WireGuard
also: WG
WireGuard is a modern, lightweight VPN protocol and implementation that provides secure point-to-point connections using public-key cryptography and runs as a kernel module on Linux.
WireGuard is a VPN (Virtual Private Network) protocol designed for simplicity, speed, and security. Unlike older VPN solutions like OpenVPN or IPSec that use complex configuration files with hundreds of parameters, WireGuard uses minimal configuration—typically just a few lines defining peers and keys.
It works by creating a secure tunnel between network interfaces, encrypting all traffic that passes through it. Each peer is identified by a public key (similar to SSH), and the protocol handles encryption, authentication, and key exchange automatically. WireGuard operates at Layer 3 (the network layer) and can be deployed on servers, routers, or individual Linux machines.
A basic setup involves generating keypairs for each peer and specifying their public keys and allowed IP addresses in a configuration file like /etc/wireguard/wg0.conf. Then you bring up the interface with wg-quick up wg0, and encrypted traffic flows immediately—with significantly lower latency and CPU overhead compared to traditional VPN solutions.
WireGuard is increasingly used for site-to-site VPNs, remote access, and mesh networking because of its modern cryptography, small codebase (under 4,000 lines), and kernel-level performance.