For a new, small Linux VPS, choose WireGuard unless you have a specific OpenVPN requirement. WireGuard keeps the tunnel and peer configuration small, uses a fixed modern cryptographic design, roams cleanly between client networks, and is efficient on Linux. OpenVPN remains the more adaptable choice when you need TCP transport, proxy or restrictive-NAT traversal, Ethernet bridging, certificate-based identity, or compatibility with older and unusually configured clients.
There is no honest universal speed multiplier. Your VPS CPU allocation, kernel, network ceiling, MTU, client software, transport, and (for OpenVPN) Data Channel Offload support determine the result. This guide explains the trade-offs and gives a deployment and testing path for both protocols.
As an Amazon Associate I earn from qualifying purchases.
The decision in one table
| Situation | Better starting point | Why |
|---|---|---|
| One person or a small number of devices on a Linux VPS | WireGuard | Few moving parts, public-key peers, UDP encapsulation, and a compact implementation. |
| Clients regularly move between Wi-Fi, mobile data, and changing NAT mappings | WireGuard | The server learns a peer’s latest authenticated endpoint, so roaming does not require a new profile. |
| A network blocks or severely limits UDP | OpenVPN | OpenVPN can use TCP and can be placed behind proxy or NAT arrangements; WireGuard packets are UDP only. |
| Ethernet-layer bridging or TUN/TAP-specific designs | OpenVPN | Its documented feature set includes Ethernet bridging and both TUN and TAP virtual interfaces. |
| Existing certificate authority, TLS policy, or a large legacy-client estate | OpenVPN | It integrates with OpenSSL, X.509 certificates, and a broad range of operating systems and tooling. |
| Several users with centralized lifecycle administration | Compare the management layer first | The tunnel protocol alone does not provide user enrollment, revocation, DNS policy, auditing, or help-desk workflows. |
What you are comparing
Both products create an encrypted virtual network, but they expose different design philosophies. WireGuard is a focused protocol and kernel implementation: each peer is identified by a public key, encrypted IP packets are carried over UDP, and a peer’s AllowedIPs define both where its outbound traffic should be routed and which source addresses are accepted from it. The official project describes the design as “extremely simple yet fast and modern”; that is a design objective, not a promise of a particular throughput number on every VPS.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsOpenVPN is a flexible VPN daemon built around SSL/TLS. It can use a pre-shared static key for a narrowly defined deployment or a public-key TLS model with a certificate authority, server certificates, and client certificates. It presents TUN or TAP interfaces, supports UDP or TCP tunnel transport, and has options for proxies, NAT, DHCP behavior, and Ethernet bridging. OpenVPN 2.6 is the relevant current manual generation for this comparison.
#1 Best Overall
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
How WireGuard works
Peer identity and configuration
A WireGuard peer has a private key that stays on that device and a public key shared with the other side. On the server, a peer entry normally contains the client public key and one or more narrowly scoped AllowedIPs, such as a single tunnel address. There is no certificate chain or interactive username and password exchange in the core protocol. You provision a new device by generating a new key pair and adding a peer; you remove access by deleting that peer or replacing its key.
Routing and access control are coupled
AllowedIPs are more than a route list. For outbound traffic they tell WireGuard which peer should receive a destination; for inbound traffic they are an access-control check on the source address. Overlapping ranges can therefore send traffic to the wrong peer or unintentionally authorize a larger network. Give each client a unique tunnel address and use the narrowest range that meets the requirement.
Cryptography and handshake properties
The protocol specification names ChaCha20 with Poly1305 authentication, Curve25519 for elliptic-curve Diffie–Hellman, BLAKE2s, SipHash24, and HKDF. Its handshake provides perfect forward secrecy, replay protection, identity hiding, and authenticated key exchange. The suite is intentionally fixed rather than exposing a long menu of negotiable ciphers, which reduces configuration drift but also means you do not select an alternate data cipher when a particular environment demands one.
