WireGuard is the newer, faster protocol everyone recommends — and in this particular product it is also the one behind the paywall, while OpenVPN is free. Here is the comparison with the licence fact stated first and the marketing stripped out of both directions.
One naming note, once: the firewall in the video is Untangle, now sold as Arista Edge Threat Management NG Firewall, and that detail matters here because the two VPN apps sit in different pricing tiers of this product. OpenVPN is a free core app; the WireGuard VPN app requires a subscription. That does not end the comparison — but any honest version of it has to start there.
WireGuard is genuinely modern: a very small codebase, cryptography with no legacy baggage, and connections that re-establish almost instantly when a phone jumps between Wi-Fi and mobile data or a laptop wakes from sleep. OpenVPN is the veteran: two decades of deployment, per-user certificates as identity, and — in Untangle's implementation — a rich group system offering Full or split tunnel per group, Push DNS with custom servers and search domains, and exported-network control. Neither protocol is "insecure"; with certificates managed properly, OpenVPN's real-world risk profile is dominated by the same things as WireGuard's: lost devices and stale users, not ciphers.
On identical hardware WireGuard is usually faster and lighter. But be honest about the bottleneck in a small office: for documents, Tally, RDP and file shares, the limit is almost never the VPN protocol — it is the office's internet uplink, and both protocols will saturate a modest line in the same places. Buying a subscription to fix a bandwidth problem buys disappointment. WireGuard's speed advantage becomes real money in different territory: many simultaneous users, big file transfers as the daily norm, or staff on genuinely bad networks where OpenVPN's slower reconnect dance is felt ten times a day.
Pay when the pattern fits: a team that roams all day between sites, homes and mobile data; users for whom "the VPN takes a minute to come back after I close the lid" is a daily tax; or an office already subscribing for other apps — Web Filter, Threat Prevention — where adding the VPN app is a small step. Also weigh the quiet benefit that the same subscription unlocks the rest of the platform you may already want. Do not pay because a forum said OpenVPN is obsolete; the setup built in the video will serve a small office well for years, and its per-user certificates make offboarding cleaner than most alternatives.
The two apps coexist on the same firewall. The sane migration is boring: enable WireGuard for two or three willing users, let them live on it for a fortnight of real work, compare notes on reconnects and speed, and only then decide whether the whole office moves. Keep the OpenVPN profiles in place as the fallback during the trial — deleting the working door before the new one is proven is how admins create their own emergencies. And if the answer after the trial is "OpenVPN is fine", that is a perfectly respectable outcome: you will have spent nothing to learn it.
The video gives you the free, working baseline — watch it before spending anything on the alternative.
▶️ Watch Full VideoWireGuard uses modern cryptography and a much smaller codebase, which reduces its attack surface. OpenVPN with per-user certificates is also a strong, proven design. In practice, small offices get breached through lost config files and un-revoked users — habits, not protocols.
No. OpenVPN is a free core app in NG Firewall, independent of subscriptions. Losing the subscription affects the paid apps — WireGuard, IPsec, full Web Filter and the like — not the OpenVPN server you built from this video.
Yes, they are separate apps and can run side by side. Many offices keep OpenVPN as the dependable default and add WireGuard for the heaviest roamers, migrating gradually instead of in one risky switch.