What is WireGuard, and how is it different from IPsec?
Show the answer
Say this first
WireGuard is a small, modern VPN protocol that runs over UDP only. It uses one fixed set of algorithms (Curve25519 for key exchange, ChaCha20-Poly1305 for encryption, BLAKE2s for hashing) instead of negotiating ciphers, and each peer is identified by a public key. A one round trip handshake creates session keys that rotate every two minutes. Configuration is a few lines per peer. It has no built-in user authentication, address assignment or policy engine, which IPsec and SSL VPN products provide around their protocols.
Go deeper
Facts to have ready
- UDP on any port; 51820 is only the convention used in the documentation and examples.
- Overhead: 60 bytes over IPv4 (20 IP, 8 UDP, 32 WireGuard), 80 over IPv6. wg-quick sets the interface MTU to the outgoing link MTU minus 80, so 1420 on a 1500-byte link.
- Silent: it does not answer packets that are not authenticated by a known key, so a port scan sees nothing.
- Roaming: a peer's endpoint is updated to the source address of its latest authenticated packet.
PersistentKeepalive(often 25 seconds) keeps NAT mappings open for peers behind NAT.- In the Linux kernel since 5.6 (2020), with implementations for Windows, macOS, BSD and many routers.
- No cipher negotiation: if an algorithm is broken, the protocol version changes instead.
A minimal peer
[Interface]
Address = 172.16.99.1/30
ListenPort = 51820
PrivateKey = (this host's private key)
[Peer]
PublicKey = (the peer's public key)
Endpoint = 203.0.113.20:51820
AllowedIPs = 172.16.99.2/32, 10.2.0.0/24They will ask next
Can WireGuard be used where FIPS-validated crypto is required?
Usually not: ChaCha20-Poly1305 and BLAKE2s are not FIPS-approved algorithms, so regulated environments tend to stay with IPsec using AES and NIST curves.
How does WireGuard deal with NAT?
It is plain UDP, so NAT works like any UDP flow. The peer behind NAT sends keepalives so the mapping stays open, and the other side learns its current public address and port from the packets it receives.
Traps
- Saying WireGuard negotiates ciphers or runs over TCP. It does neither.