WireGuard
A modern, minimal VPN protocol designed to be simpler, faster, and more secure than IPsec and OpenVPN.
Also known as: wireguard
Category: Software Development
Tags: networking, security, vpn, protocols, open-source
Explanation
WireGuard is a modern VPN protocol designed to be simpler, faster, and more secure than IPsec and OpenVPN. It runs as a kernel module (Linux) or userspace implementation (other platforms) and consists of roughly 4,000 lines of code — compared to 100,000+ for OpenVPN or IPsec. This small attack surface makes it significantly easier to audit.
## How It Works
WireGuard creates encrypted point-to-point tunnels between peers using modern cryptography: Curve25519 for key exchange, ChaCha20 for symmetric encryption, Poly1305 for authentication, and BLAKE2s for hashing. There is no cipher negotiation — it uses a single, opinionated cryptographic suite (Noise protocol framework). If a vulnerability is found, the entire protocol version is bumped.
Each peer has a public/private key pair. Configuration is minimal: you define peers by their public keys and allowed IP ranges. WireGuard operates at Layer 3 (IP level) and presents itself as a standard network interface. It is connectionless — there are no handshakes to maintain, no state machines, no keepalive negotiations. Packets are simply encrypted and sent. Silent when idle.
## Key Properties
- **Performance**: Runs in the Linux kernel, achieving near-line-rate throughput with minimal CPU overhead
- **Roaming**: Handles IP changes transparently — works naturally on mobile devices switching between WiFi and cellular
- **Stealth**: No response to unauthenticated packets, making it invisible to port scanners
- **Simplicity**: Configuration is similar in complexity to SSH authorized_keys
- **Cross-platform**: Linux (kernel module), Windows, macOS, iOS, Android, FreeBSD, OpenBSD
## Limitations
No built-in user authentication or identity management — it is purely a tunneling protocol. No automatic key distribution or peer discovery. No dynamic IP assignment without external tooling. Layer 3 only (no Layer 2/bridging support). These gaps are exactly what projects like Tailscale, NetBird, and ZeroTier fill.
Related Concepts
← Back to all concepts