Privacy tooling
What is WireGuard?
WireGuard is a VPN protocol implemented in about 4,000 lines of kernel code with a fixed modern cipher suite. It is roughly three to four times faster than OpenVPN on the same hardware, reconnects instantly, and is small enough to be meaningfully auditable.
Why WireGuard matters
It is roughly three to four times faster than OpenVPN on the same hardware, reconnects instantly, and is small enough to be meaningfully auditable. It is UDP-only, which makes it blockable on restrictive networks.
WireGuard in practice
WireGuard changes how you wire a server's networking. You configure an interface with a private key and a short peer list, then route traffic through it with a few commands. On a busy box, you watch CPU usage drop because the kernel handles it directly. Getting it wrong means losing connectivity remotely, so you learn to keep the out-of-band VNC console ready. You also accept that UDP-only will be blocked on some networks.
What people get wrong about WireGuard
People assume WireGuard is a drop-in OpenVPN replacement requiring the same key management. In fact, it uses public-key cryptography per peer, so you must exchange keys out-of-band and configure each endpoint explicitly. A common error is setting the same key on multiple peers, breaking tunnel isolation.
WireGuard — common questions
Does WireGuard work over UDP?
WireGuard is UDP-only. That makes it fast and connectionless, but restrictive networks that block UDP will block it. If you are on such a network, you may need a fallback like OpenVPN or Shadowsocks.
Why is WireGuard faster than OpenVPN?
WireGuard is implemented in about 4,000 lines of kernel code and uses a fixed modern cipher suite. That simplicity means less overhead per packet and faster cryptographic operations, making it roughly three to four times faster on the same hardware.
Where WireGuard comes up
- What is the cheapest VPS that is actually usable? About $4 a month buys 1 vCPU, 1 GB of RAM and 20 GB of NVMe on real KVM virtualisation. That is genuinely enough for a WireGuard VPN, a DNS resolver, a Tor…
- How do I stop SSH brute-force attacks? Disable password authentication entirely — brute force against key-based SSH is not possible. Add fail2ban to reduce log noise, and consider moving SSH off…
- KVM vs OpenVZ: why the virtualisation type matters KVM is full hardware virtualisation: your instance runs its own kernel and cannot see the host. OpenVZ and LXC are container technologies that share the ho…
- WireGuard vs OpenVPN on a VPS WireGuard is about 4,000 lines of kernel code with modern fixed cryptography; OpenVPN is roughly 100,000 lines in userspace with configurable ciphers. Wire…
- Set up a WireGuard VPN on a VPS in 5 minutes A working WireGuard server needs four things: a key pair, a wg0 interface configuration, IP forwarding with NAT, and one peer block per device. On a $4 ins…
- Multi-region failover with a WireGuard mesh Three instances in three countries, meshed over WireGuard, with the application bound only to the mesh and a health-checked DNS record in front, gives genu…
More from privacy tooling
- OpenVPN
- OpenVPN is a mature userspace VPN protocol with configurable ciphers that can run over TCP or UDP.
- Tor
- Tor routes traffic through three volunteer-operated relays chosen so that no single relay knows both the origin and the destination.
- Tor exit node
- A Tor exit node is the final relay in a circuit, which connects to the destination and therefore appears to be the source of the traffic.
- Onion service
- An onion service is a service reachable only through Tor, whose address is derived from its public key rather than registered with any authority.
- SOCKS5
- SOCKS5 is a proxy protocol that forwards arbitrary TCP and UDP traffic, with optional authentication.
- Shadowsocks
- Shadowsocks is an encrypted proxy protocol designed to be difficult to identify by traffic analysis.
- No-logs policy
- A no-logs policy is a commitment not to retain records of user activity such as connection metadata, netflow or DNS queries.