OpenVPN (recommended, secure). But you may have a problem making VPN connections over T-Mobile USA wireless data.
The Symptoms: You are able to do things on your mobile device over T-Mobile data (browse the Internet, send and receive email, etc), and you are able to make VPN connections over Wi-Fi wireless, but you are not able to make VPN connections over T-Mobile wireless data.
The Cause: T-Mobile apparently pushed out a data configuration in late 2013 that set APN Protocol to IPv6. That works properly for most things on mobile devices, but it prevents PPTP (built into Android) and OpenVPN (OpenVPN Connect) clients from making VPN connections.
The Cure: Open Settings > Wireless & Networks > More... > Mobile networks > Access Point Names > T-Mobile GPRS (fast.t-mobile.com) > APN protocol, and change the selection from IPv6 to
IPv4/IPv6 IPv4 (see update below).
The Caveat: This cure was tested successfully with a Nexus 5 running Android 4.4.2 KitKat on a Prepaid plan, and it might not work properly on other devices or plans. Use at your own risk.
See Also: Secure Wi-Fi with VPNUpdate: IPv4/IPv6 currently causes issues with some websites (example), so try IPv4.