OpenVPN gets throttled because its traffic is easy to recognise. Deep packet inspection can identify its handshake and packet patterns within the first few packets, and filtered networks then slow it down or cut it off. When OpenVPN runs over TCP, a second problem appears: the "TCP over TCP" effect, which makes connections crawl on busy or lossy networks. On open networks OpenVPN is perfectly good. On censored or strict networks, a static OpenVPN setup ends up slower or dead, while CyberPort AI, ZoltVPN's adaptive engine, picks a connection model that gets through and keeps full speed.
What OpenVPN is, and why it became the standard
OpenVPN is an open-source VPN protocol and program that has been around for more than two decades. It uses well-established encryption, can run over UDP or TCP, works on almost every operating system and is easy to configure for many different situations. Companies use it for remote access, home users run it on routers, and countless VPN services have been built on it.
Its strengths are real: it is mature, widely reviewed and flexible. Its weakness is that it was designed to be secure, not to be invisible. That distinction did not matter much when it was created. On today's filtered networks, it matters a great deal.
Why OpenVPN is easy to detect
A recognisable handshake
Every OpenVPN connection starts with a handshake that has a known structure. The opening packets carry protocol-specific header fields in predictable positions. A filter does not need to decrypt anything. It only needs to see that the first packets match the pattern.
Known defaults
By default, OpenVPN uses UDP on port 1194. Many setups never change that, which makes the crudest form of blocking, simply dropping that port, surprisingly effective.
Patterns that survive encryption
Even when the contents are fully encrypted, the sizes of control packets, the timing of keep-alive messages and the rhythm of renegotiation can give OpenVPN away. Some options add an extra layer of protection to the handshake, which helps, but the overall traffic shape often remains recognisable.
Disguises that wear out
People wrap OpenVPN in other tunnels or apply "scramble" patches to hide it. These can work for a while, but they add overhead and complexity, and once a disguise becomes popular, filters learn its pattern too.
What happens to OpenVPN on filtered networks
The experience varies with the network, but the patterns are familiar:
- The handshake never completes. The log shows a message such as "TLS key negotiation failed to occur within 60 seconds".
- It connects, then resets a few seconds or minutes later.
- It stays connected but slows to a crawl. This is throttling, and it is the hardest to spot.
- UDP is blocked, so the user switches to TCP and runs straight into the next problem.
The TCP over TCP problem
TCP is the internet's reliable delivery system. When a packet goes missing, TCP notices, waits and sends it again. That is fine for one layer. When OpenVPN runs in TCP mode, your apps' TCP traffic is carried inside the VPN's own TCP connection, so there are two layers each trying to fix the same losses.
When the network drops a packet, the outer connection holds everything back until it recovers the missing data. Meanwhile, the inner connections see the delay, assume their own packets were lost and retransmit as well. The two layers amplify each other's delays. On a clean network you barely notice. On a congested mobile network or a throttled international link, speeds can collapse.
| Setup | Detectable by DPI | Behaviour on lossy networks | When blocked | Typical result on strict networks |
|---|---|---|---|---|
| OpenVPN over UDP | Yes, by handshake and patterns | Good | Often blocked outright | Dead or throttled |
| OpenVPN over TCP | Yes, by handshake and patterns | Poor (TCP over TCP) | Throttled or reset | Slow, unstable |
| OpenVPN with a disguise | For a while, then yes | Extra overhead | Disguise fingerprinted | Works until it doesn't |
| CyberPort AI | Chooses a model that suits the network | Picks based on live performance | Switches automatically | Keeps full speed where possible |
OpenVPN vs CyberPort AI
The difference is not one protocol against another. It is one fixed method against an engine that keeps choosing.
| Typical OpenVPN setup | CyberPort AI | |
|---|---|---|
| Ways to connect | One config, one protocol | 10 connection models |
| How the choice is made | Once, by hand | Automatically, by location, provider and live performance |
| When blocked | Stops until you change something | Switches in seconds |
| When throttled | Stays slow | Treats slowness as failure and moves on |
| Memory | None | Remembers what works on each network |
| Setup | Config files and certificates | One tap |
We cover how filters find VPN traffic in what deep packet inspection is, and how the switching works in automatic connection switching.
When OpenVPN is still a good choice
OpenVPN remains a sound tool in the right setting:
- Open networks with no VPN filtering, where its fingerprint does not matter.
- Company remote access, where the IT department requires it and the network allows it.
- Self-hosted setups, such as reaching your home network from outside.
If your networks never block VPNs, OpenVPN may serve you well for years. The trouble starts when the network decides it does not want VPN traffic.
How to tell if your OpenVPN connection is being throttled
- Compare networks. Fast at home, slow on mobile data or abroad, suggests the network is interfering.
- Watch speed over time. Throttling often begins after a connection has been recognised, so speed may drop a few minutes in.
- Switch transport. If UDP fails completely and TCP connects but crawls, you are probably seeing a UDP block followed by TCP over TCP slowdowns.
- Read the log. Repeated handshake timeouts or resets point to blocking rather than a problem with your device.
Where ZoltVPN fits
With ZoltVPN you do not manage protocols, ports or config files. CyberPort AI chooses between 10 connection models based on your location, your internet provider and live performance, switches automatically when one is blocked or slow, and remembers what works on each network. You can compare ZoltVPN with other approaches on our comparison page.
FAQ
Is OpenVPN insecure?
No. Its encryption is well regarded. The issue on filtered networks is not security but visibility: it is easy to recognise, and recognised traffic gets throttled or blocked.
Does running OpenVPN on port 443 help?
Sometimes, briefly. Port 443 is used for secure websites, so it is rarely blocked. But DPI looks at the traffic itself, not just the port, and OpenVPN does not look like ordinary web traffic.
Is OpenVPN over UDP or TCP faster?
UDP is usually faster, because it avoids the TCP over TCP problem. TCP is often used only because UDP is blocked.
Why does OpenVPN work at home but not when I travel?
Different networks apply different filtering. A hotel, an airport or a foreign mobile operator may block or throttle traffic your home network leaves alone.
Tired of fixing configs? Download ZoltVPN and try CyberPort AI free for 7 days from the pricing page, no card needed.
