VPN with WireGuard – Integrating the Cutting Edge in Open-Source Technology

WireGuard, an open-source VPN tool, is enjoying a great deal of hype at present. According to its developer, the idea behind the software is to make connecting to virtual private networks (VPNs) as simple as possible. This means that it will not only be faster and more useful than IPSec and others, but also easier to configure.

This opens the door to a variety of different applications for the program. For example, WireGuard can allow employees to remotely and quickly connect to their company's intranet. Backbone Router also allows for connections to be established anywhere, without special infrastructure or certificates.

This article provides a detailed look into how WireGuard operates, and highlights what you should pay attention to when installing and configuring it for use. Additionally, we also summarize the most important advantages and disadvantages of the open-source software.

WireGuard is based on a relatively new technology developed by Jason A. Donenfeld that enables the establishment of secure VPN networks, and is an alternative to well-known solutions like IPSec, SSTP, or OpenVPN. This can be seen as a mix between a VPN protocol and VPN software, which is not only easy-to-configure, but also capable of establishing fast connections and stable VPN tunneling (even on mobile clients).

WireGuard performs well on the network level (Layer 3) of the open systems interconnection (OSI) model, supporting IPv4 and IPv6. Although the software is based on peer-to-peer architecture, it can also simulate client-server architecture. The VPN connection (similarly to the secure shell protocol, or SSH) is implemented by exchanging publicly-available keys.

Since it is open-source, WireGuard remains, at least in part, in a developmental stage, however, it is available for a variety of platforms (such as Linux distributions, Android, and iOS). On Linux systems, the code is executed as a module in the kernel.

WireGuard fulfills the role of a network adapter, adding one or multiple network interfaces that can be configured analogue to wlan0 or eth0 (i.e. with ipconfig or route). The application is limited to the most necessary features, in a conscious step by the developer to keep it as simple as possible. The program's code is comprised of a mere 4,000 lines of code, making it easy to read and understand.

To compare: IPSec or OpenVPN entail several hundred thousand lines of code.

As a result, WireGuard offers fewer configuration possibilities, but can also be checked more easily, an important feature for security-critical applications.  

WireGuard's VPN solution uses three basic cipher functions to encrypt connections:

• Curve25519 with the Elliptic Curve Diffie-Hellman (ECDHE) protocol for handshake encryption (key exchange)
• BLAKE2s for universal hashing (for example, to generate HMAC codes or key derivations with HKDF)
• ChaCha20 and Poly1305 for symmetric encryption and data exchange

The underlying principle is both simple and effective: Each participant receives a public VPN key, through which they can be identified. Ed25519 is used as the protocol for public key authentication.

WireGuard's high security and encryption standards are based off of modern crypto-algorithms. Using "cryptokey routing", servers and clients each receive static IP addresses which are stored in the server's configuration data. When establishing a connection, this is compared to the public key, and only when they match, does the process continue.

The main advantage of WireGuard is its easy usability. Apart from that, it also offers a number of other benefits:

If you are planning to use WireGuard, you should be aware that it is an unfinished program, and somewhat under-developed, particularly in terms of functionality. Alongside with its numerous advantages, WireGuard also has some significant disadvantages:

Most VPN providers are currently experimenting with the incorporation of WireGuard into their clients. Some have already made WireGuard available to their customers, a list of which can be found below: