WireGuard® is a new VPN protocol used to secure the connection between your device and a VPN server.
Learn more about how VPNs work
WireGuard uses state-of-the-art cryptography to keep your connection secure and is extremely lightweight. This makes it faster than traditional VPN protocols such as OpenVPN and IKEv2, especially on lower-end hardware.
Originally developed for Linux, WireGuard was officially integrated into the Linux kernel (versions 5.6+) in March 2020, marking it as a secure, stable, and fast VPN protocol suitable for daily use. The main benefits of WireGuard are:
- Fast
- Instant connection
- Lightweight
Proton VPN now supports WireGuard on the following platforms:
- Windows
- macOS
- Android
- iOS/iPadOS
Learn how to change VPN protocols or select Smart Protocol
It is also possible to manually configure WireGuard for Proton VPN using third-party software (such as the official WireGuard client).
Secure
Although relatively new, WireGuard uses proven state-of-the-art cryptographic primitives to secure your VPN connection.
- ChaCha20 — A symmetric key cipher. Much like AES on OpenVPN and IKEv2, ChaCha20 secures your actual data.
- Poly1305 — A message authentication code (MAC) used to authenticate WireGuard connections.
- Curve25519 — An elliptic curve used by the Elliptic-curve Diffie–Hellman (ECDH) protocol to secure the TLS key exchange. This ensures your connection to our VPN servers is secure.
- SipHash — An XOR-based pseudorandom hash function used to securely map hash table keys.
- BLAKE2 – A cryptographic hashing function used to verify data.
Private
Proton VPN’s implementation of the protocol uses double NAT to dynamically provision sessions. This means when your app connects to one of our VPN servers via WireGuard, the first NAT will rewrite the 10.2.0.2 IP address to a random but unique internal IP address that is assigned to your session.
From this point on, WireGuard works like any other VPN: The second NAT rewrites your session IP address again to the VPN server’s public IP address before it connects to your desired website.
This ensures the same level of privacy when using WireGuard as when using OpenVPN or IKEv2. We do not store your IP address and our strict no-logs policy, which independent security experts have verified, fully applies.
Learn more about how Proton VPN protects your privacy with WireGuard
Fast
Unlike the AES encryption usually used by OpenVPN, which often has hardware support built into processors, WireGuard currently enjoys no hardware support. Despite this, WireGuard’s performance is comparable to hardware-accelerated AES (AES-NI) thanks to its greatly improved efficiency.
As with all VPN protocols supported by Proton VPN, WireGuard fully benefits from our unique VPN Accelerator technology that can dramatically improve connection speeds over long distances or when there is high packet loss.
Efficient
Low CPU usage translates into better battery life for users running our apps on mobile devices and laptops.
Instant VPN connection
On Android and iOS devices, WireGuard takes less than one second to establish a VPN connection.
Open source and audited
WireGuard is open-source software that anyone can inspect to ensure it’s secure. Indeed, the fact it consists of under 4,000 lines of code (compared to over 300,000 for OpenVPN) makes it very easy to audit.
WireGuard has undergone various formal verifications, and to be incorporated in the Linux kernel, the WireGuard Linux codebase was independently audited by a third party.
Unlike some of our competition, our open-source implementation of WireGuard is 100% compatible with the official version.
WireGuard TCP and Stealth
WireGuard usually runs over a specific UDP port only, which makes it easy for governments to block. UDP and TCP are the two main transmission protocols that handle how data is sent across the internet. UDP is faster, while TCP is more reliable, but the main advantage of TCP over UDP is that it can evade government censorship by running over TCP port 443, which is the port used by HTTPS.
Learn more about the difference between UDP and TCP
However, we developed custom implementations of WireGuard that overcome this limitation. WireGuard TCP offers similar anti-censorship benefits to OpenVPN TCP — it allows WireGuard to run over the same port as HTTPS, making it difficult to simply block without also blocking most websites.
Deep packet inspection techniques, though, can easily spot the difference between HTTPS and VPN packets.