Roaming and packet transport
WireGuard securely encapsulates IP packets over UDP. After an authenticated packet arrives, the server can learn the peer’s current endpoint, allowing a phone or laptop to move between networks without editing the profile. UDP avoids TCP-over-TCP retransmission interactions, but a network that blocks UDP can prevent the tunnel entirely.
How OpenVPN works
TLS control channel and data channel
OpenVPN uses SSL/TLS for authentication and key negotiation, then carries encrypted traffic through its data channel. In public-key mode, a certificate authority signs the server and client certificates; the server can reject a certificate that has been revoked through a certificate-revocation list. Static-key mode is simpler but ties the deployment to a shared secret and is less suitable for many independently managed clients.
TUN, TAP, and bridging
A TUN interface carries routed IP packets. A TAP interface carries Ethernet frames, enabling layer-2 designs and bridging where that is genuinely required. Bridging adds broadcast traffic and operational complexity, so use routed TUN mode unless an application specifically needs layer-2 behavior.
Transport choices
OpenVPN can listen over UDP or TCP. TCP can help when outbound UDP is unavailable and can be placed through proxy or NAT arrangements, but it adds a second reliability and congestion-control layer when the inner traffic is already TCP. TCP on a port that a firewall permits is not a guarantee of policy compliance or invisibility; obtain authorization for the network you are using.
Rank #2
- 【AC1200 Dual-band Wireless Router】Simultaneous dual-band with wireless speed up to 300 Mbps (2.4GHz) + 867 Mbps (5GHz). 2.4GHz band can handles some simple tasks like emails or web browsing while bandwidth intensive tasks such as gaming or 4K video streaming can be handled by the 5GHz band.*Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【Easy Setup】Please refer to the User Manual and the Unboxing & Setup video guide on Amazon for detailed setup instructions and methods for connecting to the Internet.
- 【Pocket-friendly】Lightweight design(145g) which designed for your next trip or adventure. Alongside its portable, compact design makes it easy to take with you on the go.
- 【Full Gigabit Ports】Gigabit Wireless Internet Router with 2 Gigabit LAN ports and 1 Gigabit WAN ports, ideal for lots of internet plan and allow you to connect your wired devices directly.
- 【Keep your Internet Safe】IPv6 supported. OpenVPN & WireGuard pre-installed, compatible with 30+ VPN service providers. Cloudflare encryption supported to protect the privacy.
Data ciphers and compression
OpenVPN 2.6 documents AES-256-GCM, AES-128-GCM, and, where available, CHACHA20-POLY1305 as data-cipher defaults. Compression is disabled by default. Do not enable it casually: the manual warns that compression can create VORACLE-, CRIME-, or BREACH-style information-leak risks. If an old profile requires compression, plan a controlled migration rather than adding a global compression directive.
Security: is WireGuard secure enough?
For a normal routed VPS VPN, WireGuard’s modern fixed suite and small implementation surface are a strong security baseline. Its public-key model removes password reuse and avoids maintaining a certificate hierarchy for every peer. Security still depends on protecting private keys, restricting AllowedIPs, patching the host, and removing lost devices promptly. WireGuard does not supply a built-in account directory, certificate-revocation service, or policy engine; those are administrative responsibilities outside the protocol.
OpenVPN can be equally appropriate when your organization already operates a certificate authority, needs TLS policy controls, or must support a client that cannot run WireGuard. The additional flexibility creates more choices to audit: certificate issuance, expiration, revocation, TLS settings, data-cipher negotiation, and whether an old profile still requests compression. Treat the OpenVPN configuration and PKI as production security assets, not as disposable text files.
