TLS VPN vs IPsec: Key Differences and Where WireGuard Fits

A TLS VPN and an IPsec VPN both encrypt data in transit, but they protect different things. A TLS VPN connects people to specific apps, while IPsec connects whole networks. The short version:

TLS VPN vs IPsec: the short answer

• TLS (SSL) VPN: secures a user's connection to selected apps through a TLS session in a browser or client, usually over TCP 443. That lets it pass hotel Wi-Fi and most corporate firewalls (nordlayer.com).
• IPsec VPN: protects all traffic at the IP layer using ESP (protocol 50), IKE on UDP 500 and NAT-T on UDP 4500. It is the usual choice for site-to-site links between offices and clouds (nordlayer.com).
• Both are secure on current versions: TLS 1.2 or 1.3 (SSL 3.0 is deprecated) and IKEv2 for IPsec.

So IPsec is not the same as TLS. They work at different layers, use different ports and suit different jobs. Most consumer VPN apps now use a third option, WireGuard, which the usual comparison pages leave out. It is covered below.

TLS VPN vs IPsec vs WireGuard at a glance

	TLS (SSL) VPN	IPsec VPN	WireGuard
Network layer	Transport/application	Network (IP)	Network (IP)
Ports and transport	TCP 443, often DTLS over UDP for data	IKE on UDP 500, NAT-T on UDP 4500, ESP (protocol 50)	UDP, commonly port 51820
Firewall traversal	Easiest: looks like normal HTTPS	Needs UDP 500/4500 and ESP allowed	Needs UDP allowed
Often blocked on	Networks that inspect traffic or block known VPN gateways	Guest Wi-Fi and firewalls that allow only web traffic	Networks that allow only TCP 443
Client needed	Browser (portal) or vendor client (tunnel)	Built-in OS client or vendor client	WireGuard app or VPN app
Access control	Per user, group or app	Per network, subnet or host	Per device (key pair)
Best fit	People reaching selected apps	Linking offices and clouds	Personal VPN on phones and laptops

TLS and IPsec details from nordlayer.com. WireGuard row: common knowledge of the open protocol.

Start with the transport row if your traffic has to cross a locked-down network. Start with the best-fit row if you are linking two offices.

Every port in the table is a default. Admins can change ports, and changing them also changes what gets blocked.

What is a TLS (SSL) VPN?

nordlayer.com defines an SSL VPN as a remote access product category that uses the SSL/TLS protocol to protect traffic between a user's device and a VPN gateway. It is the same TLS that puts the padlock in your browser, used here to reach private company resources.

How a TLS VPN connects you

When you connect, your client and the gateway run a TLS handshake. They agree on keys, check the gateway's certificate and open an encrypted session (nordlayer.com). From then on, traffic between you and the gateway is encrypted.

Portal mode vs tunnel mode

Portal mode works in a web browser and gives access to specific web apps, with nothing to install. Tunnel mode uses a client app and can carry more kinds of traffic (nordlayer.com). Many companies offer both, with portal mode for contractors and tunnel mode for staff laptops.

Why it is still called an SSL VPN

The name is a leftover. SSL was replaced by TLS because of known weaknesses, and SSL 3.0 is now deprecated. Modern deployments use TLS 1.2 or TLS 1.3 (nordlayer.com). "SSL VPN" and "TLS VPN" mean the same product, and TLS is the safer of the two protocols.

Strengths: easy access for contractors and personal devices (BYOD), per-user and per-app access control, and TCP 443 traffic that rarely needs special firewall rules (nordlayer.com).

Trade-off: tunnelling features are often vendor-specific, so the client and the gateway usually come from the same vendor (nordlayer.com).

What is IPsec?

IPsec is a suite of open IETF standards. It secures IP traffic at the network layer with access control, integrity, origin authentication, anti-replay protection and, when configured, encryption (nordlayer.com).

ESP, AH and IKEv2 in plain English

• ESP (Encapsulating Security Payload) encrypts and protects your packets.
• AH (Authentication Header) checks that packets were not altered, without encrypting them.
• IKE (usually IKEv2) exchanges keys and sets up the tunnel.

How an IPsec tunnel is built

nordlayer.com describes the tunnel being built in two phases. In the first phase, the two ends authenticate and create a secure channel for negotiation. In the second phase, they agree on the keys that protect your actual data.

IPsec builds its tunnel in two phases before any of your data moves. IPsec works below the apps, so it protects all data leaving a device, not only browser traffic (lightyear.ai). That is why IPsec is not the same as TLS. TLS secures a channel for specific applications, while IPsec secures the IP traffic itself.

