WireGuard

What WireGuard actually is

WireGuard is not a host, a service, or a company — it is a VPN protocol, freely licensed, that you deploy on your own machines. Jason A. Donenfeld ("zx2c4") began developing it in 2015; the first public release appeared on 9 December 2016, and after years of maturation it was merged into the Linux kernel, shipping as WireGuard 1.0.0 in kernel 5.6 on 29 March 2020 — the first VPN technology with first-class kernel support other than IPsec. It now runs cross-platform: Linux, Windows, macOS, BSD, iOS, and Android.

The design goal was radical reduction. Where IPsec stacks (the *swan family) run to hundreds of thousands of lines and OpenVPN carries roughly 70,000-100,000 lines of its own code — over 500,000 once you count its OpenSSL dependency — WireGuard's kernel implementation is around 4,000 lines. Our database row attributed the 400,000-line comparison to OpenVPN; the accurate framing is that the 400,000+ behemoths are IPsec implementations, and OpenVPN with its dependency lands around half a million. Either way, the point holds and it is the reason security people care: a codebase one person can actually audit.

The interface model borrows from SSH. Each interface has a private key; each peer has a public key; a peer's key is bound to a set of tunnel IP addresses — WireGuard calls this Cryptokey Routing. If a packet arrives for 192.168.3.7, WireGuard looks up which peer owns that address, encrypts the whole inner IP packet with that peer's key (Noise_IK handshake, ChaCha20-Poly1305, Curve25519), and sends it over UDP. Peers roam: if a phone moves from Wi-Fi to LTE, the endpoint updates automatically, the way Mosh sessions survive network changes. There is no connection state to manage, no daemon orchestration, no TLS-style negotiation zoo. In our /category/private-networking category, WireGuard is the protocol layer — everything else (hosts, control planes, management UIs) is built around it.

Pricing: what you really pay

Zero. The software is free and open source (GPLv2 in the kernel, permissively licensed companion implementations for other platforms), and there is no paid tier, no licence, and no vendor. If someone is charging you "for WireGuard," they are charging for the servers, the management layer, or the support — not the protocol.

Your real cost is the infrastructure you run it on. A single WireGuard endpoint comfortably serves as the hub of a private network for a small team, so the practical budget line is one modest VPS — see our /benchmarks price table; entry instances in Europe run a few euros a month — plus whatever static addressing or DNS your design needs. Client-to-client mesh overlays and managed control planes (Tailscale-style products, or open-source coordination servers) add their own pricing, but plain WireGuard needs none of them.

There is nothing to compare on renewal rates, seat counts, or bandwidth fees, because there is no invoice. That is worth stating plainly in a category full of per-seat VPN pricing: the protocol itself will never be your line item.

Performance & infrastructure

Performance is the other reason for the adoption curve. WireGuard runs in-kernel on Linux and uses a small set of high-speed cryptographic primitives, which puts it at the top of the practical throughput range for software VPNs — its own documentation frames the goal as being "considerably more performant than OpenVPN," and the industry result is that it became the default protocol underneath modern commercial VPN apps, including Mullvad (whose help centre documents WireGuard as its recommended protocol) and NordVPN's NordLynx, which runs WireGuard unmodified under a double-NAT privacy layer. We have not published our own WireGuard throughput numbers, so we make no quantitative claim here; the honest statement is that on comparable hardware the protocol overhead is low enough that the network, not the crypto, is usually the bottleneck.

There is no infrastructure to describe in the vendor sense: no data centers, no regions, no network. Availability equals the availability of the machines you deploy on, and your SLA is whatever your VPS or bare-metal provider gives you. From a ServerSpotter perspective that is a feature — you choose the jurisdiction, the provider, and the topology — and a responsibility: backups, monitoring, and patching are yours.

The academic pedigree is unusually strong for infrastructure software. The protocol is defined by a formal whitepaper that works through the cryptographic construction decision by decision, and the design choices — fixed cryptography instead of negotiation, silent handshake retries, a stateless cookie mechanism for DoS resistance — are argued rather than asserted. In August 2018 Linus Torvalds publicly called it "a work of art" compared to "the horrors that are OpenVPN and IPSec"; the merge nonetheless took until 2020 because of kernel-crypto politics around the proposed Zinc library, not because of doubts about the design.

Where it falls short

WireGuard solves encryption and authentication. It deliberately does not solve key distribution, configuration management, NAT traversal orchestration, or anonymity — the documentation pushes key distribution "out of scope… much better left for other layers." If you want a push-button product where a vendor handles provisioning, WireGuard is a component, not an answer.

The privacy nuance matters and is widely misdescribed. WireGuard binds tunnel IPs to public keys in a static peer table; on a commercial no-logs VPN gateway that mapping can be used to correlate a user to traffic, which is exactly why NordVPN wraps it in a double-NAT layer and why Mullvad reworked addressing for its own deployments. Note our database row's framing — "requires static IP allocation" — is imprecise: endpoints roam freely and the issue is the key-to-IP mapping on servers many users share, not a static IP requirement for clients. Similarly, "not obfuscated by default" is correct and consequential: WireGuard's UDP handshake is fingerprintable, and restrictive networks can and do block it outright. If you need censorship resistance, you will pair it with an obfuscation layer or a different transport.

The other gaps are those of any free software: no support contract, no SLA, no credits when something breaks, and a security process that depends on community disclosure. For production use that usually means you buy support indirectly — from your server provider, from a commercial wrapper, or in-house.

Who should pick this

Our pick for WireGuard is any team building private connectivity they intend to control: site-to-site links between servers, a developer VPN into a private network, mesh connectivity for a small fleet, or a self-hosted remote-access service. It is the right default for people who read our /benchmarks pages and think in terms of their own VPS inventory.

It is also the right protocol choice inside a commercial VPN subscription — when a provider offers it, we would enable it over OpenVPN or L2TP on performance grounds alone.

We would not hand it to a non-technical user as a complete product (buy a managed offering instead), and we would not choose plain WireGuard where anonymity against the gateway operator is the goal (use a provider with a documented addressing scheme) or where the network blocks UDP VPN traffic (obfuscation required).

Key takeaways

• Free, open-source VPN protocol by Jason A. Donenfeld: first released December 2016, in the Linux kernel since 5.6 (March 2020), cross-platform everywhere else.
• Around 4,000 lines of kernel code versus ~70,000-100,000 for OpenVPN (500,000+ with OpenSSL) and 400,000+ for IPsec stacks — small enough for a single auditor.
• Cryptokey routing with SSH-style key exchange, ChaCha20-Poly1305 encryption, UDP transport, and native roaming between networks.
• No vendor, no SLA, no support contract — your availability equals the infrastructure you deploy it on.
• Not anonymity software: the static key-to-IP peer table and unobfuscated UDP fingerprint are why commercial providers wrap it in NAT layers and why censors can block it.
• In our view the default protocol for self-hosted private networking and the fastest option to enable when your commercial VPN offers it.

Sources

• https://www.wireguard.com/
• https://www.wireguard.com/xplatform/
• https://www.wireguard.com/protocol/
• https://mullvad.net/en/help?Protocol=wireguard
• https://encapsulated.network/what-is-nordlynx
• https://cyberphinix.de/en/blog/wireguard-vpn-explained