| Security concern | WireGuard treatment | OpenVPN treatment |
|---|---|---|
| Peer or user identity | Static public keys per peer | Static keys or TLS certificates, usually issued by a CA |
| Forward secrecy | Provided by the handshake design | Provided by the TLS key exchange when configured with modern parameters |
| Revoking one lost device | Remove its peer or replace its public key | Revoke its certificate and distribute an updated CRL, or replace the shared key in static-key mode |
| Algorithm selection | Fixed protocol suite | Negotiated/configured data ciphers, including the documented 2.6 defaults |
| Compression risk | No compression feature in the core tunnel | Disabled by default; enabling it can expose side-channel risks |
Transport, firewalls, and restrictive networks
Start by checking the network path your users actually have. A VPS firewall and the provider’s security group must permit the chosen protocol and port, and the host must allow forwarding between the VPN interface and the intended destination. IPv6 needs its own forwarding and firewall policy; an IPv4-only ruleset does not protect an accidentally reachable IPv6 service.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
WireGuard requires UDP. That is normally efficient and simple, but a hotel, enterprise, or public hotspot that blocks outbound UDP leaves no protocol-level fallback. OpenVPN offers a UDP-first design plus TCP as a compatibility option. UDP should generally be your first OpenVPN transport; reserve TCP for a demonstrated network constraint because nested retransmission can increase latency and reduce throughput.
Neither protocol automatically “bypasses” a firewall in a lawful or reliable sense. A permitted OpenVPN TCP connection may work through a proxy or NAT where WireGuard cannot, while an actively filtered or inspected network may block both. Document the policy, obtain authorization, and test from every network your users depend on.
Performance on a VPS: what can and cannot be claimed
WireGuard’s project documentation attributes high performance to fast cryptographic primitives and Linux-kernel integration, and its stated goal is to be faster and leaner than older approaches. OpenVPN 2.6 includes Data Channel Offload (DCO), and current OpenVPN documentation argues that DCO changes older performance assumptions. Those statements describe architecture and potential; they are not an apples-to-apples result for your VPS.
Rank #3
- New-Gen WiFi Standard – WiFi 6(802.11ax) standard supporting MU-MIMO and OFDMA technology for better efficiency and throughput.Antenna : External antenna x 4. Processor : Dual-core (4 VPE). Power Supply : AC Input : 110V~240V(50~60Hz), DC Output : 12 V with max. 1.5A current.
- Ultra-fast WiFi Speed – RT-AX1800S supports 1024-QAM for dramatically faster wireless connections
- Increase Capacity and Efficiency – Supporting not only MU-MIMO but also OFDMA technique to efficiently allocate channels, communicate with multiple devices simultaneously
- 5 Gigabit ports – One Gigabit WAN port and four Gigabit LAN ports, 10X faster than 100–Base T Ethernet.
- Commercial-grade Security Anywhere – Protect your home network with AiProtection Classic, powered by Trend Micro. And when away from home, ASUS Instant Guard gives you a one-click secure VPN.
No universal “WireGuard is X times faster” figure is defensible across providers. Results change with the VPS’s actual CPU allocation, kernel and DCO support, MTU, UDP versus TCP, client implementation, encryption settings, packet size, and the provider’s network ceiling. A small instance can be CPU-bound under encryption, while a larger instance can be limited by its virtual NIC or bandwidth quota.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →A fair test plan
- Use the same VPS, operating-system image, kernel, firewall policy, and physical region for both protocols.
- Use equivalent tunnel routes, the same MTU, the same client device, and comparable encryption strength. Record whether OpenVPN DCO is active.
- Measure sustained upload and download throughput, median and tail latency, packet loss, and host CPU utilization.
- Repeat the test with at least two client networks, including one with higher latency or a restrictive NAT.
- Test reconnect time after changing networks, idle periods, and a temporary VPS or client restart.
- Run more than one workload: a large stream, many small requests, and simultaneous connections.
Choose the protocol that meets your measured latency, reliability, and administrative requirements rather than a benchmark copied from a different provider.
VPS requirements and sizing decisions
Before installing anything, confirm that the VPS exposes a recent enough Linux kernel and permits the required kernel module or userspace implementation, UDP traffic, IP forwarding, and firewall rules. Check IPv4 and IPv6 availability, monthly transfer limits, maximum packet size or MTU constraints, and whether the provider filters common VPN ports. Also verify that running a VPN complies with the provider’s acceptable-use terms.
