WireGuard aims to provide a VPN that is both simple and highly effective. A 2018 review by Ars Technica observed that popular VPN technologies such as OpenVPN and IPsec are often complex to set up, disconnect easily, take substantial time to negotiate reconnections, may use outdated ciphers, and have relatively massive code bases which makes it harder to find bugs. WireGuard's design seeks to reduce these issues, making the tunnel more secure and easier to manage by default. By using versioning of cryptography packages, it focuses on ciphers believed to be among the most secure current encryption methods, and at the time of the Ars Technica review had a codebase of around 4000 lines of pure kernel code, about 1% of either OpenVPN or IPsec, making security audits easier, and praised by the Linux kernel creator Linus Torvalds compared to OpenVPN and IPsec as a "work of art". Ars Technica reported that in testing, stable tunnels were easy to create with WireGuard, compared to alternatives, and commented that it would be "hard to go back" to long reconnection delays, compared to WireGuard's "no nonsense" instant reconnections.
WireGuard supports Pre-shared Symmetric, which is included to mitigate any future advances in quantum computing. In the shorter term, if the pre-shared symmetric key is compromised, the Curve25519 keys still provide more than sufficient protection.
Networking
WireGuard only works over UDP. WireGuard fully supports IPv6, both inside and outside of tunnel. It supports only layer 3 for both IPv4 and IPv6 and can encapsulate v4-in-v6 and vice versa. WireGuard supports multiple topologies:
Since Point-to-point is supported, other topologies can be made, but not on the same tunnel.
Extensibility
WireGuard is designed to be extended by third-party programmes and scripts. This has been used to augment WireGuard with various features including more user-friendly management interfaces, logging, dynamic firewall updates, and LDAP integration. Excluding such complex features from the minimal core codebase improves its stability and security.
History
Earliest snapshots of the code base exist from June 30, 2016. Four early adopters of WireGuard were the VPN service providersMullvad, AzireVPN, IVPN and cryptostorm. WireGuard has received donations from Mullvad, Private Internet Access, IVPN and the NLnet Foundation. Now also by OVPN. the developers of WireGuard advise treating the code and protocol as experimental, and caution that they have not yet achieved a stable release compatible with CVE tracking of any security vulnerabilities that may be discovered. On 9 December 2019, David Miller - primary maintainer of the Linux networking stack - accepted the WireGuard patches into the "net-next" maintainer tree, for inclusion in an upcoming kernel. On 28 January 2020, Linus Torvalds merged David Miller's net-next tree, and WireGuard entered the mainline Linux kernel tree. On 20 March 2020, Debian developers enabled the module build options for WireGuard in their kernel config for the Debian 11 version. On 29 March 2020 WireGuard was incorporated into the Linux 5.6 release tree. The Windows version of the software remains at beta. On 30 March 2020, Android developers added native kernel support for WireGuard in their Generic Kernel Image. On 22 April 2020, NetworkManager developer Beniamino Galvani merged GUI support for WireGuard. On 12 May 2020, Matt Dunwoodie proposed patches for native kernel support of WireGuard in OpenBSD. On 22 June 2020, After the work of Matt Dunwoodie and Jason A. Donenfeld, WireGuard support has been imported into OpenBSD.
