What is WireGuard?

What it is

A protocol is the agreed set of rules two ends use to talk. WireGuard's rules are deliberately simple, and the software is small enough for people to read and review, which makes mistakes easier to find. It is built into the Linux kernel and is also available on other systems, including Windows, macOS, iPhone and Android.

Each end holds a pair of keys, and a device is allowed in by listing its public key. Many products are built on WireGuard, so you may already use it without knowing. For the wider idea, see VPN.

Why it matters to a business

• Speed: the design is light, so tunnels come up quickly and use little processing power on laptops, phones and firewalls.
• Simplicity: fewer options mean fewer ways to misconfigure a tunnel.
• Open source: the protocol can be inspected by anyone and carries no per-user license.
• Key handling: plain WireGuard has no sign-in or user directory. Keys must be created and tracked by hand, which gets harder as staff grow, and that gap is why services such as Tailscale exist.

How this shows up in our work

Staff remote access runs through Tailscale, which uses WireGuard underneath, with multi-factor sign-in on top. Site-to-site VPN between offices is built on OPNsense firewalls, and camera systems are viewed through VPN instead of open ports.

Because WireGuard is built into the Linux kernel, the Linux servers we manage can run it without third-party drivers.

Learn more

• WireGuard on WikipediaA neutral summary of the protocol, its history and design, useful for a quick overview.
• WireGuard project siteThe official home of the protocol, with its technical description and install guides for technical readers.