The protocol decides how a VPN encrypts traffic, how fast it runs, how much battery it uses, and — the key question in 2026 — how steadily it holds the connection on mobile and unstable networks. We compare WireGuard, OpenVPN, VLESS and Xray, Shadowsocks, MeduzaVPN ULTRA and other protocols and explain which one to choose for a given task.
What a VPN protocol is and why it matters
A protocol is a set of rules by which the client and server establish a connection, encrypt data and package it into packets. It decides four practical qualities: speed, latency and battery use, compatibility with devices, and connection stability on different networks.
That last point is often underestimated. Home Wi-Fi, mobile networks, public hotspots and congested links all behave differently: on some UDP is unstable, on others packets get lost. So there’s no “best protocol” independent of the network: something that works perfectly at home might work intermittently on a mobile network. For the general basics, see the article what a VPN is.
Protocol and transport aren’t the same thing
Many protocols support several transports: the same VLESS can run over TCP with TLS, over WebSocket, or over gRPC, while WireGuard only runs over UDP. The transport decides which ports the packets travel through and in what form. When UDP is unstable on your network, a UDP protocol will work intermittently, while a TCP transport on port 443 connects more steadily. So when choosing, look at the pair “protocol + transport,” not just the name.
Protocol comparison table
The ratings below reflect a typical 2026 experience; results can differ on a specific network. All of the protocols listed are available on a MeduzaVPN personal server.
| Protocol | Speed | Reliability on mobile networks | Battery | Platforms |
|---|---|---|---|---|
| MeduzaVPN ULTRA | High | Very high | Moderate use | iOS, Android, macOS, Windows, Linux, TV |
| MeduzaVPN | Very high | High | Low use | All apps, routers |
| VLESS / Xray (REALITY) | High | Very high | Moderate use | All apps, routers |
| Shadowsocks / Outline | High | Medium | Low use | All apps, routers, older devices |
| WireGuard | Very high | Low | Low use | All apps, routers |
| OpenVPN | Medium | Low | High use | All apps, routers, corporate gateways |
| IKEv2 / IPsec | High | Low | Low use | Built into iOS, macOS, Windows |
| Hysteria | Very high on lossy channels | Medium | Moderate use | Mobile and desktop apps |
| SoftEther | Medium | Medium | High use | Windows, Linux, routers |
| SOCKS5 | High | Low (no encryption) | Minimal use | Individual apps |
Classic protocols: WireGuard, OpenVPN, IKEv2
WireGuard
WireGuard is the most modern of the classic protocols: around four thousand lines of code, ChaCha20 and Curve25519 cryptography, running over UDP. It sets up a connection fast, barely uses any battery, and survives a switch from Wi-Fi to mobile data instantly. Its weak point is that it runs only over UDP: on networks where UDP is unstable, the connection can drop.
OpenVPN
OpenVPN is older and heavier: a TLS handshake, more overhead, running in user space. In return it supports a TCP mode for corporate networks where only TCP is open, and it runs on almost any hardware. For everyday use on a phone it uses noticeably more battery than WireGuard.
IKEv2 / IPsec
IKEv2 is built into iOS, macOS and Windows, so it needs no third-party app. It’s fast and survives network changes well, but it uses fixed ports 500 and 4500 with a known packet format. On hotel and corporate networks where those ports are closed, it won’t connect.
Modern protocols: ULTRA, VLESS, Shadowsocks
MeduzaVPN ULTRA
ULTRA is MeduzaVPN’s own protocol, built for a stable, fast connection. It encrypts traffic reliably and changes its parameters between sessions. The app picks the settings automatically — you just need to select the protocol from the list.
MeduzaVPN
The MeduzaVPN protocol is an enhanced version of a classic UDP tunnel based on WireGuard, with additional processing of the handshake and packets. It keeps WireGuard’s speed and efficiency. A good choice for home Wi-Fi and routers on a stable network.
VLESS and Xray with REALITY
VLESS is a lightweight protocol with no encryption of its own, relying on TLS instead. In the Xray core it’s paired with the REALITY transport: it encrypts the connection with TLS and doesn’t require a separate certificate for a domain. V2Ray is the previous generation of the same family, compatible with VLESS but without REALITY.
Shadowsocks and Outline
Shadowsocks encrypts the whole stream, with no open headers. It’s undemanding on resources and runs even on weak routers. Outline is the same Shadowsocks with a convenient key scheme. On unstable networks its connection holds up worse than newer protocols do, so by 2026 it’s more often used as a fallback.
