WireGuard
WireGuard is a communication protocol and free and open-source software that implements encrypted virtual private networks (VPNs), and was designed with the goals of ease of use, high speed performance, and low attack surface.  It aims for better performance and more power than IPsec and OpenVPN, two common tunneling protocols.  The WireGuard protocol passes traffic over UDP.

In March 2020, the Linux version of the software reached a stable production release and was incorporated into the Linux 5.6 kernel, and backported to earlier Linux kernels in some Linux distributions.  The Linux kernel components are licensed under the GNU General Public License (GPL) version 2; other implementations are under GPLv2 or other free/open-source licenses.

Protocol
WireGuard uses the following:
 Curve25519 for key exchange
 ChaCha20 for symmetric encryption
 Poly1305 for message authentication codes
 SipHash for hashtable keys
 BLAKE2s for cryptographic hash function
 UDP-based only

In May 2019, researchers from INRIA published a machine-checked proof of WireGuard, produced using the CryptoVerif proof assistant.

Optional Pre-shared Symmetric Key Mode 
WireGuard supports pre-shared symmetric key mode, which provides an additional layer of symmetric encryption to mitigate any future advances in quantum computing. The risk being that traffic is stored until quantum computers are capable of breaking Curve25519; at which point traffic could be decrypted. Pre-shared keys are "usually troublesome from a key management perspective and might be more likely stolen", but in the shorter term, if the symmetric key is compromised, the Curve25519 keys still provide more than sufficient protection.

Networking
WireGuard only uses UDP and thus does not work in networks that block UDP traffic. This is unlike alternatives like OpenVPN because of the many disadvantages of TCP-over-TCP routing.

WireGuard fully supports IPv6, both inside and outside of tunnel. It supports only layer 3 for both IPv4 and IPv6 and can encapsulate v4-in-v6 and vice versa.

WireGuard supports multiple topologies:
 Point-to-point
 Star (server/client)
 A client endpoint does not have to be defined before the client starts sending data.
 Client endpoints can be statically predefined.
 Mesh

Extensibility

Excluding such complex features from the minimal core codebase improves its stability and security. For ensuring security, WireGuard restricts the options for implementing cryptographic controls, limits the choices for key exchange processes, and maps algorithms to a small subset of modern cryptographic primitives. If a flaw is found in any of the primitives, a new version can be released that resolves the issue. Also, configuration settings that affect the security of the overall application cannot be modified by unprivileged users.

Reception
WireGuard aims to provide a simple and effective virtual private network implementation. A 2018 review by Ars Technica observed that popular VPN technologies such as OpenVPN and IPsec are often complex to set up, disconnect easily (in the absence of further configuration), take substantial time to negotiate reconnections, may use outdated ciphers, and have relatively massive code bases of over 400,000 and 600,000 lines of code, respectively, which hinders debugging.

WireGuard's design seeks to reduce these issues, aiming to make the tunnel more secure and easier to manage by default. By using versioning of cryptography packages, it focuses on ciphers believed to be among the most secure current encryption methods, and at the time of the Ars Technica review had a codebase of around 4000 lines of kernel code, about 1% of either OpenVPN or IPsec, making security audits easier. WireGuard was praised by Linux kernel creator Linus Torvalds who called it a "work of art" in contrast to OpenVPN and IPsec. Ars Technica reported that in testing, stable tunnels were easily created with WireGuard, compared to alternatives, and commented that it would be "hard to go back" to long reconnection delays, compared to WireGuard's "no nonsense" instant reconnections.

Oregon senator Ron Wyden has recommended to the National Institute of Standards and Technology (NIST) that they evaluate WireGuard as a replacement for existing technologies like IPsec and OpenVPN.

