What is WireGuard? The Modern VPN Protocol Explained

TL;DR: WireGuard is a modern VPN protocol built from roughly 4,000 lines of code with fixed, state-of-the-art cryptography (Curve25519 + ChaCha20-Poly1305). It lives in the Linux kernel since v5.6, reconnects almost instantly when you switch networks, and is the only protocol Palyfox VPN runs.

What is WireGuard?

WireGuard is a modern VPN protocol designed for simplicity, efficiency, and modern cryptography. Created by Jason A. Donenfeld, WireGuard was integrated into the Linux kernel in version 5.6 (March 2020) and is now available on all major operating systems including Windows, macOS, iOS, and Android.

Unlike traditional VPN protocols that were built decades ago and have accumulated layers of complexity, WireGuard takes a minimalist approach. Its entire codebase is roughly 4,000 lines of code — compared to OpenVPN’s 100,000+ lines. The smaller codebase can make review and maintenance more manageable.

Why is WireGuard Better Than Other VPN Protocols?

Speed and Performance

WireGuard is designed to operate efficiently. Its design includes:

• Minimal overhead: The lean codebase means less CPU processing per packet
• Kernel-level operation: WireGuard runs inside the OS kernel, eliminating context switching between user space and kernel space
• Modern cryptography: Uses algorithms optimized for modern hardware (ChaCha20 runs faster than AES on devices without hardware AES acceleration)
• UDP-based: Avoids the TCP-over-TCP problem that plagues OpenVPN in TCP mode

None of this repeals physics: distance to the server, server load, and your own line still set the ceiling. What the lean design changes is how little the protocol itself adds on top of that ceiling.

WireGuard vs OpenVPN vs IKEv2: Comparison

Feature	WireGuard	OpenVPN	IKEv2/IPsec
Lines of code	~4,000	~100,000	~400,000
Encryption	ChaCha20-Poly1305	AES-256 (configurable)	AES-256 (configurable)
Key exchange	Curve25519	RSA/ECDH	Diffie-Hellman
Audit complexity	Low	Very high	High
Kernel integration	Yes (Linux, Windows)	No (user space)	Partial
Mobile-friendly	Excellent	Poor	Good

Security

WireGuard uses a carefully selected set of state-of-the-art cryptographic primitives:

• Curve25519 for Elliptic-curve Diffie-Hellman key exchange
• ChaCha20-Poly1305 for authenticated symmetric encryption
• BLAKE2s for hashing and keyed hashing
• SipHash24 for hashtable keys
• HKDF for key derivation

These choices aren’t configurable — and that’s by design. Traditional VPN protocols offer dozens of cipher combinations, leading to misconfigurations and downgrade attacks. WireGuard eliminates this class of vulnerability entirely.

If a vulnerability is ever found in any of its cryptographic primitives, a new protocol version is released with updated algorithms. This is called “cryptographic versioning” and is considered best practice by modern security researchers.

Simplicity and Auditability

With only ~4,000 lines of code, WireGuard can be fully audited by a single security researcher in a reasonable timeframe. OpenVPN’s 100,000+ lines make comprehensive auditing practically impossible for small teams.

This simplicity also means:

• Fewer potential bugs
• Smaller attack surface
• Easier to implement correctly on new platforms
• Less maintenance burden

Seamless Reconnection

One of WireGuard’s standout features for mobile users is its handling of network changes. When you switch from Wi-Fi to mobile data (or vice versa), WireGuard recovers the connection almost instantly — often within a single round trip.

This is possible because WireGuard is built around the concept of “roaming” — it doesn’t care about the underlying network path. As long as both endpoints can reach each other, the encrypted tunnel stays alive. There’s no session state to re-negotiate.

How WireGuard Works Under the Hood

WireGuard operates at Layer 3 (the network layer) and creates a virtual network interface (e.g., wg0). Here’s the simplified flow:

1. Key generation: Each peer generates a public/private key pair using Curve25519
2. Configuration: Peers exchange public keys and allowed IP ranges out-of-band
3. Handshake: A 1-RTT (1 Round Trip Time) handshake establishes a shared secret using Noise Protocol Framework
4. Tunnel: All packets sent to the virtual interface are encrypted and sent to the peer’s endpoint via UDP
5. Keepalive: Optional keepalive packets maintain NAT mappings for peers behind firewalls

The handshake happens every 2 minutes to ensure perfect forward secrecy. Even if a key is compromised, only 2 minutes of traffic could theoretically be decrypted.

How Palyfox VPN Uses WireGuard

Palyfox VPN is built entirely on the WireGuard protocol. When you connect:

1. Your device generates a unique Curve25519 key pair — the private key never leaves your device and is stored securely in the system keychain
2. The public key is sent to our server via an encrypted API call
3. The server allocates a unique IP address from its pool and registers your peer configuration
4. A WireGuard tunnel is established — all your internet traffic flows through this encrypted tunnel
5. Your real IP is masked — websites and services see the VPN server’s IP instead of yours

The connection process is automatic, but completion time varies with the device, network, and server conditions.

Our Implementation Choices

• Logging policy: browsing and DNS queries are not recorded — see the privacy policy for exactly what operational data is kept
• Key handling: keys are generated on-device, and the private key is stored in the system keychain rather than in app files
• Platform roadmap: our iOS app uses WireGuard through Apple’s Network Extension framework; macOS, Android, Windows, and Linux apps are coming soon
• Kill switch: the iOS app includes a kill switch that blocks traffic outside the tunnel

Common Questions About WireGuard

Is WireGuard safe for everyday use?

Yes. WireGuard has been formally verified and audited by multiple independent security researchers. It’s been part of the Linux kernel since 2020, meaning it’s reviewed by the same team that maintains the world’s most widely deployed operating system kernel.

Does WireGuard work on all devices?

WireGuard is available on Linux, Windows, macOS, iOS, Android, FreeBSD, and OpenBSD. Palyfox VPN currently provides a native iOS app that handles WireGuard configuration automatically; macOS, Android, Windows, and Linux apps are coming soon.

Can WireGuard be blocked by firewalls?

WireGuard uses UDP and doesn’t have a distinctive traffic fingerprint, making it harder to detect and block than OpenVPN. However, deep packet inspection can still identify it in some cases.

Does WireGuard support IPv6?

Yes, WireGuard fully supports both IPv4 and IPv6 tunneling.

Getting Started

Ready to experience the speed and security of WireGuard? Download Palyfox VPN and connect. Our apps handle all the WireGuard configuration automatically — no technical knowledge required.

If you want to understand more about VPN fundamentals, check out our guide on what a VPN is and how it works, or read about why online privacy matters in today’s digital landscape.