What is WireGuard?
WireGuard is a modern VPN protocol that uses state-of-the-art cryptography and aims to be faster, simpler, and more secure than IPsec and OpenVPN.
WireGuard is a VPN protocol and software implementation designed for simplicity, high performance, and modern cryptography. It was created by Jason A. Donenfeld and first released in 2016. The protocol uses the Noise Protocol Framework for key exchange and relies on Curve25519 for elliptic-curve Diffie-Hellman, ChaCha20 for symmetric encryption, Poly1305 for authentication, BLAKE2s for hashing, and SipHash24 for hashtable keys. This minimal set of primitives keeps the codebase small (under 4,000 lines) and auditable.
WireGuard operates as a kernel-level network tunnel in Linux, FreeBSD, and other systems. It was merged into the Linux kernel mainline in version 5.6, released in March 2020. The protocol uses UDP on port 51820 by default. Each peer is identified by a public key, and configuration is static: there is no built-in support for dynamic routing or daemon-based negotiation. This reduces attack surface and eliminates many of the complexities found in IPsec and OpenVPN.
In the wider stack, WireGuard is often used as a lightweight alternative to traditional VPN solutions. Its simplicity makes it suitable for both site-to-site links and remote access, though it lacks features like built-in authentication servers or dynamic IP assignment. These can be added with external tools (e.g., wg-quick, systemd-networkd, or third-party management software). WireGuard's performance stems from its efficient kernel implementation and minimal cryptographic overhead, making it popular for high-throughput and low-latency environments.
Key facts
- Uses only modern cryptographic primitives: Curve25519, ChaCha20, Poly1305, BLAKE2s.
- Integrated into the Linux kernel since version 5.6.
- Designed to be minimal, with fewer than 4,000 lines of code.
- Operates over UDP on port 51820 by default.
- No dynamic routing or daemon required; configuration is static.
How it works in practice
Related terms
References
More in Security
2FA
Two-factor authentication (2FA) is a security method that requires a user to present two distinct types of evidence to verify their identity, typically a password and a time-based one-time code from an authenticator app or hardware key.
Bot Management
Bot management detects automated web traffic and distinguishes it from human users, using behavioral fingerprinting and other signals to block malicious bots while allowing benign ones.
Credential Stuffing
Credential stuffing is a cyberattack in which automated tools use username-password pairs leaked from one site to try logging into other sites, exploiting password reuse.
DDoS
A DDoS (Distributed Denial of Service) attack overwhelms a target server, service, or network with massive traffic from many compromised computers, making it unavailable to legitimate users.
DDoS Scrubbing
DDoS scrubbing diverts attack traffic to a specialized filtering facility that removes malicious packets and forwards only legitimate traffic to the target network.
Firewall
A network security device or software that monitors and controls incoming and outgoing traffic based on predetermined security rules, acting as a barrier between trusted and untrusted networks.
IDS
An Intrusion Detection System (IDS) monitors network traffic or host activity for signs of malicious behavior or policy violations and generates alerts for security personnel.
IPS
An Intrusion Prevention System (IPS) is a network security device that monitors traffic inline and actively blocks malicious packets before they reach their target.
OAuth 2.0
OAuth 2.0 is an authorization framework that allows a user to grant a third-party application limited access to their resources on another service without revealing their password.
OpenID Connect
OpenID Connect (OIDC) is an identity authentication layer built on OAuth 2.0 that provides a signed ID token containing verified user identity claims.