Availability

Implementations
Implementations of the WireGuard protocol include:
 Donenfeld's initial implementation, written in C and Go.
 Cloudflare's BoringTun, a user space implementation written in Rust.
 Matt Dunwoodie's implementation for OpenBSD, written in C.
 Ryota Ozaki's wg(4) implementation, for NetBSD, is written in C.
 The FreeBSD implementation is written in C and shares most of the data path with the OpenBSD implementation.
 Native Windows kernel implementation named "wireguard-nt", since August 2021
 OPNsense via standard package os-WireGuard
 pfSense via standard package (pfSense-pkg-WireGuard) (A Netgate-endorsed community package)

Linux support 
User space programs supporting WireGuard include:
 NetworkManager since version 1.16
 systemd since version 237
 Intel's ConnMan since version 1.38
IPVanish VPN since version 3.7.4.0
 Mozilla VPN (with Mullvad)
 NOIA Network 
 NordVPN via Nordlynx
Veeam Powered Network v2, since May 2019
 PiVPN since 17 October 2019
VPN Unlimited since November 2019
 Private Internet Access VPN since 10 April 2020
hide.me CLI VPN client since July 20, 2020
Surfshark since October 2020
 Mistborn (software) VPN since March 2020
 Oracle Linux with "Unbreakable Enterprise Kernel" Release 6 Update 1, since November 2020
 oVPN since Feb 2020, roll-out in 2021
 Torguard since 2020
 Vypr VPN since May 2020
 Windscribe in 2020
Trust.zone VPN since February 2021
ProtonVPN since October 2021

History 
Early snapshots of the code base exist from June 30, 2016. Four early adopters of WireGuard were the VPN service providers Mullvad, AzireVPN, IVPN and cryptostorm. WireGuard has received donations from Mullvad, Private Internet Access, IVPN, the NLnet Foundation and now also from OVPN.

 the developers of WireGuard advise treating the code and protocol as experimental, and caution that they have not yet achieved a stable release compatible with CVE tracking of any security vulnerabilities that may be discovered.

On 9 December 2019, David Miller - primary maintainer of the Linux networking stack - accepted the WireGuard patches into the "net-next" maintainer tree, for inclusion in an upcoming kernel.

On 28 January 2020, Linus Torvalds merged David Miller's net-next tree, and WireGuard entered the mainline Linux kernel tree.

On 20 March 2020, Debian developers enabled the module build options for WireGuard in their kernel config for the Debian 11 version (testing).

On 29 March 2020 WireGuard was incorporated into the Linux 5.6 release tree.  The Windows version of the software remains at beta.

On 30 March 2020, Android developers added native kernel support for WireGuard in their Generic Kernel Image.

On 22 April 2020, NetworkManager developer Beniamino Galvani merged GUI support for WireGuard.

On 12 May 2020, Matt Dunwoodie proposed patches for native kernel support of WireGuard in OpenBSD.

On 22 June 2020, after the work of Matt Dunwoodie and Jason A. Donenfeld, WireGuard support was imported into OpenBSD.

On 23 November 2020, Jason A. Donenfeld released an update of the Windows package improving installation, stability, ARM support, and enterprise features.

On 29 November 2020, WireGuard support was imported into the FreeBSD 13 kernel.

On 19 January 2021, WireGuard support was added for preview in pfSense Community Edition (CE) 2.5.0 development snapshots.

In March 2021, kernel-mode WireGuard support was removed from FreeBSD 13.0, still in testing, after an urgent code cleanup in FreeBSD WireGuard could not be completed quickly. FreeBSD-based pfSense Community Edition (CE) 2.5.0 and pfSense Plus 21.02 removed kernel-based WireGuard as well.

In May 2021, WireGuard support was re-introduced back into pfSense CE and pfSense Plus development snapshots as an experimental package written by a member of the pfSense community, Christian McDonald. The WireGuard package for pfSense incorporates the ongoing kernel-mode WireGuard development work by Jason A. Donenfeld that was originally sponsored by Netgate

In June 2021, the official package repositories for both pfSense CE 2.5.2 and pfSense Plus 21.05 included the WireGuard package

See also 
 Comparison of virtual private network services
 Secure Shell (SSH), a cryptographic network protocol used to secure services over an unsecured network.

Notes

References

External links 
 

Free security software
Linux network-related software
Tunneling protocols
Virtual private networks