My IP Help

WireGuard

A modern VPN tunneling protocol designed to be simpler, faster, and more auditable than OpenVPN or IPsec — around 4,000 lines of code with a fixed modern cryptographic suite.

Last updated:

What is WireGuard?

WireGuard is a modern VPN tunneling protocol introduced by Jason Donenfeld in 2016 and merged into the mainline Linux kernel in 2020. It runs over UDP (usually port 51820), uses a fixed set of modern cryptographic primitives (ChaCha20, Poly1305, Curve25519, BLAKE2s), and is deliberately small — the entire Linux implementation is around 4,000 lines of code, compared to hundreds of thousands for OpenVPN or IPsec. That small surface area makes WireGuard much easier to audit and much less likely to contain memory-safety bugs.

How WireGuard works

Each peer has a static Curve25519 public key, identical in concept to an SSH key. Configuration is a short list of allowed peers, their public keys, and which IP prefixes each peer is permitted to send traffic for. There is no concept of a long-lived "connection state" like OpenVPN — a WireGuard tunnel is stateless at the configuration level, with session keys regenerated on a fixed schedule via a Noise-framework handshake.

WireGuard in consumer VPNs

Most modern commercial VPN providers (NordVPN's NordLynx, Mullvad, Surfshark, ProtonVPN, IVPN) now offer WireGuard as their default or primary protocol. It reconnects faster on mobile network changes, runs close to line rate on modest hardware, and uses less battery on phones than OpenVPN over TCP. Because WireGuard is UDP and its packets look uniform, it is more easily fingerprinted and blocked by deep-packet-inspection firewalls, which is why some providers wrap it in TCP/TLS (obfuscation layers like NordWhisper or Shadowsocks) for use in restrictive networks.

Identify WireGuard VPN infrastructure and other anonymization services behind any IP with our VPN & proxy detector.

Frequently Asked Questions

Yes — substantially. Independent benchmarks routinely show WireGuard pushing 2-4x the throughput of OpenVPN on the same hardware, with lower CPU usage and lower latency. The reasons are structural: WireGuard runs in the Linux kernel, uses modern fast cryptographic primitives (ChaCha20, Poly1305), and has no protocol negotiation or legacy framing overhead. On mobile, the speed gap is even larger because OpenVPN over TCP suffers badly from TCP-in-TCP head-of-line blocking.
Yes. WireGuard uses a fixed modern cryptographic suite — Curve25519 for key exchange, ChaCha20-Poly1305 for symmetric encryption, BLAKE2s for hashing, Noise framework for the handshake — with no negotiation, so downgrade attacks are impossible. Its small codebase (~4,000 lines) has been formally verified in parts and audited multiple times. The main weakness is operational: WireGuard does not include built-in identity, key distribution, or revocation, so misconfiguration is a more common risk than cryptographic weakness.
WireGuard runs over UDP and the default port is 51820, but the port is configurable per peer and any UDP port can be used. There is no official IANA-assigned port. Some commercial providers run WireGuard on port 443/UDP to look like QUIC and bypass simple port-blocking firewalls. WireGuard does not have a TCP fallback by design; tunnels that need TCP wrap WireGuard inside udp2raw, wstunnel, or Shadowsocks.
Yes — when used as a VPN. The destination server sees the WireGuard server's IP, not yours. WireGuard itself is just a tunneling protocol; whether your IP is hidden depends on whether the WireGuard server logs traffic and how it routes outbound connections. Self-hosted WireGuard on a VPS hides your IP from destinations but not from the VPS provider. Commercial WireGuard VPNs add policies and shared-IP NAT to hide individual users.
Yes. WireGuard packets have a recognizable structure — a fixed handshake type byte and predictable handshake sizes — that deep-packet-inspection firewalls in China, Russia, and Iran use to fingerprint and drop them. Workarounds include obfuscation layers (NordWhisper, AmneziaWG, wstunnel) that wrap WireGuard inside TLS, HTTPS, or random noise, and rotating server ports. Plain WireGuard on the default port is trivial to block.
Back to glossary