Strengths: IPsec is fully standardised, so equipment from different vendors can talk to each other. nordlayer.com notes that ESP, AH and IKEv2 are recommended by the NSA and CISA for hardened remote access.

Trade-off: remote users usually need a client or an OS-level setup. IPsec also relies on UDP 500, UDP 4500 and ESP, which strict networks often block.

Key differences between TLS VPN and IPsec

Neither wins outright. Each fits a different job.

Network layer

TLS sits at the transport/application layer. IPsec sits at the network layer. nordlayer.com calls this the most important technical difference, because it decides what traffic gets protected.

Access control

TLS VPNs grant access per user, group or app. IPsec usually grants it per network, subnet or host (nordlayer.com). In practice, TLS suits "this contractor may reach the HR app only", and IPsec suits "the branch office joins head office".

Firewall and NAT traversal

TLS on TCP 443 looks like ordinary HTTPS and rarely needs firewall changes. IPsec needs UDP 500, UDP 4500 for NAT-T, and ESP allowed through (nordlayer.com). Behind a home or hotel router, NAT-T wraps ESP inside UDP 4500 so it survives address translation.

Speed: which is faster?

The first page offers no benchmark numbers, but the mechanism is clear. A TLS tunnel over TCP can slow down on lossy links, because TCP traffic inside a TCP tunnel triggers retransmissions on two levels at once. That is why many TLS VPNs carry data over DTLS on UDP (nordlayer.com).

IPsec runs at the network layer without that TCP-in-TCP problem, so it is often the steadier choice for constant site-to-site traffic. To check your own connection, run a speed test with the VPN off, then again with it on.

Device and client support

TLS portal mode needs only a browser. IPsec with IKEv2 is built into Windows, macOS, iOS and Android, but someone still has to configure it with the right server, certificate or key.

Which is more secure?

Neither is more secure by design. TLS 1.3 and IKEv2 with modern ciphers are both strong. The real risks come from old versions (SSL 3.0, TLS 1.0 and 1.1), weak settings and unpatched VPN gateways.

As superops.com puts it, the two differ in implementation, access levels and management. The linkedin.com summary is even shorter: "SSL/TLS VPNs secure user access, while IPsec is built around network connectivity."

Where each VPN type gets blocked

Photo by Vitaly Gariev on Unsplash

Hotel, airport and guest Wi-Fi

Guest networks that allow only web traffic often drop UDP 500, UDP 4500 and ESP. IPsec then fails to connect, while a TLS VPN on TCP 443 gets through. nordlayer.com notes that TCP 443 traffic tends to traverse hotel Wi-Fi and corporate firewalls without special rules.

Office and school firewalls

An admin can block known VPN gateways or inspect traffic, and port 443 is not invisible to deep packet inspection. Before you run your own VPN on a network you do not control, read our guide to using a VPN on a work laptop.

Countries that censor VPNs

State firewalls detect and block standard VPN protocols, including IPsec, WireGuard and many TLS VPNs. Without an obfuscation feature, none of them is reliable there.

Quick symptom guide: if the VPN connects and then drops, or never finishes the handshake, a port or protocol is usually being filtered. Our guide to why your VPN keeps disconnecting walks through the fixes.

Where WireGuard fits (IPsec vs WireGuard)

How WireGuard differs from IPsec and TLS

WireGuard is a newer, open-source VPN protocol. Like IPsec, it works at the network layer and encrypts all of a device's traffic. Unlike IPsec, it uses one fixed, modern cipher set, including ChaCha20-Poly1305, instead of a menu of options. It runs over UDP, commonly on port 51820, and is built into the Linux kernel.

WireGuard keeps IPsec's network-layer coverage with far fewer settings. Compared with IPsec, WireGuard has no separate IKE negotiation to configure, so there are fewer settings to get wrong. Compared with TLS VPNs, it skips TCP, so it avoids the TCP-in-TCP slowdown. Because it is UDP-only, a network that allows only TCP 443 can block it, much as it blocks IPsec.

When WireGuard is the better fit for you

• Use a TLS VPN to give people access to company apps.
• Use IPsec to link networks.
• Use WireGuard for a personal VPN on your phone or laptop.

OpenVPN, another open-source protocol you may see in VPN apps, also runs over TLS. For protocol and provider side-by-sides, see our VPN comparisons.

Which is the most secure VPN protocol?

