Privacy tooling

What is WireGuard?

Definition

WireGuard is a VPN protocol implemented in about 4,000 lines of kernel code with a fixed modern cipher suite. It is roughly three to four times faster than OpenVPN on the same hardware, reconnects instantly, and is small enough to be meaningfully auditable.

Why WireGuard matters

It is roughly three to four times faster than OpenVPN on the same hardware, reconnects instantly, and is small enough to be meaningfully auditable. It is UDP-only, which makes it blockable on restrictive networks.

WireGuard in practice

WireGuard changes how you wire a server's networking. You configure an interface with a private key and a short peer list, then route traffic through it with a few commands. On a busy box, you watch CPU usage drop because the kernel handles it directly. Getting it wrong means losing connectivity remotely, so you learn to keep the out-of-band VNC console ready. You also accept that UDP-only will be blocked on some networks.

What people get wrong about WireGuard

People assume WireGuard is a drop-in OpenVPN replacement requiring the same key management. In fact, it uses public-key cryptography per peer, so you must exchange keys out-of-band and configure each endpoint explicitly. A common error is setting the same key on multiple peers, breaking tunnel isolation.

WireGuard — common questions

Does WireGuard work over UDP?

WireGuard is UDP-only. That makes it fast and connectionless, but restrictive networks that block UDP will block it. If you are on such a network, you may need a fallback like OpenVPN or Shadowsocks.

Why is WireGuard faster than OpenVPN?

WireGuard is implemented in about 4,000 lines of kernel code and uses a fixed modern cipher suite. That simplicity means less overhead per packet and faster cryptographic operations, making it roughly three to four times faster on the same hardware.

More from privacy tooling

OpenVPN
OpenVPN is a mature userspace VPN protocol with configurable ciphers that can run over TCP or UDP.
Tor
Tor routes traffic through three volunteer-operated relays chosen so that no single relay knows both the origin and the destination.
Tor exit node
A Tor exit node is the final relay in a circuit, which connects to the destination and therefore appears to be the source of the traffic.
Onion service
An onion service is a service reachable only through Tor, whose address is derived from its public key rather than registered with any authority.
SOCKS5
SOCKS5 is a proxy protocol that forwards arbitrary TCP and UDP traffic, with optional authentication.
Shadowsocks
Shadowsocks is an encrypted proxy protocol designed to be difficult to identify by traffic analysis.
No-logs policy
A no-logs policy is a commitment not to retain records of user activity such as connection metadata, netflow or DNS queries.