AnyProxy

Get Pro
Glossary · VPN & tunneling

WireGuard

Also calledwireguard protocolwg vpn
Definition

WireGuard is an open-source VPN protocol that encrypts traffic with a small, fixed set of modern algorithms and runs only over UDP.

Explanation

In depth

WireGuard was designed by Jason Donenfeld and merged into the Linux kernel in version 5.6 in 2020; it now also runs on Windows, macOS, iOS and Android, and most commercial VPN apps offer it. Its design goal is simplicity. Instead of letting each side negotiate ciphers, it uses one fixed suite (Curve25519 for key exchange, ChaCha20-Poly1305 for encryption, BLAKE2s for hashing). Peers are identified by public keys, much like SSH keys, and the whitepaper describes an implementation of roughly 4,000 lines - small enough to audit. In practice this makes connections quick to set up and fast on phones. The project is explicit about its limits. Its own Known Limitations page says WireGuard 'does not focus on obfuscation' and leaves that to other layers, so deep packet inspection can recognise it. It also refuses to run over TCP, which means networks that block or throttle UDP stop it entirely. Where those filters exist, people wrap WireGuard in another transport or pick a TCP-capable option. None of this applies to a web proxy, which uses ordinary HTTPS from the browser.

In practice

WireGuard in the real world

WireGuard was merged into the Linux kernel in version 5.6 in March 2020. Its whitepaper describes a codebase of around 4,000 lines — small enough to audit — built on fixed modern cryptography such as Curve25519 and ChaCha20-Poly1305. It runs only over UDP, by default on port 51820, which makes it fast but also easy to spot and block on networks that filter or throttle UDP.

Sources: WireGuard whitepaper · WireGuard - Known limitations

Questions about WireGuard

Why does WireGuard not work on some networks?
It uses only UDP. Networks that block or heavily throttle UDP - some offices, hotels and national filters - stop it, while TCP-based options still get through.
Is WireGuard more secure than OpenVPN?
Both are considered secure. WireGuard's advantage is a much smaller codebase and fixed, modern cryptography with fewer settings to get wrong.
Can WireGuard run over TCP port 443?
Not by itself. The project deliberately avoids TCP because tunnelling TCP inside TCP performs badly. Third-party wrappers exist, but then you depend on that extra layer.

Related terms

VPNA VPN (virtual private network) is software that sends all of a device's network traffic through an encrypted connection to a provider's server, which then contacts websites on the device's behalf.OpenVPNOpenVPN is an open-source VPN protocol and program, first released in 2001, that builds its encrypted tunnel with TLS and can run over either UDP or TCP.IKEv2IKEv2 (Internet Key Exchange version 2) is the standard protocol that sets up IPsec VPN connections; it is valued on phones because it can keep a VPN alive when the network changes.VPN tunnelA VPN tunnel is the encrypted link between a device and a VPN server, made by wrapping each original packet inside a new packet addressed to the server.

Put the concept to work

Try AnyProxy free — no install, no signup, six regions.

Open a blocked page