For this self-hosted setup, Antihost VPS provides Linux VPS instances with full root access and a one-click OpenVPN image as a starting point for the deployment described here.
Do not size from a marketing bandwidth number alone. During a pilot, watch per-process CPU, soft-interrupt load, memory pressure, interface drops, and actual egress throughput. If WireGuard is CPU-light but the link is saturated, adding vCPUs will not increase speed. If OpenVPN consumes a core under your workload, DCO support, a different transport, or a larger CPU allocation may matter more than a protocol switch.
Recommended Free Tools
Self-hosting WireGuard on a Linux VPS
1. Prepare the host
On Debian or Ubuntu, the package name is commonly wireguard; package names and service integration can differ on other distributions.
sudo apt update
sudo apt install wireguardEnable only the forwarding and firewall rules you need. Keep the VPS administration port separate from the VPN policy so a mistake in tunnel rules does not lock you out.
Rank #4
- 【DUAL BAND WIFI 7 TRAVEL ROUTER】Products with US, UK, EU, AU Plug; Dual band network with wireless speed 688Mbps (2.4G)+2882Mbps (5G); Dual 2.5G Ethernet Ports (1x WAN and 1x LAN Port); USB 3.0 port.
- 【NETWORK CONTROL WITH TOUCHSCREEN SIMPLICITY】Slate 7’s touchscreen interface lets you scan QR codes for quick Wi-Fi, monitor speed in real time, toggle VPN on/off, and switch providers directly on the display. Color-coded indicators provide instant network status updates for Ethernet, Tethering, Repeater, and Cellular modes, offering a seamless, user-friendly experience.
- 【OpenWrt 23.05 FIRMWARE】The Slate 7 (GL-BE3600) is a high-performance Wi-Fi 7 travel router, built with OpenWrt 23.05 (Kernel 5.4.213) for maximum customization and advanced networking capabilities. With 512MB storage, total customization with open-source freedom and flexible installation of OpenWrt plugins.
- 【VPN CLIENT & SERVER】OpenVPN and WireGuard are pre-installed, compatible with 30+ VPN service providers (active subscription required). Simply log in to your existing VPN account with our portable wifi device, and Slate 7 automatically encrypts all network traffic within the connected network. Max. VPN speed of 100 Mbps (OpenVPN); 540 Mbps (WireGuard). *Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【PERFECT PORTABLE WIFI ROUTER FOR TRAVEL】The Slate 7 is an ideal portable internet device perfect for international travel. With its mini size and travel-friendly features, the pocket Wi-Fi router is the perfect companion for travelers in need of a secure internet connectivity on the go in which includes hotels or cruise ships.
2. Generate keys securely
Generate the server key and each client key on the device that will hold the private key. Restrict the directory before writing files.
umask 077
wg genkey | tee server.key | wg pubkey > server.pub
wg genkey | tee client.key | wg pubkey > client.pubCopy public keys through your normal secure administration channel. Never paste a private key into a ticket, chat room, or shared script.
3. Define the server and peer
A minimal routed configuration has an interface address and listen port, plus one peer per client. The following values are examples; choose an address range that does not overlap networks your users must reach.
[Interface]
Address = 10.8.0.1/24
ListenPort = 51820
PrivateKey = <server-private-key>
[Peer]
PublicKey = <client-public-key>
AllowedIPs = 10.8.0.2/32On the client, set its own private key and 10.8.0.2/32 address, the server public key, the server’s public endpoint, and the destinations that should enter the tunnel. A full-tunnel client usually routes its default traffic through the VPN; a split-tunnel client lists only private networks. Add PersistentKeepalive only when a client behind a stateful NAT needs periodic outbound traffic to keep its mapping open.
4. Enable the interface and verify the handshake
sudo systemctl enable --now wg-quick@wg0
sudo wg showwg show should display the expected peer, a recent handshake after the client connects, and transfer counters that increase when you send traffic. If the handshake is absent, check the VPS firewall, client endpoint, UDP port, system clock, and whether the public keys were copied without extra characters.
