SSL VPN Compared: OpenVPN vs WireGuard

Introduction

SSL VPN allows remote users to connect to your corporate network over the internet using standard HTTPS/UDP ports. The two main open-source options are OpenVPN (mature, feature-rich) and WireGuard (modern, faster, simpler). This guide covers both.

OpenVPN Setup (Server Side)

BASH

# Install OpenVPN and EasyRSA
apt install openvpn easy-rsa

# Set up PKI
make-cadir /etc/openvpn/easy-rsa
cd /etc/openvpn/easy-rsa
./easyrsa init-pki
./easyrsa build-ca nopass
./easyrsa gen-req server nopass
./easyrsa sign-req server server
./easyrsa gen-dh
openvpn --genkey secret /etc/openvpn/ta.key

Server Configuration

TEXT

# /etc/openvpn/server.conf
port 1194
proto udp
dev tun

ca   /etc/openvpn/easy-rsa/pki/ca.crt
cert /etc/openvpn/easy-rsa/pki/issued/server.crt
key  /etc/openvpn/easy-rsa/pki/private/server.key
dh   /etc/openvpn/easy-rsa/pki/dh.pem
tls-auth /etc/openvpn/ta.key 0

server 10.8.0.0 255.255.255.0
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"

keepalive 10 120
cipher AES-256-GCM
auth SHA256
tls-version-min 1.2
user nobody
group nogroup
persist-key
persist-tun
log /var/log/openvpn.log
verb 3

BASH

# Enable IP forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward
# Add to /etc/sysctl.conf: net.ipv4.ip_forward=1

# NAT for VPN clients
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

# Start OpenVPN
systemctl start openvpn@server
systemctl enable openvpn@server

Creating Client Certificates (OpenVPN)

BASH

cd /etc/openvpn/easy-rsa
./easyrsa gen-req client1 nopass
./easyrsa sign-req client client1

Client .ovpn File

TEXT

client
dev tun
proto udp
remote vpn.company.com 1194

ca   ca.crt
cert client1.crt
key  client1.key
tls-auth ta.key 1

cipher AES-256-GCM
auth SHA256
verb 3

WireGuard Setup (Simpler, Faster)

WireGuard is built into Linux kernel 5.6+, uses modern cryptography (Curve25519, ChaCha20).

BASH

# Install
apt install wireguard

# Generate server keys
wg genkey | tee /etc/wireguard/server_private.key | wg pubkey > /etc/wireguard/server_public.key

# Generate client keys
wg genkey | tee /etc/wireguard/client1_private.key | wg pubkey > /etc/wireguard/client1_public.key

Server Config

INI

# /etc/wireguard/wg0.conf
[Interface]
Address = 10.9.0.1/24
ListenPort = 51820
PrivateKey = <server_private_key>
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
# Client 1
PublicKey = <client1_public_key>
AllowedIPs = 10.9.0.2/32

Client Config

INI

[Interface]
Address = 10.9.0.2/24
PrivateKey = <client1_private_key>
DNS = 8.8.8.8

[Peer]
PublicKey = <server_public_key>
Endpoint = vpn.company.com:51820
AllowedIPs = 0.0.0.0/0    # Route all traffic through VPN
PersistentKeepalive = 25

BASH

# Start WireGuard
wg-quick up wg0
systemctl enable wg-quick@wg0

# Check status
wg show

OpenVPN vs WireGuard Comparison

Feature	OpenVPN	WireGuard
Protocol	SSL/TLS	UDP only
Speed	Moderate	Very fast
Configuration	Complex	Simple
Kernel integration	Userspace	Kernel module
Mobile support	Good	Excellent
Dynamic IP clients	Yes (with DDNS)	Needs extra config
Audit history	Long	Short (new)

Split Tunneling

Route only corporate traffic through VPN, rest goes direct:

TEXT

# OpenVPN: remove "redirect-gateway" and add specific routes
push "route 10.0.0.0 255.0.0.0"
push "route 192.168.0.0 255.255.0.0"

# WireGuard client: change AllowedIPs
AllowedIPs = 10.0.0.0/8, 192.168.0.0/16

Summary

OpenVPN: battle-tested, works everywhere, more configuration options
WireGuard: simpler, faster, modern crypto — prefer for new deployments
Always use split tunneling unless you specifically need all traffic routed through VPN
Monitor active VPN connections and alert on unusual login times/locations