WireGuard

WireGuard is a VPN (Virtual Private Network) solution developed by ZX2C4 and Edge Security. According to the vendor, it offers a simple, fast, and secure way to establish encrypted connections over the internet. WireGuard is designed to be easy to configure and deploy, making it suitable for businesses of various sizes, from small enterprises to large organizations. It caters to a wide range of professions and industries, including IT professionals, network administrators, software developers, security professionals, and service providers.

Key Features

Simple & Easy-to-use: WireGuard aims to be as easy to configure and deploy as SSH. According to the vendor, VPN connection is made by exchanging simple public keys, and all the rest is transparently handled by WireGuard. No need to manage connections or worry about what's under the hood.

Cryptographically Sound: WireGuard utilizes state-of-the-art cryptography like Noise protocol framework, Curve25519, ChaCha20, Poly1305, BLAKE2, SipHash24, HKDF, and secure trusted constructions. The vendor claims that WireGuard has been reviewed by cryptographers and makes conservative and reasonable choices. It is designed to be secure and resistant to cryptographic attacks.

Minimal Attack Surface: WireGuard is designed with ease-of-implementation and simplicity in mind. According to the vendor, it can be implemented in a few lines of code and easily audited for security vulnerabilities. Compared to other VPN solutions, WireGuard is said to be comprehensively reviewable by single individuals.

High Performance: WireGuard combines high-speed cryptographic primitives with the efficiency of being inside the Linux kernel. The vendor states that it is suitable for both small embedded devices and fully loaded backbone routers, providing fast and secure networking.

Well Defined & Thoroughly Considered: WireGuard is the result of a lengthy and thoroughly considered academic process. According to the vendor, the technical whitepaper clearly defines the protocol and the intense considerations that went into each decision. WireGuard is built on a solid foundation of research and analysis.

Simple Network Interface: WireGuard works by adding a network interface called wg0 (or wg1, wg2, etc.). The interface can be configured normally using ifconfig or ip-address. According to the vendor, WireGuard aspects of the interface are configured using the wg tool. The interface acts as a tunnel interface for secure networking.

Cryptokey Routing: WireGuard uses Cryptokey Routing to associate public keys with a list of tunnel IP addresses. Each network interface has a private key and a list of peers with public keys. Public keys are used to authenticate peers and determine allowed IP addresses. According to the vendor, Cryptokey Routing provides a simple association of public keys and allowed IPs.

Built-in Roaming: WireGuard supports built-in roaming between IP addresses. The server discovers the endpoint of its peers by examining authenticated data. Both client and server send encrypted data to the most recent IP endpoint. The vendor claims that WireGuard allows for seamless IP roaming on both ends.

Ready for Containers: WireGuard can be used in containers by creating the WireGuard interface in the main network namespace. The interface can then be moved into a network namespace belonging to a Docker container. According to the vendor, this ensures that the container can only access the network through a secure WireGuard tunnel. WireGuard provides secure and encrypted networking for containerized environments.