Security

WireGuard, OpenVPN or an SSH tunnel: picking a VPN setup for a small team

BM BizMaC Team Jul 06, 2026 10 min read

When a small team needs to connect securely to a shared VPS, whether to access internal tools, manage servers, or route traffic back to a central point, three options come up again and again: WireGuard, OpenVPN, and a plain SSH tunnel. Each handles encryption, authentication, and tunnelling, but they differ sharply in throughput, CPU consumption, mobile battery drain, client availability, ease of key rotation, and behaviour on an unstable link. This article compares the three protocols side by side by those criteria and recommends which to pick based on your team's real use case, with a focus on teams working between mainland China and Vietnam, where the choice of protocol can make or break a setup that actually stays connected.

团队选择VPN协议，吞吐量、CPU负载和断线重连比功能多少更重要。

A team choosing a VPN protocol cares more about throughput, CPU load, and reconnection behaviour than about feature count.

The infrastructure model for this comparison is a Windows VPS with a dedicated IPv4 in Vietnam (NVMe, KVM, full Administrator access, monthly billing) that the team members log into via RDP, use as a stable always-on desktop, and from which they route selective traffic. The Linux alternative is mentioned where relevant, both OS options run these protocols identically.

How each protocol works at a glance

WireGuard is a modern kernel-level VPN. It uses a simple key exchange (Curve25519) and encrypts every packet as a single UDP message. No handshake state to maintain between packets, it's connectionless. The entire codebase fits in ~4,000 lines. OpenVPN is a feature-rich user-space VPN that can run over TCP or UDP, uses TLS for the control channel and your choice of cipher for the data channel (AES-256-GCM is standard). It supports complex topologies, certificate-based authentication with a full CA, and plugin-based extensibility. SSH tunnel (ssh -D for SOCKS or ssh -L/-R for port forwarding) is not a full VPN, it creates a single encrypted channel through which you forward individual ports or dynamic SOCKS traffic. It reuses the SSH daemon already on the server and requires almost no extra configuration.

Comparison table: WireGuard vs OpenVPN vs SSH tunnel

Criteria WireGuard OpenVPN SSH tunnel
Throughput Very high, near line rate on modern kernels (often 2-5 Gbps on a decent VPS) Moderate, AES-NI helps, but user-space overhead caps at 300-800 Mbps on typical VPS Low to moderate, single-process, single-threaded per tunnel, caps at 100-300 Mbps
CPU cost per connection Very low, kernel-integrated, negligible overhead (0.2-0.5% per active tunnel) Moderate-high, user-space plus TLS handshake overhead (2-8% per connection) Low, SSH protocol is efficient, but single-threaded (0.5-2% per tunnel)
Mobile battery Excellent, connectionless: no keepalive traffic, no renegotiation overhead Poor, periodic keepalives and renegotiations drain battery significantly on long connections Moderate, persistent connection with keepalives, but lower overhead than OpenVPN
Client availability Built into Linux >=5.6, macOS, iOS, Android, Windows (third-party client); limited on legacy Ubiquitous, clients for every OS, router firmware (OpenWrt, DD-WRT), and embedded system Built into every SSH client, any OS with OpenSSH works immediately
Ease of key rotation Simple, generate a new key pair, update the peer's allowed-ips and preshared-key. No CA. Complex, requires CA infrastructure: revoke old cert, issue new cert, update CRL on all peers Simple, replace the authorized_keys entry. But need to restart the tunnel session.
Behaviour on unstable link Excellent, stateless: lost packets are simply not acknowledged; reconnection is instant on next valid packet Poor, TCP-over-TCP mode collapses on packet loss (compound retransmits). UDP mode recovers but needs full handshake renegotiation Poor, single TCP connection: any packet loss stalls the tunnel until the sender window advances

Throughput and CPU cost: which protocol wastes your VPS resources

On a Vietnam VPS for China business scenario, where the team sits in Shenzhen, Guangzhou, or Kunming and the VPS sits in Hanoi or Ho Chi Minh City, the link between them crosses multiple international hops and the domestic Chinese network. The bottleneck is almost always the latency and packet loss on that link, not the VPS CPU. WireGuard handles this best because its connectionless design treats lost packets as normal network events and simply retransmits at the application layer. OpenVPN over UDP suffers from the handshake renegotiation that must complete before new data flows, on a link with 5-10% loss, OpenVPN renegotiation can take 10-30 seconds, during which no traffic moves. SSH tunnel, being a single TCP connection, is the worst: any packet loss causes TCP-in-TCP compound retransmit that can cut throughput by 80-90% compared to the same link without a tunnel.

If your team routes large files, database replication, or git pushes through the tunnel, WireGuard's near-zero CPU overhead on a 2GB RAM VPS or 4GB RAM VPS means those CPU cycles remain available for actual work. OpenVPN on a 2GB VPS with 4-5 concurrent tunnels can eat 15-20% of CPU just from encryption. SSH tunnels are light enough but the single-thread constraint means one tunnel cannot saturate a modern VPS line anyway.

Mobile battery: a real concern for field teams

A team with members working from laptops on the go, or from phones tethered to a 4G/5G connection in Yunnan or Guangxi, will feel the battery drain difference. WireGuard's connectionless design, no keepalive, no renegotiation, means the phone's radio can enter doze mode between packets. OpenVPN, by contrast, sends periodic keepalives and, on many mobile clients, renegotiates the TLS session every hour. That constant radio wake-up shortens battery life by 20-40% over an 8-hour workday based on published mobile VPN benchmarks. SSH tunnel sits in between: keepalives are configurable but the persistent TCP socket keeps the radio active.

