# WireGuard WireGuard is a modern VPN protocol designed to be simpler, faster, and more secure than IPsec and OpenVPN. It runs as a kernel module (Linux) or userspace implementation (other platforms) and consists of roughly 4,000 lines of code — compared to 100,000+ for OpenVPN or IPsec. This small attack surface makes it significantly easier to audit. ## How It Works WireGuard creates encrypted point-to-point tunnels between peers using modern cryptography: Curve25519 for key exchange, ChaCha20 for symmetric encryption, Poly1305 for authentication, and BLAKE2s for hashing. There's no cipher negotiation — it uses a single, opinionated cryptographic suite (Noise protocol framework). If a vulnerability is found, the entire protocol version is bumped. Each peer has a public/private key pair. Configuration is minimal: you define peers by their public keys and allowed IP ranges. WireGuard operates at Layer 3 (IP level) and presents itself as a standard network interface (`wg0`, etc.). It's connectionless — there are no handshakes to maintain, no state machines, no keepalive negotiations. Packets are simply encrypted and sent. Silent when idle. ## Key Properties - **Performance**: Runs in the Linux kernel, achieving near-line-rate throughput with minimal CPU overhead - **Roaming**: Handles IP changes transparently — works naturally on mobile devices switching between WiFi and cellular - **Stealth**: No response to unauthenticated packets, making it invisible to port scanners - **Simplicity**: Configuration is similar in complexity to SSH authorized_keys - **Cross-platform**: Linux (kernel module), Windows, macOS, iOS, Android, FreeBSD, OpenBSD ## Limitations - No built-in user authentication or identity management — it's purely a tunneling protocol - No automatic key distribution or peer discovery - No dynamic IP assignment without external tooling - Layer 3 only (no Layer 2/bridging support) These gaps are exactly what projects like [[Tailscale]], [[NetBird]], and [[ZeroTier]] fill — they build coordination, identity, access control, and NAT traversal on top of WireGuard's core tunneling. ## References - Website: https://www.wireguard.com/ - Whitepaper: https://www.wireguard.com/papers/wireguard.pdf ## Related - [[Tailscale]] - [[NetBird]] - [[ZeroTier]] - [[Virtual Private Network (VPN)]]