Special cases: Hysteria, SoftEther, SOCKS5
Hysteria runs over QUIC and manages congestion aggressively, so it wins out on channels with packet loss: satellite internet, congested cell towers, Wi-Fi on trains. Where UDP is closed, it won’t connect.
SoftEther wraps traffic in HTTPS and is useful on networks where only port 443 over TCP is allowed. It’s heavier than the others and rarely needed on a phone, but it helps on corporate and hotel networks.
SOCKS5 isn’t a VPN — it’s a proxy. It doesn’t create a system-wide tunnel and doesn’t encrypt traffic on its own, but it lets you route a single program through the server: a browser, a torrent client, a messenger. On a MeduzaVPN personal server, SOCKS5 is available as an add-on to the main protocols.
Which protocol to choose
- A mobile or unstable network: start with MeduzaVPN ULTRA, with VLESS and REALITY as a fallback.
- Home Wi-Fi: the MeduzaVPN protocol gives maximum speed; switch to ULTRA if it fails.
- A stable network with a good link (office, corporate access): WireGuard, as the fastest and most efficient option.
- A router or an older device: Shadowsocks or WireGuard — they need the fewest resources.
- A network where only TCP 443 is allowed: VLESS, SoftEther, or OpenVPN in TCP mode.
- An unstable, lossy channel: try Hysteria, if UDP is open on the network.
There’s no protocol that’s guaranteed to work everywhere. The right strategy is to have several protocols on one server and switch when the network changes.
How to switch protocols in MeduzaVPN
A MeduzaVPN personal server runs every protocol at once: ULTRA, MeduzaVPN, WireGuard, OpenVPN, VLESS, V2Ray, Xray, Shadowsocks, Outline, Hysteria, SOCKS5, IKEv2 and SoftEther. Each one listens on its own ports on the same IP address, so switching protocol changes neither your location nor the address that websites see.
In the app, the protocol is chosen in the connection settings. Switching takes a few seconds: the app tears down the current tunnel, brings up a new one, and remembers the choice for that network. Split-tunneling settings and the kill switch apply to every protocol the same way.
For routers running OpenWrt and other devices without an app, the website has ready-made configurations for WireGuard, VLESS, Shadowsocks and OpenVPN — more on that at VPN for a router.
Every protocol is included with any plan at no extra cost: 5.99 USD a month, cheaper when you pay yearly, with the first seven days of a subscription free. Compare the terms on the personal VPN pricing page.
FAQ
Which VPN protocol is the fastest?
On a stable network, WireGuard is fastest: it has compact code, modern cryptography and low overhead. But on unstable and mobile networks, speed depends not only on the protocol but on how steadily the connection holds. There, MeduzaVPN ULTRA and VLESS with REALITY often end up faster simply because the connection drops less often.
How is VLESS different from Xray and V2Ray?
V2Ray and Xray are cores — programs that implement a set of protocols. VLESS is one of the protocols inside them. Xray develops VLESS more actively and added the REALITY transport to it, which encrypts the connection with TLS. That’s why in 2026 the VLESS + Xray + REALITY combination is considered the most stable in this family.
Why is OpenVPN still used?
OpenVPN is time-tested, runs on almost any hardware including old routers and corporate gateways, and supports a TCP mode for corporate networks where only TCP is open. At home it lags behind WireGuard in speed and battery use.
Which protocol uses the least battery on a phone?
WireGuard and the MeduzaVPN protocol built on it: they run over UDP, don’t keep a persistent TLS state, and quickly restore the connection after a network change. ULTRA and VLESS use a bit more because of additional traffic processing, but in practice the difference is only noticeable during continuous data transfer.
Do I need to change servers when I switch protocols?
Not with MeduzaVPN. Your personal server runs all protocols at once, and the app switches between them on the same IP address. Your location, split-tunneling settings and kill switch all stay as they are.
What is Hysteria and when is it useful?
Hysteria runs over QUIC and uses its own congestion control, so it holds up well on unstable channels with packet loss — satellite internet or a congested mobile network, for example. On networks where UDP is closed, as on some corporate and hotel networks, it won’t connect, and you should switch to a TCP-based protocol.
Why would I need SOCKS5 if I already have a VPN?
SOCKS5 isn’t a VPN — it’s a proxy for individual programs: a browser, a torrent client, a messenger. It doesn’t encrypt traffic on its own and doesn’t cover the whole device. On a MeduzaVPN personal server it’s available as an add-on for apps you want to route through the server without a system-wide tunnel.