networks//VPN//WireGuard

WireGuard is a VPN protocol that builds encrypted tunnels over UDP between peers identified only by their public keys. It runs inside the Linux kernel since version 5.6 (2020) and on every major system, and products such as Tailscale use it as their data path.

WireGuard is a VPN protocol that builds encrypted tunnels over UDP between peers identified only by their public keys. It runs inside the Linux kernel since version 5.6 (2020) and on every major system, and products such as Tailscale use it as their data path.

Each peer holds a Curve25519 key pair. Configuring a tunnel means telling each side the other's public key and, optionally, an address where it can be found; there are no certificates, user names or negotiated cipher lists. When the first packet needs to go out, the two peers run a handshake of one round trip built on the Noise framework, a key exchange that proves each side holds the private key matching its public key and derives fresh symmetric keys. Data then travels encrypted and authenticated with ChaCha20-Poly1305, and the session keys are replaced every two minutes.

No connection to keep alive.

WireGuard keeps no session that idles or times out: a peer is a public key and a last known address, and a handshake happens only when there is something to send. An idle tunnel sends nothing, which makes it nearly free to leave running.

It answers no packet that fails authentication. To a scanner the UDP port looks closed, which removes the tunnel itself from the attack surface that an exposed login service would add.

A data packet adds 32 bytes of its own (a 16-byte header with type, receiver index and counter, and a 16-byte authentication tag), on top of the outer UDP and IP headers. Over IPv4 a tunnel therefore costs 60 bytes per packet, and implementations lower the inner maximum packet size so the outer one still fits a normal link.

The small design is deliberate: the original paper counts about 4,000 lines of code against hundreds of thousands for the usual IPsec and OpenVPN stacks, and the fixed choice of algorithms leaves nothing to misconfigure. The cost of that rigidity is that changing an algorithm means a new protocol version.

WireGuard does not find peers behind NAT or distribute keys. That is left to whatever configures it, which is exactly the part Tailscale adds.