WireGuard VPN Protocol

WireGuard cryptographic design, configuration, kernel integration, Kubernetes use (Cilium/Flannel encryption), and comparison with IPSec and OpenVPN.

Overview

Overview WireGuard is a modern, cryptographically opinionated VPN protocol built into the Linux kernel (5.6+). It is designed to be simpler, faster, and more secure than IPSec or OpenVPN.

Cryptographic design (no negotiation): WireGuard does not negotiate algorithms. It uses a fixed modern suite: X25519 for key exchange, ChaCha20-Poly1305 for encryption/authentication, and BLAKE2s for hashing. No cipher suites, no downgrade attacks.

Peers and allowed IPs: WireGuard is connectionless — there are no sessions. Each peer is identified by its public key and configured with AllowedIPs (the IP ranges it routes to/from). When a packet arrives, WireGuard looks up the source IP in the AllowedIPs of known peers and validates the packet signature. Invalid packets are dropped silently.

Roaming / stealth: WireGuard endpoints do not respond to unauthenticated packets. A WireGuard server is invisible to port scanners — no response to probes without a valid handshake. The client always initiates.

Kernel implementation: the userspace implementation is wg-quick; the kernel module handles all crypto in kernel space (or hardware offload). The entire implementation is ~4,000 lines of code (vs OpenVPN's ~70,000 or StrongSwan IPSec's ~300,000).

Kubernetes use: Cilium and Flannel both support WireGuard for transparent pod-to-pod encryption. Cilium activates WireGuard per-node with --enable-wireguard. All inter-node pod traffic is encrypted without application changes. Tailscale uses WireGuard as its underlying protocol.

Key concepts

AllowedIPs
Per-peer IP ranges that WireGuard routes through that peer. Acts as both the routing table and access control — packets from a peer must have source IPs within its AllowedIPs.
Cryptographic key routing
WireGuard matches incoming packets to peers by public key + source IP. No session state, no connection setup — stateless design makes it resilient to roaming.
ChaCha20-Poly1305
The WireGuard AEAD cipher. Faster than AES-GCM on CPUs without AES-NI (ARM, older x86). Provides both encryption and authentication in one pass.
Silent drop
WireGuard drops unauthenticated packets without responding. A port scan of a WireGuard endpoint returns nothing — the server appears offline to non-peers.
wg-quick
Userspace configuration tool for WireGuard. Manages /etc/wireguard/*.conf files, brings up wg0 interfaces, and configures AllowedIPs routing.

When to use it

  • Selecting a VPN protocol for cloud-to-on-premises connectivity
  • Explaining why Cilium WireGuard encryption adds less overhead than IPSec
  • Configuring site-to-site VPN between two cloud VPCs
  • Justifying WireGuard over OpenVPN for Kubernetes pod encryption

Interview questions

  • How does WireGuard differ from IPSec and OpenVPN in design philosophy?

Sign up free to read the full topic

More Networking topics

Start free on Cariara · Coding problems · System design studio