WireGuard is one of several protocols used to create encrypted VPN connections. Its design emphasizes simplicity and performance, but support for the protocol alone does not establish a commercial VPN’s speed, logging practices or ability to connect through restrictive networks.
Alternatives include OpenVPN and IKEv2/IPsec. The protocol governs the encrypted tunnel, while a commercial VPN service supplies the apps, servers and account systems around it.
Design and performance
WireGuard carries encrypted IP packets over UDP and uses a fixed set of cryptographic tools rather than a configurable menu of ciphers. Its developers describe the compact implementation as an approach intended to make security review more manageable.
The protocol also supports roaming between IP addresses. It updates a peer’s network endpoint after receiving authenticated traffic from a new address, allowing the tunnel to accommodate address changes when a device moves between networks.
The project’s stated goals include higher performance than OpenVPN and IPsec. Its performance documentation, however, cautions that its published benchmarks are outdated and were not well conducted. Those benchmarks do not establish a consistent speed advantage across commercial VPN services.
Privacy handling by VPN providers
WireGuard associates public keys with permitted tunnel IP addresses and remote network endpoints. These associations support routing and authentication; they do not specify a commercial provider’s data-retention policy.
In its April 24, 2020 announcement of NordLynx, NordVPN said its WireGuard-based technology combined the protocol with double network address translation, or double NAT, to establish connections without storing identifiable data on VPN servers.
Proton VPN says its modified WireGuard implementation also uses double NAT to assign internal addresses dynamically. The company says WireGuard does not necessarily create logs and that it does not retain users’ IP addresses or WireGuard session logs.
These privacy assurances concern the providers’ own implementations and policies. They do not establish the logging practices of other services that use WireGuard.
Restrictive networks and alternative protocols
WireGuard does not include built-in obfuscation to disguise VPN traffic, and it does not natively tunnel over TCP. Its developers leave those functions to additional layers above the protocol.
These limitations are relevant on networks that restrict VPN traffic. Switching to another conventional protocol does not necessarily conceal VPN use: Proton VPN says OpenVPN, IKEv2 and WireGuard traffic can all be recognized on a network.
Providers also offer protocols with different designs. ExpressVPN’s August 10, 2021 Lightway launch announcement described a separate protocol supporting both TCP and UDP. Proton VPN describes Stealth as an obfuscation-focused protocol that uses TLS tunneling over TCP to make VPN traffic resemble ordinary HTTPS connections.
Post-quantum security
WireGuard’s known-limitations documentation states that the protocol is not post-quantum secure by default. It describes an optional pre-shared key as a way to add a layer of post-quantum secrecy, and a separate post-quantum handshake as an approach for supplying that key.