5. Add forwarding, NAT, DNS, and lifecycle controls
Enable IPv4 and, if used, IPv6 forwarding. Add a firewall rule that permits the VPN subnet to reach only the destinations you intend, then add source NAT when clients need to reach the public internet through the VPS. Configure DNS deliberately; a tunnel can be encrypted while queries still leak to an unintended resolver. Document how to add, rotate, and remove peers before inviting additional users.
Self-hosting OpenVPN 2.6 on a Linux VPS
1. Install the daemon and choose a PKI process
On Debian or Ubuntu, the package is commonly named openvpn. Many administrators use Easy-RSA or an existing organizational certificate authority to create the CA, server certificate, client certificates, and Diffie–Hellman or equivalent parameters required by their chosen profile. Distribution paths and helper commands vary, so use the versioned package documentation rather than copying a profile built for another release.
Best Value
- Next-Gen Gigabit Wi-Fi 6 Speeds: 2402 Mbps on 5 GHz and 574 Mbps on 2.4 GHz bands ensure smoother streaming and faster downloads; support VPN server and VPN client¹
- A More Responsive Experience: Enjoy smooth gaming, video streaming, and live feeds simultaneously. OFDMA makes your Wi-Fi stronger by allowing multiple clients to share one band at the same time, cutting latency and jitter.²
- Expanded Wi-Fi Coverage: 4 high-gain external antennas and Beamforming technology combine to extend strong, reliable, Wi-Fi throughout your home.
- Improved Battery Life: Target Wake Time helps your devices to communicate efficiently while consuming less power.
- Improved Cooling Design: No heat ups, no throttles. A larger heat sink and redefined case design cools the WiFi 6 system and enables your network to stay at top speeds in more versatile environments.
2. Select routed UDP first
Use a TUN interface and UDP for the normal case. The server profile needs the server certificate and key, the CA certificate, a tunnel network, an appropriate data-cipher policy, and client-verification settings. Keep compression disabled. Add TCP only as a separately documented listener or profile when a real network constraint justifies it.
3. Issue one client profile per device
Each client should receive its own certificate and private key, not a shared profile. Embed or securely distribute the CA certificate, client certificate, client key, server hostname, transport, and port according to your organization’s handling rules. Give certificates sensible expiration dates and maintain a process for revoking a lost device.
4. Start the service and inspect logs
On systems using the common systemd layout, a service may be started with a command such as sudo systemctl enable --now openvpn-server@server; the exact unit name depends on the distribution and configuration-file location. Confirm the service status and journal, then check that the TUN interface receives an address and that a test client completes the TLS handshake.
Free tools Windows power users keep installed
One-click scans. No signup required.
5. Configure forwarding and policy
Apply the same host-level decisions as for WireGuard: forwarding, firewall zones, NAT when required, DNS behavior, IPv6 policy, and routes to private networks. Avoid broad client-to-client access by default. If you use TAP bridging, explicitly account for broadcast domains, DHCP interactions, and the larger failure surface.
Operations after the tunnel works
Provisioning and revocation
WireGuard provisioning is a key-distribution workflow: generate a pair, assign a unique address, add the public key and AllowedIPs, deliver the client profile, and remove the peer when access ends. OpenVPN provisioning is a PKI workflow: issue a certificate, deliver a profile, track expiration, and revoke the certificate through the CRL when necessary. In both cases, keep an inventory of device owner, key or certificate identifier, assigned addresses, creation date, and last review.
Updates and configuration backup
Patch the VPS operating system and VPN packages through the normal maintenance process. Back up encrypted configuration and PKI material, but keep private keys out of general-purpose backup shares. Test restoring a server configuration and issuing or revoking a test client before an emergency occurs.
