Tools · SPBoucher
Menu

WireGuard

In-depth entry

by WireGuard project (Jason A. Donenfeld) · Application · also known as wg, wireguard-go

Minimal, high-speed VPN protocol and implementation built on modern cryptography, included in the Linux kernel and available on macOS, iOS, Windows, Android and BSD

GPL-2.0-only licenseOpen sourceFreeSelf-hostedLocalSelf-hostable
Visit official site Compare

Link verified Nov 2, 2026

Overview

WireGuard is a layer-3 VPN protocol and set of implementations created by Jason A. Donenfeld. It replaces the configuration-heavy model of IPsec and OpenVPN with a single fixed cryptographic suite built on the Noise protocol framework (Curve25519 key exchange, ChaCha20-Poly1305 encryption, BLAKE2s hashing) and a peer model in which each endpoint is identified by a public key and a set of allowed IP ranges. The reference implementation lives in the Linux kernel since version 5.6 under GPL-2.0; a userspace implementation in Go, wireguard-go (MIT), powers the macOS, iOS, Windows and Android apps, and the wg and wg-quick tools manage interfaces and configuration files.

Its configuration is short enough to read at a glance: an interface section with a private key and address, and one peer section per remote with its public key, endpoint and allowed IPs. Because peers roam freely and the protocol is stateless from the user's perspective, it suits hub-and-spoke setups where many machines connect to one gateway, site-to-site links between servers, and the data plane of overlay networks such as Tailscale. On UDP it handles NAT traversal when at least one side has a reachable port.

What WireGuard does not provide is key distribution, identity or access policy: every peer's public key and allowed ranges must be placed on the other side by some external process, and there is no built-in user authentication or certificate model. Networks with many nodes therefore add a coordination layer or configuration management. The protocol is also UDP-only, which some restrictive networks block.

Editorial note on uncertainty. license_spdx reflects the Linux kernel module and wireguard-tools (GPL-2.0); wireguard-go and the platform apps use the MIT license.

Capabilities

  • Encrypted layer-3 tunnels using Noise, Curve25519, ChaCha20-Poly1305 and BLAKE2s
  • In-kernel implementation on Linux and userspace implementations for other platforms
  • Public-key peer identity with AllowedIPs-based cryptokey routing
  • Roaming endpoints and NAT traversal over UDP
  • wg and wg-quick tools with simple INI-style configuration files
  • Official apps for macOS, iOS, Windows and Android

Typical workflows

  1. Connect a fleet of machines to a public gateway host so a reverse proxy can reach them
  2. Build a site-to-site tunnel between two servers
  3. Give a laptop secure access to a home or lab network
  4. Serve as the data plane under an overlay such as Tailscale

Strengths

  • Small code base that has been formally analyzed
  • High throughput thanks to the kernel implementation
  • Configuration fits in a few lines
  • Available on every mainstream operating system

Limitations

  • No built-in key distribution, identity or access control
  • UDP only; blocked on some networks unless a port such as 443 is used
  • Static configuration does not scale to large meshes without tooling
  • Kernel module availability depends on the host OS version

Prerequisites

  • Linux kernel 5.6+ or the WireGuard app/wireguard-go on other systems
  • A reachable UDP port on at least one peer

Who it is for

  • Network and systems administrators
  • Self-hosters connecting home and cloud machines
  • Developers building overlay networks

Alternatives & comparison

Tailscale wraps WireGuard with a coordination service that distributes keys, assigns addresses and enforces access policies, trading some control for far less configuration. OpenSSH tunnels and port forwards provide encrypted access to individual services without a network interface, which is simpler for one-off use but not for routing. Cloudflare Tunnel publishes services outbound through Cloudflare's edge and needs no open ports at all, but routes traffic through a third party rather than directly between peers.

  • Cloudflare Tunnel

    Outbound-only connector (cloudflared) that publishes local web services and private networks through Cloudflare's edge without opening inbound ports

    MixedFreemium
  • OpenSSH

    Reference implementation of the SSH protocol from the OpenBSD project: remote shell, file transfer, port forwarding, key agent and certificate authority tooling

    Open sourceOpen source
  • Tailscale

    WireGuard-based mesh overlay network with a hosted coordination service, identity-provider login, access policies, MagicDNS and features such as Tailscale SSH, Serve and Funnel

    MixedFreemium
Compare WireGuard with its alternatives →

Sources & verification

Primary sources consulted for this record. Claims are tied to the fields each source supports; the automated link checker re-verifies every URL on a schedule.

  • License
    wireguard-tools COPYING (GPL-2.0)

    https://git.zx2c4.com/wireguard-tools/tree/COPYING

    Supports: license_spdx, source_model

    checked Nov 1, 2026
  • Official documentation
    WireGuard Quick Start

    https://www.wireguard.com/quickstart

    Supports: workflows, data_formats, prerequisites

    checked Nov 1, 2026
  • Official site
    WireGuard: fast, modern, secure VPN tunnel

    https://www.wireguard.com/

    Supports: name, summary, capabilities, operating_systems

    checked Nov 1, 2026
  • Repository
    WireGuard/wireguard-go

    https://github.com/WireGuard/wireguard-go

    Supports: languages

    Userspace Go implementation under the MIT license.

    checked Nov 1, 2026
Confidence
High
Reviewed
Nov 1, 2026
Links
Verified · Nov 2, 2026

Spotted an error?

Broken link, outdated license, wrong category, or a tool that no longer exists? Tell us; reports are reviewed by the editor.

ngrok

ngrok, Inc. · Tunneling & remote access

Hosted ingress service that exposes local servers through public URLs via an agent or SDK, with Traffic Policy rules, API gateway features and reserved domains

ProprietaryFreemiumPaidLocalBroken