WireGuard

WireGuard is an open-source VPN protocol and implementation created by Jason Donenfeld, designed around simplicity, high performance, and a minimal attack surface. It is implemented as a Linux kernel module (and cross-platform userspace implementations for other OSes) and uses a curated suite of modern cryptographic primitives: Curve25519 for key exchange, ChaCha20 for encryption, Poly1305 for authentication, and BLAKE2s for hashing. WireGuard’s codebase is approximately 4,000 lines, compared to OpenVPN’s 400,000+, which dramatically reduces the audit surface.

How it works

WireGuard operates at the network layer, creating a virtual network interface (wg0) that encrypts all traffic destined for peer IP ranges. Each peer is identified by its public key, and the allowed IPs list defines which source/destination address ranges are authorized for that peer. The protocol is stateless from a connection perspective: there is no handshake state machine to exploit, and peers silently ignore packets that fail cryptographic validation. Configuration is minimal: each side needs only the peer’s public key, endpoint IP/port, and allowed IP ranges.

Key facts

• Performance: WireGuard typically achieves 3 to 4x higher throughput than OpenVPN on the same hardware due to in-kernel processing and modern cipher selection
• Integration: WireGuard is the underlying transport for Tailscale, Mullvad, and many commercial VPNs; it is built into Linux kernel 5.6+ and all major OS platforms
• No dynamic IP handling: WireGuard itself does not handle dynamic IP addresses; Tailscale or wg-easy add this capability on top of the base protocol

For builders

For builders who want to run their own VPN server rather than relying on Tailscale‘s coordination plane, WireGuard is the correct choice. wg-easy is a Docker container that wraps WireGuard with a simple web UI for managing peer configurations, making self-hosted VPN setup accessible without deep networking expertise. Running WireGuard on a Hetzner VPS for under $5/month gives a builder a private, fast, self-controlled VPN endpoint for all devices.

Sources

• Donenfeld, J. A. (2017). WireGuard: Next Generation Kernel Network Tunnel. wireguard.com
• IETF. RFC 8446: The Transport Layer Security (TLS) Protocol Version 1.3. datatracker.ietf.org
• F5 / Nginx. Nginx official documentation. nginx.org
• IETF. RFC 1035: Domain Names, Implementation and Specification. datatracker.ietf.org
• Cloudflare. Tunnel and Zero Trust networking documentation. developers.cloudflare.com