A very basic VPN protocol based on PPP. The PPTP specification does not actually describe encryption or authentication features and relies on the PPP protocol being tunneled to implement security functionality.
IKEv2 (Internet key exchange version 2) is part of the IPSec protocol suite. Standardized in RFC 7296. IPSec has become the defacto standard protocol for secure Internet communications, providing confidentiality, authentication and integrity.
Open-source VPN protocol developed by OpenVPN technologies. Very popular however not based on standards (RFC). Uses a custom security protocol and SSL/TLS for key exchange. Provides full confidentiality, authentication and integrity.
WireGuard® offers an extremely fast VPN connection with very little overhead and maintains security with state-of-the-art cryptography. It has the potential to offer a simpler, more secure, more efficient, and easier to use VPN over existing technologies.
The PPP payload is encrypted using Microsoft’s Point-to-Point Encryption protocol (MPPE). MPPE implements the RSA RC4 encryption algorithm with a maximum of 128 bit session keys.
IKEv2 implements a large number of cryptographic algorithms including 3DES, AES, Blowfish, Camellia. IVPN implements IKEv2 using AES with 256 bit keys.
OpenVPN uses the OpenSSL library to provide encryption. OpenSSL implements a large number of cryptographic algorithms such as 3DES, AES, RC5, Blowfish. As with IKEv2, IVPN implements AES with 256 bit keys.
Built atop ChaCha20 for symmetric encryption (RFC7539), Curve25519 for Elliptic-curve Diffie–Hellman (ECDH) anonymous key agreement, BLAKE2s for hashing (RFC7693), SipHash24 for hashtable keys, and HKDF for key derivation (RFC5869). Makes use of a UDP-based handshake and the key exchange uses perfect forward secrecy while avoiding both key-compromise impersonation and replay attacks.
The Microsoft implementation of PPTP has serious security vulnerabilities. MSCHAP-v2 is vulnerable to dictionary attack and the RC4 algorithm is subject to a bit-flipping attack. Microsoft strongly recommends upgrading to IPSec where confidentiality is a concern.
IPSec has no known major vulnerabilities and is generally considered secure when implemented using a secure encryption algorithm and certificates for authentication. However Leaked NSA presentations indicate that IKE could be exploited in an unknown manner to decrypt IPSec traffic.
OpenVPN has no known major vulnerabilities and is generally considered secure when implemented using a secure encryption algorithm and certificates for authentication.
New and has not seen the thorough vetting of OpenVPN, though the code-base is extremely small, so full audits are possible by individuals and not just large organizations. The cryptography has been reviewed, but WireGuard® should still be considered experimental and only used in testing and non-production environments where security is not critical.
With RC4 and 128 bit keys, the encryption overhead is least of all protocols making PPTP the fastest.
IPSec with IKEv2 should in theory be the faster than OpenVPN due to user-mode encryption in OpenVPN however it depends on many variables specific to the connection. In most cases it is faster than OpenVPN.
When used in its default UDP mode on a reliable network OpenVPN performs similarly to IKEv2.
WireGuard® benefits from extremely high-speed cryptographic primitives and deep integration with underlying operating system kernel, so speeds are very high with low overhead.
PPTP uses TCP port 1723 and GRE (Protocol 47). PPTP can be easily blocked by restricting the GRE protocol.
IKEv2 uses UDP 500 for the initial key exchange, protocol 50 for the IPSEC encrypted data (ESP) and UDP 4500 for NAT traversal. IKEv2 is easier to block than OpenVPN due to its reliance on fixed protocols and ports.
OpenVPN can be easily configured to run on any port using either UDP or TCP thereby easily bypassing restrictive firewalls.
WireGuard® uses the UDP protocol and can be configured to use any port. May succumb to traffic shaping more easily than OpenVPN due to lack of support for TCP.
All versions of Windows and most other operating systems (including mobile) have native support for PPTP. PPTP only requires a username, password and server address making it incredibly simple to setup and configure.
Windows 7+, macOS 10.11+ and most mobile operating systems have native support for IPSec with IKEv2.
OpenVPN is not included in any operating system release and requires the installation of client software. Installation typically takes less than 5 minutes.
Not currently included in any operating system and requires the installation of client software and a kernel module. Ultimately, WireGuard® will be included in the kernel for smartphones and macOS, Linux, and other *nix-like operating systems.
PPTP is not as realiable, nor does it recover as quickly as OpenVPN over unstable network connections. Minor compatibility issues with the GRE protocol and some routers.
IPSec is more complex than OpenVPN and can require additional configuration between devices behind NAT routers. However as long as both the server and client support NAT traversal there shouldn’t be any issues.
Very stable and fast over wireless, cellular and other non reliable networks where packet loss and congestion is common. OpenVPN has a TCP mode for highly unreliable connections but this mode sacrifices significant performance due to the inefficiency of encapsulating TCP within TCP.
Makes use of the benefits of the UDP protocol where packet loss will not cripple the connection. Uses an initial endpoint for connections and can switch servers while maintaining the connection. Client can also change networks without dropping the connection.
Due to the major security flaws, there is no good reason to choose PPTP other than device compatibility. If you have a device on which only PPTP is supported then you should consider how to encrypt data at other layers e.g. HTTPS.
IKEv2 is an excellent choice, it is extremely fast, secure and reliable. In addition unlike OpenVPN it requires no additional software to be installed (in most cases) and is therefor the quickest to configure. If you have a threat model that includes sophisticated adversaries then you may want to consider OpenVPN due to the leaked NSA presentations discussed above.
OpenVPN is the best choice for all platforms. It is extremely fast, secure and reliable. Additionally, the IVPN Multihop network is only available when connecting via OpenVPN. The only minor downside is the requirement to install the software client but on most platforms this only takes a few minutes.
WireGuard® is a promising VPN with high speed, high efficiency, strong encryption, and low overhead, but may not yet be ready for production environments.
All IVPN apps are open source and our service is independently audited.
We don’t retain any logs relating to your VPN connection.
Secure and protect all your data with 256 bit AES + 4096 bit RSA encryption.
Cancel your subscription anytime and easily with no questions asked. No bullshit.
Our experts are available 24/7 to ensure you’re never left waiting.
Use IVPN on up to 7 devices with a single IVPN Pro account, providing you even more value.
Try IVPN for 7 days and get a full refund if you are not delighted — no questions asked.
IVPN operates its own logless DNS servers to ensure your DNS requests don’t leak.
Connect to any of our servers in any location without restrictions. We’re adding more every month.
“Aurora chose LimeVPN because of the great reviews that we found online. Rolling it out to our entire team was seamless. It’s been working great from the moment we started.”
“As a small business engineering/program management consulting company we seek every tool to ensure the security of our data. LimeVPN Teams provides that security for us.”
“Aurora chose LimeVPN because of the great reviews that we found online. Rolling it out to our entire team was seamless. It’s been working great from the moment we started.”