Observability
Monitor handshake or session freshness, interface transfer counters, CPU, memory, packet drops, tunnel-address exhaustion, and DNS failures. Alert on an unexpected increase in peers, repeated authentication failures, or a certificate approaching expiry. Logging should support incident response without collecting more client traffic metadata than your policy permits.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Compatibility and feature matrix
| Capability | WireGuard | OpenVPN 2.6 |
|---|---|---|
| Primary transport | UDP only | UDP or TCP |
| Authentication model | Public-key peers | Static key or SSL/TLS with certificates |
| Roaming between client IP addresses | Built into the peer endpoint behavior | Supported through reconnect and session mechanisms; behavior depends on profile and network |
| Virtual networking | Routed IP packets | TUN routed IP and TAP Ethernet modes |
| Ethernet bridging | Not a core feature | Documented feature |
| Algorithm configuration | Small fixed suite | Multiple documented data-cipher choices and TLS settings |
| Implementation footprint | Designed to be small and reviewable | Larger, highly configurable daemon |
| Central user administration | Outside the core protocol | Outside the open-source tunnel core; packaged management options exist |
A practical decision framework
Pick WireGuard when these statements are true
- Your VPS runs Linux and clients can install a current WireGuard implementation.
- You want a short configuration and a peer-per-device public-key model.
- UDP is available on every network your users need.
- You value straightforward roaming and low operational overhead.
- You are prepared to build or adopt separate tooling for enrollment, key rotation, DNS, and revocation.
Pick OpenVPN when these statements are true
- At least one important network blocks UDP or requires TCP/proxy compatibility.
- You need TAP, Ethernet bridging, or an existing TUN/TAP-based integration.
- Your organization already operates certificate authorities, TLS policy, and certificate revocation.
- You must support older or unusually diverse client platforms.
- You need extensive transport and authentication configuration and can maintain it safely.
For a mixed fleet
Running both protocols can be sensible when a small WireGuard profile serves normal users and a separately governed OpenVPN profile covers a legacy client or restrictive network. Treat them as two security perimeters: separate address pools, firewall rules, DNS policy, monitoring, and revocation procedures. Do not assume that adding a second daemon automatically shares users or permissions.
Troubleshooting branches
The client never handshakes
- Verify the server is listening on the intended UDP port and that both the VPS firewall and provider security group allow it.
- Check that each side has the other side’s public key, not a private key or a truncated value.
- Confirm the client endpoint resolves to the correct address and that the VPS clock is accurate.
- For OpenVPN, inspect TLS and certificate errors separately from data-channel errors; an expired or untrusted certificate prevents a session before routing is tested.
The handshake works but no traffic passes
- Check tunnel addresses and route overlap. In WireGuard, review
AllowedIPson both peers. - Confirm IP forwarding and return routes on the VPS and destination network.
- Inspect NAT and firewall counters rather than adding unrestricted allow rules.
- Test the tunnel address first, then a known destination, then DNS; this identifies whether the failure is tunnel, routing, or name resolution.
It is slower than expected
- Confirm whether the VPS CPU or network interface is saturated and record packet loss.
- Check MTU and fragmentation, especially across mobile or nested VPN paths.
- For OpenVPN, compare UDP with TCP and verify whether DCO is available and active.
- Repeat measurements with the same client, workload, and path before changing protocols.
A user changes networks and loses access
- For WireGuard, confirm the latest handshake and that the client can send an outbound packet after the network change; review NAT keepalive only when needed.
- For OpenVPN, inspect reconnect and session timeout settings, then test the profile on both Wi-Fi and cellular networks.
- Ensure DNS uses a stable server endpoint and that IPv6 is not taking an unintended path.
Bottom line
For most new self-hosted Linux VPS deployments in 2026, WireGuard is the sensible first build: its public-key peer model, compact design, UDP transport, and roaming behavior reduce setup and maintenance work. OpenVPN is the deliberate choice when transport flexibility, TLS and certificate integration, bridging, or legacy compatibility outweigh that simplicity. If speed is the deciding factor, benchmark both on the exact VPS and networks you will operate; architecture claims cannot substitute for measurements from your infrastructure.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
