VPN Protocol Performance Test: Latency and Throughput Analysis of WireGuard, OpenVPN, and IKEv2 on Mobile Networks

The surge in mobile work and remote access has made VPNs a critical tool for securing data transmission and privacy. However, significant performance differences exist among various VPN protocols, especially in the dynamic conditions of mobile networks. This article aims to provide a quantitative performance analysis of three mainstream protocols—WireGuard, OpenVPN, and IKEv2—on 4G/5G networks through practical testing, offering data-driven insights for technical selection.

Test Environment and Methodology

To ensure objectivity and comparability, we established a standardized test environment. The test device was a smartphone equipped with a Qualcomm Snapdragon 8 Gen 2 chip, running Android 14. The VPN server was deployed in a data center approximately 1500 km away, with a gigabit network uplink. The test network environments included urban 4G LTE and 5G SA networks.

The testing methodology covered three key dimensions:

1. Connection Establishment Time: The time required from initiating a connection to successfully establishing a tunnel, averaged over 50 repeated tests.
2. Network Latency (Ping): After the VPN tunnel was established, ICMP packets were sent to a fixed target server to measure the Round-Trip Time (RTT).
3. Throughput Test: Using the iPerf3 tool for TCP/UDP throughput tests over a 60-second duration to evaluate maximum bandwidth.

All tests were conducted during periods of relatively stable network load, and device performance bottlenecks were eliminated as a factor.

Comparative Analysis of Test Results

1. Connection Speed

Connection speed directly impacts user experience, especially when devices frequently switch networks or resume from sleep.

• WireGuard: Performed best, with an average connection time of just 0.3 seconds. This is due to its minimalist protocol design and stateless connection mechanism, which avoids complex handshakes.
• IKEv2: Followed closely with an average time of 1.2 seconds. IKEv2 is optimized for mobile networks, supporting the MOBIKE protocol for fast reconnection during IP address changes.
• OpenVPN: Had the slowest connection speed, averaging 3.5 seconds. Its TLS-based handshake process is more lengthy, a clear disadvantage in high-latency mobile environments.

2. Data Transmission Latency

Latency is a critical factor for real-time applications like online meetings and gaming. We conducted continuous ping tests to the server under stable connections.

• WireGuard: Led again, with an average latency of 45ms on 4G, only about 8ms higher than the bare connection (no VPN). This is credited to its efficient user-space implementation and modern cryptography (ChaCha20).
• IKEv2: Added about 15ms of latency, averaging 52ms. Performance remains excellent, making it a reliable choice balancing security and speed.
• OpenVPN: Had the highest latency overhead, increasing by over 30ms on average to 67ms. This is primarily due to its protocol overhead and potential encryption/decryption performance bottlenecks.

3. Throughput Performance

Throughput determines the speed ceiling for scenarios like file transfers and video streaming. Tests used the TCP protocol to simulate real high-traffic scenarios.

• WireGuard: On 5G networks, achieved peak throughput of 780 Mbps download and 210 Mbps upload, with efficiency loss controlled under 15%, performing close to the native network.
• IKEv2: Showed robust throughput at 650 Mbps download and 180 Mbps upload, with an efficiency loss of about 25%.
• OpenVPN: Demonstrated the most significant throughput bottleneck, reaching only 420 Mbps download and 110 Mbps upload, with efficiency loss exceeding 40%. Its performance may not meet demands on high-speed 5G networks.

Conclusion and Selection Recommendations

Based on the comprehensive test results, each protocol has its strengths and weaknesses:

• For Pursuing Ultimate Performance and Low Latency: WireGuard should be the first choice. It is particularly suitable for mobile work, HD video streaming, and real-time communication scenarios demanding high speed. However, being relatively new, some enterprise-grade features (like detailed user auditing) might be less mature than in traditional protocols.
• For the Best Balance of Mobility and Security: IKEv2 is the optimal choice. Co-developed by Microsoft and Cisco, it natively supports mobile device network switching, is widely built into mainstream operating systems for easy deployment, and its security is well-proven.
• For Maximum Compatibility and Configuration Flexibility: OpenVPN still holds value. It is open-source, highly configurable, can traverse most firewalls, and is irreplaceable in scenarios requiring high customization or running on legacy systems.

The final choice should be a trade-off based on the specific application scenario, security policy requirements, and performance tolerance. For most modern mobile users, WireGuard and IKEv2 offer a superior performance experience.