IKEv2, L2TP/IPsec and PPTP fail under censorship because they are among the easiest VPN protocols to recognise. They use fixed ports, special protocol numbers and clearly structured handshakes, so a filter can block them with a few simple rules, without any sophisticated inspection. PPTP is also insecure by modern standards. On censored or strict networks these protocols end up dead or throttled, while CyberPort AI, ZoltVPN's adaptive engine, chooses among 10 connection models one that gets through and keeps its speed.
Why these protocols exist
PPTP, L2TP and IPsec-based protocols were created to connect employees and branch offices to company networks. They were designed to be standard and interoperable, so that equipment from different vendors could work together, and they were built into Windows, macOS, iOS and Android so that nobody had to install anything.
Those goals made sense at the time. Being standard and predictable is helpful when the network is on your side. On a network that is trying to stop VPN traffic, being predictable is exactly the problem.
PPTP: obsolete and insecure
PPTP, the Point-to-Point Tunneling Protocol, dates from the 1990s. It uses a control connection on TCP port 1723 and carries data over GRE, a separate IP protocol.
- Its security is broken. The authentication commonly used with PPTP has well-known weaknesses, and it is no longer considered safe for anything sensitive.
- It is being retired. Apple removed PPTP from iOS and macOS in 2016, and other operating system makers have been phasing it out.
- It is trivial to block. Blocking one TCP port or the GRE protocol stops it completely.
There is no good reason to use PPTP today.
L2TP/IPsec: double wrapping, fixed ports
L2TP on its own does not encrypt anything, so it is almost always paired with IPsec. The combination uses UDP port 500 for key exchange, UDP port 4500 when the connection passes through a router, UDP port 1701 for L2TP itself, and the ESP protocol for encrypted data.
- It adds overhead. Traffic is wrapped twice, once by L2TP and once by IPsec.
- It is often set up with shared keys that are widely published by free services, which weakens it.
- It struggles with some routers and hotel networks, which do not handle IPsec well.
- It is easy to identify by its ports and protocol numbers alone.
IKEv2/IPsec: modern, fast and still easy to block
IKEv2 is the most capable of the three. It is fast, well supported and particularly good on phones, because it can keep a connection alive while you move between Wi-Fi and mobile data.
But it shares the IPsec fingerprint. Its key exchange runs on UDP ports 500 and 4500, its messages follow a standard, recognisable structure, and its data travels as ESP or wrapped in UDP. A filter that blocks those ports or recognises the handshake stops it immediately.
IKEv2 is a good protocol in an open network. It was never designed to hide.
Why they fail under censorship
Fixed ports and protocol numbers
Most censorship starts with the simplest rules. Blocking UDP ports 500 and 4500 disables IPsec-based VPNs. Blocking GRE disables PPTP. These rules are cheap and affect almost nothing else.
Standard handshakes
Because these protocols are public standards, their opening messages look the same on every network. Deep packet inspection identifies them almost instantly. We explain the technique in what deep packet inspection is.
Unusual traffic types
ESP and GRE are not ordinary TCP or UDP traffic. They stand out on any network, and many filters and home routers drop them anyway.
No plan B
The built-in VPN clients on phones and computers try one thing. If it fails, they show an error and stop. They do not try another method or another server.
| Protocol | Detectable by DPI | What happens when blocked | Typical result on censored networks |
|---|---|---|---|
| PPTP | Trivially, by port and GRE | Fails to connect | Dead, and insecure |
| L2TP/IPsec | Easily, by ports and ESP | Handshake times out | Dead or unstable |
| IKEv2/IPsec | Easily, by ports and handshake | Fails or drops repeatedly | Dead on strict networks |
| CyberPort AI | Chooses a model that suits the network | Switches automatically | Gets through, keeps speed |
How they compare beyond censorship
| Protocol | Security today | Speed on open networks | Built into most systems | Good for mobile |
|---|---|---|---|---|
| PPTP | Weak | Fast | Being removed | No |
| L2TP/IPsec | Acceptable with strong keys | Moderate | Yes | Moderate |
| IKEv2/IPsec | Strong | Fast | Yes | Yes |
The pattern is clear. Even the best of the three, IKEv2, only performs well when the network leaves it alone.
When legacy protocols still make sense
- IKEv2 is a reasonable choice for company remote access on networks that do not filter VPNs, especially on phones.
- L2TP/IPsec survives mainly because older equipment supports nothing else.
- PPTP should be retired wherever it is still running.
Moving away from legacy protocols
- Stop using PPTP for anything, even "just for testing".
- Remove old VPN profiles from your phone and computer. Leftover entries in the system's VPN settings can conflict with the app you actually use.
- Do not rely on built-in VPN settings when travelling to countries with heavy filtering. They are usually the first thing to stop working.
- Choose a VPN that adapts. A single protocol, however secure, gives the network one fingerprint to block.
How CyberPort AI is different
With ZoltVPN you do not pick a protocol or type in a server address. CyberPort AI weighs your location, your internet provider and the live performance of your connection to pick one of 10 connection models. When one model is blocked or slow, it switches automatically, in seconds, and it remembers what works on each network. If you are comparing options, see OpenVPN vs CyberPort AI and our comparison page.
FAQ
Is IKEv2 better than OpenVPN?
On open networks both are secure, and IKEv2 often reconnects faster on phones. On censored networks both are easy to detect, so neither is a dependable choice there.
Why does my phone's built-in VPN work at home but not abroad?
Your home network does not block it. Many foreign, hotel and mobile networks block the ports and protocols that built-in VPNs depend on.
Does L2TP encrypt my traffic?
Not by itself. It relies on IPsec for encryption. L2TP without IPsec offers no protection.
Is PPTP safe for anything?
No. Its known weaknesses make it unsuitable for any traffic you care about.
Leave legacy protocols behind: download ZoltVPN and try CyberPort AI free for 7 days via the pricing page, no card needed.