For a cross-border China Vietnam team where the "office" is a hotel room in Guangzhou or a co-working space in Shenzhen, and the connection is a tethered phone, WireGuard is the only protocol that will not cause the team to hunt for power outlets by 2pm.

Client availability: who can actually connect

This is where the Windows VPS recommendation matters. The VPS itself, whether running Windows Server or Linux, runs the server side of any protocol identically. But the client side matters. OpenVPN has a native Windows client, a macOS client, and mobile apps. WireGuard has its own apps for Windows, macOS, iOS, and Android, but on Linux it is built into the kernel, no extra client needed. SSH tunnels require only a terminal: Windows 10+ includes OpenSSH built-in; macOS and Linux have it natively. For a team that cannot install third-party software on managed corporate laptops (common in financial or government-adjacent work), an SSH tunnel is the only option that works out of the box. For every other case, WireGuard is simpler to deploy because you only distribute a config file, no client installation for many OSs.

Key rotation: who gets locked out when a team member leaves

The moment a developer leaves the company, you need to revoke their access. With WireGuard, you delete their peer config on the server and regenerate the preshared key, that person is cut off within one handshake timeout (typically 2-5 minutes). With OpenVPN, you must revoke their certificate in the CA, update the CRL or compression flag on the server, then either restart the server or wait for the next CRL refresh. If your team does not have a full PKI setup (most small teams do not), certificate revocation is error-prone and people forget. SSH tunnel key rotation is trivial: remove the public key from authorized_keys. But a session that was already established stays open until the TCP connection drops, you may need to kill the SSH process. For a VPS for Chinese users situation where team turnover happens across time zones and you cannot coordinate a restart window easily, WireGuard's simplicity in key rotation is a strong advantage.

Behaviour on an unstable link: the cross-border reality

Any VPS in Vietnam serving a team in China crosses at least one international submarine cable, AAG, SJC, APG, or SEA-ME-WE 3/4, and then the domestic China network. Loss is not zero. On this kind of link, the protocol choice determines whether the VPN stays up or the team spends an hour every morning reconnecting. WireGuard handles this naturally: every packet is independent; the roaming logic means you can even switch between Wi-Fi and 4G without reconnecting. OpenVPN, even in UDP mode, loses state when the handshake renegotiation fails, and on a lossy link, renegotiation failure is common. SSH tunnel on a lossy link is a productivity killer: the team constantly re-runs the ssh command.

For a Vietnam VPS for China business where your team signs in from Shenzhen, Guangzhou, or Kunming and needs the connection to survive a typical day's network flakiness, WireGuard is the clear choice.

Recommendations per use case

Use WireGuard when: you have a team of 2-15 people, all using modern clients (Windows 10+, macOS, iOS, Android, or Linux), you value throughput and uptime on a lossy link, and you want per-person keys that you can rotate in 30 seconds. This covers most cross-border China-Vietnam teams that route internal tools, support access, or development traffic through a Vietnam VPS. Pair it with a Windows VPS where the team also uses RDP for their daily desktop, the VPN stays separate from the RDP session and works even if RDP drops.

Use OpenVPN when: you need advanced authentication (client certificates + 2FA), complex routing policies (split-tunnel with site-to-site bridging), or your team manages legacy devices that lack WireGuard support, older routers, embedded Linux, or corporate firewalls that only speak OpenVPN.

Use SSH tunnel when: you cannot install any software on team laptops, your use case is simple port forwarding (one developer needs SSH + one web app), or you want a zero-configuration fallback that works from any terminal within 20 seconds. It is not a replacement for a full-team VPN but a practical last resort.

The setup above runs on any of our Linux VPS plans with full root access.

FAQ

Which VPN protocol is fastest on a VPS

WireGuard is fastest in terms of raw throughput and CPU cost. On a typical VPS with AES-NI, OpenVPN is close behind for single connections. SSH tunnel is the slowest because it is single-threaded and uses TCP-over-TCP.

Can I run both WireGuard and OpenVPN on the same VPS

Yes. They use different ports (WireGuard: UDP/51820 default; OpenVPN: UDP/1194 default) and separate configs. You can offer both to the team and let each member choose what works on their device.

Does a Windows VPS support WireGuard

Yes. WireGuard runs as a service on Windows Server 2019 and 2022 and on Windows 10/11. The official WireGuard client from wireguard.com works identically.

What happens to an SSH tunnel when the network drops for 30 seconds

The TCP session times out. The team member must re-run the ssh command. No reconnection is built in unless an external tool (autossh) handles it.

Is WireGuard safe to use for business traffic

Yes. WireGuard uses proven cryptography (ChaCha20, Poly1305, Curve25519, BLAKE2s). It is considered production-grade and is used by large organisations including cloud providers for their internal networking.

Related articles

Note: This guide is for general reference. Every system and infrastructure has its own specifics, so test each step in a safe environment and consult a qualified engineer before applying it in production.

WireGuard、OpenVPN与SSH隧道的取舍

三种方案在吞吐、CPU开销、客户端支持和密钥管理上各有差异。文中用对比表按团队场景给出建议。不确定的指标以定性描述为准，不编造数据。