WireGuard

WireGuard is a modern open-source VPN protocol and software that implements a simple, fast, and secure way to create encrypted tunnels between peers. It is designed to be easy to audit and to perform well on common hardware, with a small codebase compared to traditional VPN systems.

The protocol uses the Noise Protocol Framework with Curve25519 for key exchange, ChaCha20-Poly1305 for encryption and authentication, and BLAKE2s for hashing. It derives keys with HKDF and uses ephemeral keys for forward secrecy. Communication patterns rely on a streamlined handshake and avoid older TLS or RSA dependencies, contributing to a smaller attack surface and simpler verification.

WireGuard runs as a Linux kernel module and in userspace, and has implementations for Windows, macOS, iOS, Android, and BSD. It operates over UDP by default and supports NAT traversal and persistent keepalive. Configuration is peer-based, with each peer identified by a public key and a list of allowed IPs to determine route ownership.

Traffic is forwarded between peers through interfaces configured with a compact set of parameters, making the system lightweight and predictable. Its performance benefits come from the streamlined cryptography and minimal kernel integration, resulting in high throughput and low latency relative to many traditional VPNs.

WireGuard is released as free and open-source software under the GNU General Public License version 2. It was created by Jason A. Donenfeld and publicly released in 2016; Linux kernel integration followed in 2020. It has been widely adopted for site-to-site and remote access VPN use cases.