WireGuard, IPsec with IKEv2 and modern TLS VPNs (TLS 1.2 or 1.3) are all considered secure when they are configured well and kept patched. Older options such as SSL 3.0 and PPTP are not. Version and setup matter more than the protocol's name.

In practice, security comes down to four things: current protocol versions, strong authentication (certificates or multi-factor), patched gateways and leak protection on your device.

Encryption such as IPsec or TLS protects against eavesdropping and tampering on the network path, such as snooping on public Wi-Fi or an ISP reading your traffic. It does not protect you from phishing, from malware already on your device, or from tracking by a site you log in to.

After connecting, run a DNS leak test and a WebRTC leak test to confirm your traffic really goes through the tunnel. For a fuller routine, use our 7 privacy checks to run on any VPN.

SSL vs TLS: quick answers

Is TLS outdated?

No. TLS 1.3 is the current version, and TLS 1.2 is still widely used. Only TLS 1.0 and 1.1 are retired. SSL is the outdated one: SSL 3.0 is deprecated (nordlayer.com), so "SSL" today is just a label for TLS.

Is Gmail SSL or TLS?

Gmail uses TLS. Mail settings often say "SSL/TLS" (port 465) or "STARTTLS" (port 587), but both use TLS underneath.

Does TLS Tunnel give free internet?

No. TLS Tunnel is an Android tunnelling app, not a source of free mobile data. Your carrier still counts the data you use, and tricks that try to dodge data billing break carrier terms.

TLS VPN, IPsec or WireGuard: which should you choose?

Pick the line that matches your situation. Business readers often choose inside one product rather than between vendors. Fortinet's FortiGate firewalls and FortiClient app, for example, support both SSL VPN and IPsec. Many teams use IPsec between sites and SSL VPN for remote staff on the same box.

If you work from home or on the road, our guide to staying safe while working remotely covers the rest of your setup, from Wi-Fi to passwords.

Using WireGuard with GhostShield VPN

GhostShield VPN is a personal VPN, not a business site-to-site link or an SSL VPN gateway. It uses WireGuard with ChaCha20-Poly1305 only, with no OpenVPN, IKEv2 or TLS-based option. There are apps for Windows, macOS, Android, iPhone and iPad, and Google TV, and Linux and routers work through a manual WireGuard configuration. You can use up to 10 devices at once.

GhostShield VPN app on a MacBook The apps include a kill switch, DNS leak protection, split tunneling, ad and malware blocking and a strict no-logs policy. One clear limit: GhostShield VPN has no obfuscation or stealth mode, so it is not reliable in China, Russia, Iran or the UAE. If you are heading to China, read our China travel VPN guide first.

Every plan comes with a 30-day money-back guarantee, so you can start a 7-day free trial and see how WireGuard performs on your own devices.

FAQ

Does the TLS Tunnel app give free internet?

No. TLS Tunnel is an Android app that sends your traffic through an encrypted tunnel, but your mobile carrier still counts every megabyte you use. Methods that try to avoid data charges break most carrier terms and can get your line suspended. Treat it as a privacy tool, not a free data plan.

Is TLS outdated?

No, TLS is current. TLS 1.3 is the latest version, and TLS 1.2 is still widely used and considered secure. Only the older TLS 1.0 and 1.1 have been retired. When a product says "SSL", it almost always runs TLS underneath, because SSL 3.0 is deprecated.

Which is safer, TLS or SSL?

TLS is safer. It replaced SSL because SSL had known weaknesses, and SSL 3.0 is now deprecated (nordlayer.com). Modern VPNs and websites use TLS 1.2 or TLS 1.3. If a gateway or app still offers real SSL or TLS 1.0, ask your admin to disable those versions.

Is Gmail SSL or TLS?

Gmail uses TLS. Email apps may label the setting "SSL/TLS" on port 465 or "STARTTLS" on port 587, but both options use TLS encryption. The SSL label is a holdover from older software. Either setting gives you an encrypted connection to Gmail's servers when configured correctly.

Why is SSL not used anymore?

SSL was retired because security researchers found serious weaknesses in it, and TLS was built to fix them. SSL 3.0 is deprecated, and modern deployments use TLS 1.2 or 1.3 instead (nordlayer.com). The name survives in product names like "SSL VPN" even though the protocol inside is TLS.

Is IPsec faster than an SSL VPN?

It often is for steady, high-volume traffic. IPsec runs at the network layer, so it avoids the TCP-in-TCP slowdown that can hit TLS tunnels on lossy links. Many SSL VPNs reduce that gap by sending data over DTLS on UDP. Real speed depends on hardware, distance and settings.