Protocol choice is an engineering trade-off, not a loyalty test.

VPN marketing often reduces protocol discussion to “newest equals best.” Real networks are messier. Handshake cost, roaming behaviour, middlebox interference and implementation quality all matter.

EVPN is designed WireGuard-first. That preference should be explained, not merely asserted.

---

WireGuard

Strengths typically include:

• Compact cryptography and a small codebase surface
• Fast handshakes
• Efficient roaming between networks
• Straightforward key and peer models

Trade-offs:

• Less historical deployment inertia than OpenVPN in some enterprise environments
• Restrictive networks may interfere with its usual UDP transport
• Feature expectations (like some legacy TLS camouflage patterns) require additional transport work

For many consumer and modern mobile contexts, WireGuard is an excellent default.

---

OpenVPN

OpenVPN remains widely understood and flexible. TLS-based modes can help on networks that treat unknown UDP poorly.

Trade-offs often include:

• Heavier handshake and CPU cost relative to WireGuard
• More moving parts in configuration and cipher negotiation
• Operational complexity that teams must actively manage

OpenVPN is not “obsolete.” It is sometimes the pragmatic path through hostile middleboxes — at a performance and complexity cost.

---

IKEv2

IKEv2 (often with IPsec) can shine for mobile roaming and OS-integrated profiles.

Trade-offs:

• Implementation quality varies by platform
• Debugging can be opaque
• Feature sets and cipher policies depend heavily on the stack

It can be excellent for specific device ecosystems and disappointing when misconfigured.

---

What “WireGuard-first” should mean

For EVPN it means:

1. Prefer WireGuard for ordinary private tunnels
2. Keep transport agility as a planned path for restrictive networks
3. Do not pretend one protocol solves every network path

Benchmark theatre without methodology is noise. Architecture that matches real device behaviour is the product.

---

Takeaway

Choose protocols for the network conditions you expect — not for the slogan that photographs best. EVPN’s launch design centres WireGuard; Stealth and other transports remain labelled as planned or research until they ship.