What is WireGuard VPN and how does it work?

Wireguard is a modern Virtual Private Network (VPN) protocol that enables secure, encrypted con­nec­tions between devices. With a simple codebase and high per­for­mance, it has es­tab­lished itself as a powerful and resource-efficient al­ter­na­tive to older VPN protocols such as IPsec and OpenVPN. In this article, you will learn what sets Wireguard apart, how it works, and how to install this VPN solution on your own system.

What is Wireguard?

Wireguard is an open-source VPN protocol used to establish encrypted tunnels between devices. Data streams are routed through this tunnel and are thus protected from unau­tho­rized access. In addition to focusing on strong en­cryp­tion, Wireguard also offers op­ti­miza­tions for mobile systems and the Internet of Things (IoT). The software is licensed as free software under the GPLv2 license and is available across platforms. Wireguard is written in C and Go and runs on Windows, macOS, BSD, iOS, and Android.

Since 2020, Wireguard has been directly in­te­grat­ed into the Linux kernel. Because Linux runs as the standard operating system on billions of connected devices worldwide, Wireguard can be used almost anywhere. Thanks to its simple con­fig­u­ra­tion and low system load, Wireguard is in­creas­ing­ly being used by VPN services and busi­ness­es.

What features does Wireguard have?

A central feature of Wireguard is the so-called Cryptokey Routing. In this process, the IP address ranges allowed within a tunnel are assigned to a peer’s public key. Incoming packets from a peer are decrypted using the public key. After de­cryp­tion, an incoming packet is delivered only if it orig­i­nates from an IP address that cor­re­sponds to the key. Otherwise, the packet is discarded.

In contrast to older VPN protocols such as IPsec and OpenVPN, Wireguard uses a fixed set of modern cryp­to­graph­ic prim­i­tives without ne­go­ti­a­tion. While es­tab­lished protocols negotiate the cryp­to­graph­ic foun­da­tions during the handshake, Wireguard relies on a fixed, versioned com­bi­na­tion of al­go­rithms. If a cryp­to­graph­ic primitive is deemed insecure in the future, a new version of the protocol will be released that includes an updated and secure algorithm selection.

The protocol uses modern and highly secure en­cryp­tion al­go­rithms, including:

• Noise Protocol Framework for handshake and key exchange processes
• Curve25519 for secure key exchange
• ChaCha20 for symmetric en­cryp­tion
• Poly1305 for au­then­ti­ca­tion
• BLAKE2 for a fast cryp­to­graph­ic hash function
• SipHash24 for gen­er­at­ing cryp­to­graph­i­cal­ly secure hashes
• HKDF for the secure key de­riva­tion process

What are the ad­van­tages of Wireguard?

Wireguard offers many ad­van­tages that make it a preferred choice for modern VPN con­nec­tions. The key benefits at a glance:

• Lean code base: Wireguard has a sig­nif­i­cant­ly smaller code base, with only about 4,000 lines of code compared to OpenVPN or IPsec (around 100,000 to 600,000 lines). This reduction makes the protocol more secure, since bugs are easier to find, and more resource-efficient, since it requires less computing power.
• Higher per­for­mance: Due to its lower com­plex­i­ty, Wireguard delivers higher transfer speeds and lower latency than many competing protocols. This makes it ideal for ap­pli­ca­tions that require a fast and stable con­nec­tion, such as streaming, online gaming, and video con­fer­enc­ing.
• Energy ef­fi­cien­cy: Wireguard is only active when data is actually being trans­mit­ted. This power saving is es­pe­cial­ly ben­e­fi­cial for mobile devices, as it extends battery life.
• Roaming support: Wireguard supports seamless switching between Wi-Fi and mobile networks without losing the con­nec­tion. If the con­nec­tion does drop, it is usually re-es­tab­lished faster than with other VPN protocols.
• Easy con­fig­u­ra­tion: Compared to other VPN protocols, Wireguard does not require manual con­fig­u­ra­tion of a large number of cryp­to­graph­ic options. It uses a fixed, well-defined con­fig­u­ra­tion that is ac­ces­si­ble to both ex­pe­ri­enced users and beginners.

How does Wireguard work?

Wireguard is a de­cen­tral­ized peer-to-peer VPN protocol that does not require a central server. Instead, a tunnel can be es­tab­lished directly between two devices (“peers”). In this case, a “Wireguard server” is simply a device that contains con­fig­u­ra­tion data for multiple peers.

The con­nec­tion setup works similarly to Secure Shell (SSH): Peers generate public and private key pairs, exchange them, and use them for au­then­ti­cat­ing and en­crypt­ing the trans­mit­ted data. The en­cryp­tion is based on modern cryp­to­graph­ic methods that ensure a high level of security.

