These two protocols solve different problems, so the honest answer is that neither wins outright. WireGuard connects faster and runs leaner. SoftEther gets through networks that block VPNs, which WireGuard cannot do on its own.
The SoftEther vs WireGuard question usually gets answered by people running their own servers, and their answer is almost always WireGuard.
For anyone buying a commercial VPN, the calculation is different, because a handful of providers ship both. GnuVPN is one of them, which makes it a useful reference point through this comparison.
Here is where each protocol wins, and how to tell which one your situation calls for.
WireGuard Wins on Speed and Simplicity
For most people on most networks, WireGuard is the right default, and it wins on three counts:
- Small. Roughly four thousand lines of code against a far larger surface in SoftEther. Fewer places for a vulnerability to hide, and a researcher can audit the whole thing in an afternoon.
- Fast. Kernel-space on Linux, ChaCha20 cryptography that performs well on mobile chips without hardware acceleration, and a handshake that completes in one round trip.
- Simple. Fewer moving parts to misconfigure, and misconfiguration causes more real-world leaks than protocol weaknesses do.
In GnuVPN’s app, WireGuard is the protocol to leave selected until something stops you.
SoftEther Gets Through What WireGuard Cannot
The problem it solves is a network that refuses to pass VPN traffic at all.
A standard WireGuard connection has a recognisable signature, which is why WireGuard being blocked is a common complaint on campus networks, corporate filters, and national firewalls. Private Internet Access says as much on its own blog, noting that if you need a VPN that works behind firewalls, SoftEther is the better option.
What SoftEther brings:
- Hides on 443. SoftEther obfuscation tunnels through HTTPS on SoftEther port 443, the port that secures ordinary websites, so filters see routine browsing. Blocking it means breaking the web.
- Falls back further. Tunnels over ICMP and DNS, the two protocols almost no network dares block completely.
- Strong encryption. AES-256 and RSA-4096, at gigabit-class throughput.
- Open licence. Apache 2.0, from the University of Tsukuba project that built it.
GnuVPN SoftEther connections carry all of that without a separate client. Most providers that support the protocol expect you to install it yourself.
The honest caveat: SoftEther’s last independent audit was in 2017, which found eleven vulnerabilities that were promptly patched, and it does not yet carry post-quantum protection.
Head to Head Comaprison
Neither protocol wins every row, so here is where each one lands:
| WireGuard | SoftEther | |
| Speed | Faster, lower latency | Strong, slightly behind |
| Gets through firewalls | No | Yes, via HTTPS on 443 |
| Fallback tunnelling | None | ICMP and DNS |
| Codebase | ~4,000 lines | Far larger |
| Ease of audit | Excellent | Harder |
| Last independent audit | Ongoing scrutiny | 2017 |
| Post-quantum | Adopted by some builds | Not yet |
| Native OS support | Linux kernel, wide | Limited, usually manual |
| In GnuVPN’s app | Yes | Yes |
Read that honestly and WireGuard takes more rows. It is faster, leaner, easier to verify, and better supported. SoftEther takes the row that decides everything when a network is blocking you, and none of WireGuard’s advantages matter if the connection never establishes.
Five Providers That Give You Both
Committing to one protocol is a choice you can avoid. Each of these ships a fast option and an obfuscated one in the same subscription, though only one pairs WireGuard with SoftEther.
1. GnuVPN: WireGuard, SoftEther and AmneziaWG
GnuVPN protocols include the only stealth option on this list that is SoftEther itself, the protocol this article compares, instead of an in-house substitute.
- Fast option: WireGuard
- Stealth options: SoftEther for HTTPS camouflage, AmneziaWG for a scrambled WireGuard signature at WireGuard speed
- Full set: five protocols in one app, including OpenVPN and IKEv2
- Price: from $2.79/month on the two-year plan, across 55+ countries
Being a VPN with SoftEther and WireGuard in a single app matters when your day changes networks. Home, office filter and hotel portal each call for something different, and switching takes a tap.
2. NordVPN: NordLynx and NordWhisper
The largest provider here, pairing a WireGuard-based protocol with its own obfuscation built in-house.
- Fast option: NordLynx, NordVPN’s WireGuard implementation
- Stealth option: NordWhisper, which wraps traffic in HTTP web tunnels
- Trade-off: NordWhisper is proprietary, slower by NordVPN’s own account, and incompatible with Meshnet and Onion Over VPN
3. Surfshark: WireGuard and Camouflage Mode
The value pick, with obfuscation bundled into a budget plan that carries no device limit.
- Fast option: WireGuard
- Stealth option: Camouflage Mode, built on OpenVPN
- Trade-off: OpenVPN-based obfuscation strains under the heaviest national filtering
4. Proton VPN: WireGuard and Stealth
The Swiss provider, and the only one here offering obfuscation on a genuine free tier.
- Fast option: WireGuard
- Stealth option: Stealth, available at no cost
- Trade-off: Proton states Stealth does not work reliably in China
5. CactusVPN: WireGuard and SoftEther
The other provider supporting SoftEther, though not in the way most people expect.
- Fast option: WireGuard, in the apps
- Stealth option: SoftEther, which needs the separate client from the protocol’s developers
- Trade-off: the SoftEther route works on Windows only, so it is off the table on mobile
Use WireGuard Until Something Blocks You
On a normal connection it is faster, easier to verify, and the obfuscation SoftEther offers solves a problem you do not have.
The moment a network starts blocking you, that calculation inverts completely. A fast protocol that cannot connect protects nothing, and SoftEther’s HTTPS camouflage is the most reliable way through a filter that is actively hunting VPN traffic.
The best VPN protocol for blocked networks is therefore whichever one is working, which is the argument for choosing a provider that carries both instead of committing to one in advance.
This is where the protocol comparison turns into a purchasing one. If your provider ships WireGuard alone, a blocked network ends your session. If it ships obfuscation alone, you pay overhead you do not need at home.
GnuVPN sidesteps both by putting five protocols behind one switch, so the answer to this article’s question is that you should not have to pick.
FAQ
Is SoftEther faster than WireGuard?
Usually not. Is SoftEther faster than WireGuard comes down to conditions: WireGuard is quicker to connect and lower in latency on an unrestricted network, thanks to kernel-space operation and a single-round-trip handshake. SoftEther delivers gigabit-class throughput but carries more overhead. On a blocked network, the question is moot, because WireGuard will not connect at all.
Why does WireGuard get blocked?
Its packets and handshake have a distinctive signature that deep packet inspection recognises easily. WireGuard was designed for speed and simplicity, not concealment, and it has no native obfuscation. Networks that filter VPN traffic identify and drop it without difficulty.
Can SoftEther get through the Great Firewall?
Often, yes. Tunnelling through HTTPS on port 443 makes SoftEther traffic difficult to distinguish from normal web browsing, and its ICMP and DNS fallbacks add routes when port 443 itself is scrutinised. No protocol works everywhere all the time, and success varies by region and by day.
Does GnuVPN support both SoftEther and WireGuard?
Yes. GnuVPN carries five protocols in one app: SoftEther, AmneziaWG, WireGuard, OpenVPN and IKEv2. You select whichever suits the network you are on, which means you are not committing to speed or stealth when you buy the subscription.
Is SoftEther still safe to use in 2026?
For its intended job, yes. It uses AES-256 and RSA-4096 encryption and remains the most capable option for firewall traversal. The caveats are a last independent audit in 2017, which found eleven vulnerabilities that were promptly patched, and no post-quantum protection yet.
Disclaimer: This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.
