Does changing protocol affect my privacy?

All the main protocols (WireGuard, OpenVPN, IKEv2, Lightway) provide strong encryption. L2TP and PPTP are older protocols that are less secure and rarely used in modern VPN apps; avoid these if they appear as options.

Is "Automatic" a good VPN protocol setting?

For general use, Automatic is fine. It lets the VPN pick the best protocol for your current network. Where it gets tricky is troubleshooting: if you're trying to diagnose a specific problem, locking in a specific protocol gives you more control and makes it easier to work out what's causing the issue.

Why does switching from UDP to TCP sometimes fix things?

UDP sends data in discrete packets without confirming receipt, which makes it faster. TCP confirms each packet was received before sending the next, which makes it slower but more reliable on unstable connections. On a network that drops UDP packets (some firewalls do this deliberately), TCP will get through when UDP won't. It's slower, but it connects.

Will switching protocol fix streaming blocks?

Not usually, unless the network you're on is blocking VPN traffic entirely. If the VPN connects fine but the streaming service is detecting you, the problem is most likely the server's IP address, not the protocol. Try switching servers before spending time on protocol changes.

What is split tunnelling and is it related to protocols?

Split tunnelling lets you choose which apps use the VPN and which connect directly. It's separate from protocols. If your streaming app is excluded from the VPN in your split tunnelling settings, it won't be covered no matter which protocol you're running. Worth checking if the VPN appears active but the streaming app doesn't seem to be going through it.

How to Change Your VPN Protocol (and Which One to Use)

If your VPN keeps getting blocked or won't connect on certain networks, the protocol is often why. A protocol is simply the method your VPN uses to send your encrypted data. Different methods handle different types of blocks, and switching from one to another takes about 30 seconds in most VPN apps.

What a VPN protocol actually is

A VPN works by creating an encrypted tunnel between your device and a VPN server. The protocol is the connection method: the set of rules that determines how that tunnel gets built and how data travels through it. Think of it like different routes between two cities. Some are faster, some are more reliable in bad weather, and some are better at avoiding roadblocks.

Different protocols behave differently on restricted networks. Some are fast but easier for firewalls to spot and block. Others are slower but much better at getting through. Knowing which to reach for in which situation saves a lot of trial and error.

The main protocols and when to use them

WireGuard is the newest of the main protocols and, for most people in most situations, the best choice. It's faster than the alternatives, uses less battery on mobile, and is just as secure. If your VPN offers it and you're not on a heavily restricted network, use this one. NordVPN offers WireGuard under the name NordLynx.

OpenVPN is the long-standing standard. It's slightly slower than WireGuard but very well-established and extremely reliable. It comes in two variants: UDP, which is faster and better for streaming, and TCP, which is slower but better at getting through firewalls. If WireGuard isn't available or isn't working, try OpenVPN (UDP) first, then OpenVPN (TCP) if UDP fails.

IKEv2/IPSec is particularly good on mobile because it handles switching between wi-fi and mobile data without dropping the connection. If you're on a phone and your VPN connection keeps dropping when you move between networks, IKEv2 is worth trying.

Lightway is ExpressVPN's own protocol, built for the same goals as WireGuard: fast connections, low battery use, and quick reconnections. If you're on ExpressVPN, this is the one to use.

Not sure which protocol to pick? Start with WireGuard. It's the fastest, most reliable option on most networks and works for the vast majority of situations.

How to switch protocol

The protocol setting is usually in your VPN app's settings, one level below the main connection screen:

NordVPN: Settings > Connection > VPN Protocol. Select from Auto, NordLynx (WireGuard), OpenVPN (UDP), OpenVPN (TCP), or IKEv2/IPSec. Auto usually picks NordLynx.

ExpressVPN: The three lines (hamburger) menu > Preferences > Protocol. Options include Automatic, Lightway (UDP), Lightway (TCP), OpenVPN (UDP), OpenVPN (TCP), IKEv2. Automatic typically picks Lightway.

PureVPN: Settings > Protocol. Options include Auto, WireGuard, OpenVPN (UDP), OpenVPN (TCP), IKEv2, L2TP, and SSTP. WireGuard is the recommended starting point.

After changing the protocol, you'll need to disconnect and reconnect for the change to take effect. The same options are available in the mobile apps under the same Settings or Preferences area, though the layout may look slightly different on iOS or Android.

Which protocol to try first for streaming problems

For streaming on a home network, WireGuard (or NordLynx / Lightway) is the best starting point. It adds the least delay and works for the vast majority of streaming situations.

If streaming is working but you're getting buffering, the protocol usually isn't the cause. Buffering with an active VPN is almost always down to the server being too far away or under heavy load. Try a different server in the same country rather than changing protocol.

If you're on a restricted network (hotel, university, work) and the VPN won't connect at all, switch to OpenVPN (TCP) on port 443. Port 443 is the same port used by every HTTPS website, so networks almost never block it. This is the most reliable way to get a VPN through a tight firewall.

When protocol isn't the problem

Protocol changes are most useful when the VPN won't connect on a particular network at all, or when the connection keeps dropping. They're less likely to help if the VPN is connecting fine but streaming services are still detecting you. In that situation, the more likely causes are the server's IP address being flagged (see our guide on switching servers), a DNS leak, or the browser exposing your location. Try switching server first.