Best choice for mobile VPN clients?

[Diggy]

Of the three built-in VPN solutions, which is the best choice for mobile clients?

The OPNsense router at the headquarters has a static WAN IP address.

The mobile clients include newer versions of:
 * Android
 * Apple iOS
 * Apple iPadOS
 * Linux
 * Windows

Any special considerations for the above scenario I need to take into consideration?  Side note, I plan to implement IPSec for satellite offices to headquarters 24/7 VPN connectivity.  Hopefully it won't conflict with the solution best for mobile clients.

Your guidance is much appreciated.  Thank you.

[Patrick M. Hausen]

Medium to large number of users? Dynamic handling of assigned IP addresses? External authentification like with Active Directory or similar? OpenVPN, no contest.

WireGuard is nice, but you need to manage IP addresses manually and there is no external auth. So if it's for a handful of admins, it's great. But it does not scale.

IPsec is similar to OpenVPN in features, but much more difficult to set up and debug, you need extra clients which all behave differently for all the client OSes. And it does not work quite as well as OpenVPN through restricted Internet uplinks like hotel or train hotspots etc.

With OpenVPN you get the same open source client for each OS, done.

[Diggy]

Medium to large number of users? Dynamic handling of assigned IP addresses? External authentification like with Active Directory or similar? OpenVPN, no contest.

WireGuard is nice, but you need to manage IP addresses manually and there is no external auth. So if it's for a handful of admins, it's great. But it does not scale.

IPsec is similar to OpenVPN in features, but much more difficult to set up and debug, you need extra clients which all behave differently for all the client OSes. And it does not work quite as well as OpenVPN through restricted Internet uplinks like hotel or train hotspots etc.

With OpenVPN you get the same open source client for each OS, done.

Good info.  Thanks.  No external authentication for now.  Internal authentication if that is an option with OpenVPN.

[Patrick M. Hausen]

It is.

[Diggy]

Any thoughts on the "Tinc VPN" plugin for either site-to-site or mobile users or both?  j/w

[nero355]

Of the three built-in VPN solutions, which is the best choice for mobile clients?

Just FYI :

Pretty much EVERYONE keeps telling me that the battery usage of Wireguard is superior compared to the battery usage of OpenVPN for mobile phones so that's something to consider too !!