What NordLynx and OpenVPN actually are
A VPN protocol is the method used to create the encrypted tunnel between your device and the VPN server. Think of it as the language the two sides speak to each other. Different protocols make different trade-offs between speed, security, and compatibility.
NordLynx is NordVPN's implementation of WireGuard — a newer, leaner protocol designed from scratch with modern cryptography. The code is about 4,000 lines, compared to OpenVPN's 70,000+. Fewer lines means a smaller attack surface and faster performance.
OpenVPN is the long-established standard, built in 2001 and audited extensively over two decades. It comes in two variants: TCP (more reliable, slower) and UDP (faster, less reliable on unstable connections). OpenVPN is the protocol that supports NordVPN's obfuscated servers.
Speed and performance
NordLynx is significantly faster than OpenVPN in most conditions. In NordVPN's own testing, NordLynx delivers around 3x higher download speeds than OpenVPN. Independent tests generally confirm a meaningful speed advantage, though the exact difference depends on your device, network, and server location.
For everyday use — streaming, browsing, video calls — NordLynx's speed advantage translates to a noticeably snappier connection and less buffering. For very fast home internet (500 Mbps+), both protocols can saturate the connection and the difference becomes less apparent.
✓ Why NordLynx is faster
WireGuard runs in the kernel space of your operating system — the lowest level, closest to the hardware. OpenVPN runs in user space, which requires data to cross the kernel/user boundary repeatedly. That overhead adds up, especially on mobile devices.
Head-to-head comparison
| Feature | NordLynx | OpenVPN TCP | OpenVPN UDP |
|---|---|---|---|
| Speed | Fastest Winner | Moderate | Fast |
| Battery impact | Lowest Winner | Higher | Higher |
| Stability on weak connections | Good | Best Winner | Moderate |
| Obfuscated servers | No | Yes Required for China | Yes |
| Firewall penetration | Good | Best Winner | Good |
| Streaming (Netflix, iPlayer) | Best Winner | Good | Good |
| Security | Excellent | Excellent | Excellent |
| Default protocol | Yes | No | No |
When to use each protocol
- Streaming Netflix, iPlayer, Prime
- Video calls and meetings
- Everyday browsing
- Gaming with a VPN
- On mobile to save battery
- Hotel wifi in most countries
- Traveling to China
- Traveling to UAE or Iran
- NordLynx won't connect
- On very unstable connections
- Behind a restrictive firewall
- Need obfuscated servers
The key dividing line is obfuscation. NordLynx doesn't support obfuscated servers — the feature that disguises VPN traffic to bypass China's Great Firewall and similar censorship systems. If you're traveling to a country where standard VPN connections get blocked, you need OpenVPN TCP with obfuscated servers enabled.
⚠ Traveling to China or UAE
Switch to OpenVPN TCP and enable obfuscated servers before you board. NordLynx will not work in China — it produces a traffic pattern the Great Firewall recognizes and blocks. See our obfuscated servers guide for exact setup steps.
Is NordLynx safe?
Yes — WireGuard uses modern, well-reviewed cryptography (ChaCha20, Poly1305, Curve25519, BLAKE2s). The small codebase is actually a security advantage: fewer lines means fewer places for vulnerabilities to hide, and it's easier for security researchers to audit thoroughly.
One limitation of base WireGuard is that it assigns static IP addresses, which could theoretically be used to identify users over time. NordVPN addresses this with a double NAT system that assigns dynamic IPs — you get WireGuard's performance without the static IP issue.
OpenVPN is also extremely secure and has a 20+ year track record of independent audits. For most users, the security difference is negligible — both are well above the threshold for practical privacy.
How to switch protocols in NordVPN
On iPhone/Android: tap the menu icon → Settings → VPN Protocol → select NordLynx or OpenVPN (TCP/UDP).
On Mac/Windows: click the gear icon → Connection → VPN Protocol → select your choice.
✓ One setting worth knowing
If you switch to OpenVPN for China travel, remember to switch back to NordLynx when you return — OpenVPN's speed overhead is unnecessary once you're not dealing with censorship. The default is NordLynx for a reason.
Frequently asked questions
NordLynx is built on WireGuard but not identical to it. NordVPN adds a double NAT layer on top of WireGuard to solve the static IP issue. When you see NordLynx in NordVPN's settings, you're using WireGuard with NordVPN's privacy improvements on top.
Obfuscation works by wrapping OpenVPN traffic to make it look like regular HTTPS. WireGuard/NordLynx uses a different traffic pattern that doesn't lend itself to the same obfuscation technique. NordVPN's obfuscation technology is specifically built around OpenVPN. This may change as WireGuard obfuscation techniques mature.
NordLynx uses significantly less battery than OpenVPN. Because it runs in kernel space and processes packets more efficiently, the CPU does less work per unit of data. On a long travel day where you're using your phone heavily with a VPN, this difference is noticeable.
TCP if you need obfuscated servers or maximum reliability — it's required for China and is more stable on poor connections. UDP if you want faster OpenVPN without obfuscation. In practice, most people who switch to OpenVPN are doing it for obfuscated servers, so TCP is the right choice.
The VPN we travel with
NordVPN — NordLynx and OpenVPN on all plans
Both protocols included on every subscription. Switch between them in one tap. Works in China with obfuscated servers on OpenVPN TCP.
Get NordVPN — Save up to 69% →* Affiliate link — we earn a commission at no cost to you.