Culvert VPNVPN protocols explained: WireGuard, OpenVPN and IKEv2
A VPN protocol is the set of rules that builds the encrypted tunnel. How WireGuard, OpenVPN and IKEv2 differ in speed, size and getting through.
Protocols and the technology
You do not need to pick a protocol, but it helps to know what the app is doing. These guides explain WireGuard, OpenVPN and IKEv2, UDP versus TCP, a VPN wrapped in TLS on port 443, handshakes, MTU, keepalives, and the DNS and IPv6 leaks that careless apps forget.
13 guides · RSS
What WireGuard is, and why modern VPNs use it
WireGuard is a small, fast VPN protocol with fixed modern cryptography, a one-round-trip handshake and built-in roaming. How it works and its limits.
WireGuard vs OpenVPN on a phone
WireGuard is quicker, lighter on battery and roams without reconnecting; OpenVPN can run over TCP 443 where UDP is filtered. Which wins on a phone.
WireGuard vs IKEv2: reconnects, roaming and battery
WireGuard and IKEv2 both roam between networks and are light on battery. They differ in ports, handshake weight and how easily a network filters them.
UDP vs TCP for a VPN: speed versus getting through
UDP is the right transport for a VPN because it avoids stacked retransmission; TCP is the one that connects where UDP is filtered. The trade explained.
A VPN inside TLS on port 443: how it works and when you need it
Wrapping a VPN tunnel in TLS on TCP port 443 makes it look like HTTPS, so it connects on networks that filter ports or protocols. How, and what it costs.
VPN encryption explained without the jargon
VPN encryption does three jobs: agreeing a secret key, scrambling each packet and proving nothing was altered. What each means and what it cannot do.
What a VPN handshake is, and why the first second matters
A VPN handshake is the exchange that proves both sides are genuine and agrees session keys. What happens in it, and why an app must not wait on silence.
MTU and VPNs: why some sites load and some hang
A VPN shrinks the largest packet a connection can carry. Set that MTU too high and small pages load while large ones hang. What MTU is and what fixes it.
IPv6 and VPNs: the leak many apps forget
An IPv6 leak is when the tunnel carries IPv4 only while the phone still has an IPv6 route, so IPv6 traffic goes around the VPN. How to spot and stop it.
What a DNS leak is
A DNS leak is when your phone's name lookups go to the local network's resolver instead of through the VPN, exposing every site you visit. The fix.
Why a VPN sends keepalives
A VPN keepalive is a small packet sent about every 25 seconds so the router between you and the server does not forget the connection. Why NAT needs it.
Why VPN sessions expire and reconnect
A VPN session expires because its keys and server-side record are meant to be temporary. Why a 24-hour ceiling is a feature, and what reconnecting does.