WireGuard
A modern VPN protocol known for its minimal codebase (approximately 4,000 lines of kernel implementation), high performance, and strong encryption. It was merged into the Linux 5.6 kernel mainline in 2020.
Core Facts
WireGuard's codebase is only approximately 4,000 lines, whereas OpenVPN exceeds 70,000 lines.
WireGuard was developed by Jason Donenfeld in 2015 and was officially merged into the Linux kernel in 2020.
WireGuard uses a fixed cryptographic combination of Curve25519 for key exchange, ChaCha20 for symmetric encryption, and Poly1305 for message authentication.
Timeline (last 90 days)
NetBird is a zero-trust mesh network platform based on WireGuard, adding an identity management, NAT traversal, and policy distribution layer on top of WireGuard.
WireGuard employs a silent design that does not respond to unauthenticated packets, making its presence undetectable by port scanning.
NetBird uses a peer-to-peer mesh architecture where devices establish direct WireGuard tunnels with each other whenever possible, falling back to a relay server only when a direct connection is not feasible.
Tailscale/WireGuard relies on centralized coordination servers, ZeroTier also has central nodes, whereas Yggdrasil's routing is fully decentralized.
Deep packet inspection (DPI) can identify the presence of VPN traffic to a certain extent—for example, detecting that a connection is using the OpenVPN or WireGuard protocol.
WGDashboard has built-in WireGuard functionality, enabling one-stop management of peers, configurations, and traffic data.
On ARM Cortex-A53 cores such as the Pi3, WireGuard's kernel module support is limited, and some operations need to fall back to user-space processing, making efficiency lower than on x86 platforms.
WireGuard is a modern open-source VPN protocol with a codebase of approximately 4,000 lines, based on the Noise protocol framework, and has been merged into the Linux kernel mainline.
VPN solutions such as Tailscale and WireGuard are suitable for scenarios where access is restricted to specific members and not exposed to the public internet.
Tailscale Funnel is based on WireGuard networking and focuses more on internal team network connectivity than on temporary public-internet sharing.
28 more timeline events
All Facts (20)
WireGuard's codebase is only approximately 4,000 lines, whereas OpenVPN exceeds 70,000 lines.
75%VerifiedWireGuard was developed by Jason Donenfeld in 2015 and was officially merged into the Linux kernel in 2020.
75%VerifiedWireGuard uses a fixed cryptographic combination of Curve25519 for key exchange, ChaCha20 for symmetric encryption, and Poly1305 for message authentication.
70%VerifiedTailscale is a zero-configuration VPN service built on the WireGuard protocol, enabling different devices to communicate directly through secure encrypted tunnels.
65%VerifiedWireGuard, as the underlying protocol of Tailscale, has only approximately 4,000 lines of Linux kernel module code.
65%VerifiedWireGuard was developed by Jason Donenfeld in 2015 with a codebase of approximately 4,000 lines, compared to the hundreds of thousands of lines in OpenVPN.
65%VerifiedWhen UDP is completely blocked by a firewall, Tailscale ensures connectivity through DERP (Designated Encrypted Relay for Packets) relay servers, and end-to-end encryption prevents the relay servers from decrypting data content.
65%UnverifiedTailscale's coordination server does not relay users' actual data traffic; data is always transmitted end-to-end between devices through WireGuard tunnels with encryption.
70%UnverifiedThe Noise Protocol Framework was proposed by Trevor Perrin, the designer of the Signal protocol; its IK pattern enables zero-RTT encrypted transmission when the initiator already knows the responder's static public key.
60%UnverifiedWireGuard's encryption is performed at the network layer (Layer 3), transparently encrypting data of any protocol.
60%UnverifiedDERP relay servers can only see the ciphertext encrypted by WireGuard and cannot decrypt the actual transmitted content.
60%UnverifiedWireGuard uses the IK mode of the Noise Protocol, achieving a 1-RTT handshake and providing forward secrecy.
60%UnverifiedNetBird is a zero-trust mesh network platform based on WireGuard, adding an identity management, NAT traversal, and policy distribution layer on top of WireGuard.
50%UnverifiedWireGuard employs a silent design that does not respond to unauthenticated packets, making its presence undetectable by port scanning.
50%UnverifiedNetBird uses a peer-to-peer mesh architecture where devices establish direct WireGuard tunnels with each other whenever possible, falling back to a relay server only when a direct connection is not feasible.
50%UnverifiedTailscale/WireGuard relies on centralized coordination servers, ZeroTier also has central nodes, whereas Yggdrasil's routing is fully decentralized.
50%UnverifiedDeep packet inspection (DPI) can identify the presence of VPN traffic to a certain extent—for example, detecting that a connection is using the OpenVPN or WireGuard protocol.
50%UnverifiedWGDashboard has built-in WireGuard functionality, enabling one-stop management of peers, configurations, and traffic data.
50%UnverifiedOn ARM Cortex-A53 cores such as the Pi3, WireGuard's kernel module support is limited, and some operations need to fall back to user-space processing, making efficiency lower than on x86 platforms.
50%UnverifiedWireGuard is a modern open-source VPN protocol with a codebase of approximately 4,000 lines, based on the Noise protocol framework, and has been merged into the Linux kernel mainline.
50%