Migrating from OpenVPN to WireGuard
How Wiretastix's architecture maps to a traditional OpenVPN concentrator, and what actually moving from OpenVPN to WireGuard looks like in practice.
If you’re running OpenVPN today, Wiretastix’s architecture will feel familiar: a single VPN concentrator that clients connect to, a web-based admin panel, per-user/per-group policy. The protocol underneath is different, but the operational shape – and the reasons people move – are not.
Why WireGuard Over OpenVPN
- Much smaller codebase. WireGuard’s implementation is roughly an order of magnitude smaller than OpenVPN’s, which matters directly for security: less code means a smaller attack surface and a codebase that’s actually feasible to audit in full.
- Modern, fixed cryptography. WireGuard uses a single, current cryptographic suite (the Noise protocol framework) with no negotiation and no legacy cipher options to misconfigure. OpenVPN’s OpenSSL-based stack is flexible, but that flexibility means it’s possible to run it with dated or weak settings if a deployment was never revisited.
- Kernel-space performance. WireGuard typically runs in the kernel (or a fast userspace implementation), giving it lower latency and higher throughput than OpenVPN’s userspace, TLS-based tunnel.
- Simpler configuration format. A WireGuard peer config is a handful of lines – keys, address, allowed IPs, endpoint. There’s no certificate chain to manage.
- Better roaming. WireGuard tolerates the client’s IP address changing (switching networks, waking from sleep) far more gracefully than OpenVPN’s connection model.
How the Pieces Map
| OpenVPN concept | Wiretastix / WireGuard equivalent |
|---|---|
| OpenVPN server (concentrator) | Wiretastix daemon (also a concentrator – see WireGuard Integration) |
| OpenVPN Access Server UI, or a separate community GUI | Wiretastix’s built-in web-based admin panel |
.ovpn client config file | WireGuard peer config (also delivered once, as text + QR code) |
| easy-rsa PKI, CA-signed client certificates | A public/private keypair per peer – no CA, no certificate revocation infrastructure |
| CCD (client-config-dir) per-user overrides | Groups: shared allowed-ips, DNS, search domain, and device limits per group |
| Username/password or cert auth, optionally with an LDAP/RADIUS plugin | Native OIDC/SSO self-service login |
up/down scripts calling iptables | Dynamic nftables integration, synced automatically per group |
What Migration Actually Looks Like
To be direct about it: there is no automatic converter from .ovpn client configs to WireGuard peers. The two protocols use fundamentally different config formats and cryptographic material, and Wiretastix doesn’t ship an import tool for OpenVPN configuration.
In practice, “migrating” means standing up Wiretastix as a new concentrator and having users onboard fresh, rather than converting existing client files:
- Install Wiretastix alongside your existing OpenVPN server.
- Configure OIDC against the same identity provider your organization already uses.
- Have users sign in and self-service their own WireGuard tunnel – this replaces manually distributing
.ovpnfiles with a self-service flow, which is usually most of the operational win people are looking for anyway. - Run both VPNs in parallel during a transition window, then decommission the OpenVPN server once everyone has moved over.
If you have devices that can’t go through the OIDC self-service flow (servers, IoT devices, site-to-site links), those get unmanaged peers created directly instead, the same way they would under OpenVPN with a static client config.