In addition to creating the cryp­to­graph­ic keys, you need to set network and routing settings on the peers (see our guide below). This includes con­fig­ur­ing the allowed IP address ranges, which are linked to the public keys. Only packets from these IP addresses are accepted.

Data trans­mis­sion runs over the User Datagram Protocol (UDP), which is preferred because of its speed and ef­fi­cien­cy. It does not require extensive error cor­rec­tion like the Trans­mis­sion Control Protocol (TCP), enabling faster transfers.

Con­fig­u­ra­tion is usually done using the Wireguard command-line tool and standard net­work­ing tools. For less ex­pe­ri­enced users, com­mer­cial VPN providers offer user-friendly apps for easy setup.

How to get started with Wireguard

In principle, Wireguard can be installed and con­fig­ured on a Linux system with little effort. On newer Ubuntu versions (from 20.04 LTS), Wireguard is already in­te­grat­ed as a kernel module, so there is no need to install ad­di­tion­al Personal Package Archive (PPA) repos­i­to­ries. Simply run the following command:

sudo apt install wireguard

How to install Wireguard on your own system

In­stalling Wireguard on your own system is simple and can be done with just a few commands.

For Ubuntu 20.04 LTS or newer:

Wireguard is already in­te­grat­ed as a kernel module, so no ad­di­tion­al PPA repos­i­to­ries are required. Simply run the following command:

sudo apt update
sudo apt install wireguard

For older Ubuntu versions:

Here you need to add the Wireguard PPA to perform the in­stal­la­tion:

sudo add-apt-repository ppa:wireguard/wireguard
sudo apt-get update
sudo apt-get install wireguard

Gen­er­at­ing Wireguard keys

As with many other modern VPN protocols, Wireguard is also based on the use of cryp­to­graph­ic keys to establish secure con­nec­tions between peers. Each peer needs a private and a public key pair. The private key always remains secret, while the public key is shared with other peers.

Run the following commands on the command line to generate a private and public Wireguard key:

# Create key directory and set permissions
sudo mkdir -p /etc/wireguard/keys
sudo chmod 700 /etc/wireguard/keys
cd /etc/wireguard/keys
# Set umask so only root can read/write
umask 077
# Generate private key and save it to file
wg genkey | sudo tee privatekey | wg pubkey | sudo tee publickey
# Check the output of the generated keys
sudo cat privatekey
sudo cat publickey

Con­fig­ur­ing network settings for Wireguard

After the cryp­to­graph­ic keys have been generated, certain network and routing settings must be con­fig­ured on each peer. This con­fig­u­ra­tion is crucial to enable secure com­mu­ni­ca­tion between the peers.

Es­sen­tial­ly, a con­fig­u­ra­tion file is created that contains, among other things, the following in­for­ma­tion:

• Private and public keys of the peers
• Allowed IP addresses (the IP ranges the peer is allowed to com­mu­ni­cate with)
• Peer addresses that are as­so­ci­at­ed with the re­spec­tive public keys

An example of the basic con­fig­u­ra­tion of a Wireguard con­nec­tion might look like this:

[Interface]
# Internal VPN IP of the server
Address = 10.0.0.1/24
# Private key (of the server)
PrivateKey = <SERVER_PRIVATE_KEY>
# UDP port where Wireguard accepts connections
ListenPort = 51820
# Client peer
[Peer]
# Public key of the client
PublicKey = <CLIENT_PUBLIC_KEY>
# Internal VPN IP assigned to the client
AllowedIPs = 10.0.0.2/32

Testing the con­nec­tion and ac­ti­vat­ing Wireguard

After Wireguard has been installed and con­fig­ured on your system, it’s time to test the con­nec­tion and activate the network interface. This can be done from the command line by running the following commands:

1. Activate network interface

First, you need to activate the Wireguard interface you just con­fig­ured:

sudo systemctl enable --now wg-quick@wg0

This command activates the Wireguard interface (wg0) that you created earlier. If this command runs suc­cess­ful­ly, the con­nec­tion should be ready to send data.

2. Test the con­nec­tion

To make sure the con­nec­tion is working, you can use the ping command to check whether the remote device is reachable. For example:

ping 192.168.1.2

Replace the IP address with that of the remote peer you are connected to. If the ping is suc­cess­ful, it means the VPN con­nec­tion is working.

3. Trou­bleshoot­ing

If the con­nec­tion is not working as expected, check the following points:

• Make sure the IP addresses are con­fig­ured correctly.
• Check whether the public and private keys have been exchanged correctly.
• Make sure the firewall on both devices is con­fig­ured to allow Wireguard traffic (usually over port 51820).

If problems persist, you can also restart the Wireguard service:

sudo systemctl restart wg-quick@wg0