCP mode.
- An unstable, lossy channel: try Hysteria, if UDP isn’t blocked.
There’s no protocol that’s guaranteed to work everywhere. The right strategy is to have several protocols on one server and switch when the network changes.
How to switch protocols in MeduzaVPN
A MeduzaVPN personal server runs every protocol at once: ULTRA, MeduzaVPN, WireGuard, OpenVPN, VLESS, V2Ray, Xray, Shadowsocks, Outline, Hysteria, SOCKS5, IKEv2 and SoftEther. Each one listens on its own ports on the same IP address, so switching protocol changes neither your location nor the address that websites see.
In the app, the protocol is chosen in the connection settings. Switching takes a few seconds: the app tears down the current tunnel, brings up a new one, and remembers the choice for that network. Split-tunneling settings and the kill switch apply to every protocol the same way.
For routers running OpenWrt and other devices without an app, the website has ready-made configurations for WireGuard, VLESS, Shadowsocks and OpenVPN — more on that at VPN for a router.
Every protocol is included with any plan at no extra cost: 5.99 USD a month, cheaper when you pay yearly, with the first seven days of a subscription free. Compare the terms on the personal VPN pricing page.
FAQ
Which VPN protocol is the fastest?
On an open network with no filtering, WireGuard is fastest: it has compact code, modern cryptography and low overhead. But on networks with DPI, speed is decided not by the protocol itself but by whether it gets through at all. There, MeduzaVPN ULTRA and VLESS with REALITY end up faster simply because a filter doesn’t slow them down.
How is VLESS different from Xray and V2Ray?
V2Ray and Xray are cores — programs that implement a set of protocols. VLESS is one of the protocols inside them. Xray develops VLESS more actively and added the REALITY transport to it, which disguises the connection as a real website. That’s why in 2026 the VLESS + Xray + REALITY combination is considered the most resilient in this family.
Why is OpenVPN still used?
OpenVPN is time-tested, runs on almost any hardware including old routers and corporate gateways, and supports a TCP mode that gets through strict corporate firewalls. At home it lags behind WireGuard in speed and battery use.
Which protocol uses the least battery on a phone?
WireGuard and the MeduzaVPN protocol built on it: they run over UDP, don’t keep a persistent TLS state, and quickly restore the connection after a network change. ULTRA and VLESS use a bit more because of their obfuscation, but in practice the difference is only noticeable during continuous data transfer.
Do I need to change servers when I switch protocols?
Not with MeduzaVPN. Your personal server runs all protocols at once, and the app switches between them on the same IP address. Your location, split-tunneling settings and kill switch all stay as they are.
What is Hysteria and when is it useful?
Hysteria runs over QUIC and uses its own congestion control, so it holds up well on unstable channels with packet loss — satellite internet or a congested mobile network, for example. On networks where UDP is restricted, it won’t connect, and you should switch to a TCP-based protocol.
Why would I need SOCKS5 if I already have a VPN?
SOCKS5 isn’t a VPN — it’s a proxy for individual programs: a browser, a torrent client, a messenger. It doesn’t encrypt traffic on its own and doesn’t cover the whole device. On a MeduzaVPN personal server it’s available as an add-on for apps you want to route through the server without a system-wide tunnel.