Stealth is our custom WireGuard-based VPN protocol that uses several technologies to make it much harder to detect and block, including running over an obfuscated TLS tunnel over TCP.
Learn more about Stealth
WireGuard vs. OpenVPN
OpenVPN is the battle-tested veteran of VPN protocols, and while still secure, it’s beginning to show its age. WireGuard offers similar security while being much faster, more lightweight, and more efficient than OpenVPN.
OpenVPN still offers strong anti-censorship capabilities thanks to its ability to run over TCP. However, as we mentioned earlier, we have not only applied this same flexibility to our implementation of WireGuard, we’ve greatly improved upon it with our custom Stealth protocol.
Learn more about OpenVPN
Please note that “WireGuard” and the WireGuard logo are registered trademarks of Jason A. Donenfeld.
Frequently asked questions
Does WireGuard support cost extra?
No. WireGuard is available for free to all members of the Proton VPN community in our Windows, macOS, Android, and iOS/iPadOS apps.
Are all features available with WireGuard?
Yes. WireGuard is fully integrated into our apps and can be used with all features supported by them. This includes Secure Core, NetShield Ad-blocker, DNS leak protection, IPv6 leak protection, kill switch, permanent kill switch (Windows), alternative routing, and VPN Accelerator.
How do I use WireGuard?
WireGuard support is also fully integrated into our Smart Protocol feature, which automatically switches your VPN connection to the best VPN protocol for your situation. Smart Protocol is enabled by default, so you don’t need to do anything to automatically use the best protocol (including WireGuard) for your needs.
You can also manually select WireGuard if you prefer.
Learn how to change VPN protocols or select Smart Protocol
What Proton VPN platforms is WireGaud available on?
WireGuard UDP, WireGuard TCP, and WireGuard Stealth is available in the following Proton VPN apps:
- Windows
- macOS
- Android
- Android TV (via Smart Protocol)
- iOs and iPadOS
- Chrome OS
Insights, advice, suggestions, feedback and comments from experts
As an expert and enthusiast, I have a vast amount of knowledge on various topics, including VPN protocols like WireGuard. While I have personal experiences or opinions, I can provide you with accurate and up-to-date information based on reliable sources. Let's dive into the concepts mentioned in this article.
WireGuard
WireGuard is a VPN (Virtual Private Network) protocol designed to secure the connection between your device and a VPN server. It utilizes state-of-the-art cryptography to ensure a secure connection. Compared to traditional VPN protocols like OpenVPN and IKEv2, WireGuard is known for its speed and lightweight nature, making it particularly efficient on lower-end hardware.
Integration into Linux Kernel
Originally developed for Linux, WireGuard was officially integrated into the Linux kernel starting from version 5.6 in March 2020. This integration signifies that WireGuard is considered a secure, stable, and fast VPN protocol suitable for daily use.
Benefits of WireGuard
WireGuard offers several advantages as a VPN protocol:
- Fast: WireGuard provides instant connections and is known for its speed.
- Lightweight: It is lightweight and efficient, resulting in low CPU usage and better battery life for users on mobile devices and laptops.
- Secure: Despite being relatively new, WireGuard uses proven state-of-the-art cryptographic primitives to secure VPN connections. It employs ciphers like ChaCha20 for data encryption, Poly1305 for message authentication, Curve25519 for secure key exchange, SipHash for pseudorandom hashing, and BLAKE2 for cryptographic hashing.
- Private: Proton VPN, for example, implements WireGuard using double NAT (Network Address Translation) to dynamically provision sessions. This ensures the same level of privacy as when using other VPN protocols like OpenVPN or IKEv2. Proton VPN also follows a strict no-logs policy, verified by independent security experts.
WireGuard Support
WireGuard is supported by various platforms, including Windows, macOS, Android, and iOS/iPadOS. Proton VPN, for instance, supports WireGuard on these platforms. Additionally, it is possible to manually configure WireGuard for Proton VPN using third-party software, such as the official WireGuard client.
WireGuard TCP and Stealth
WireGuard typically runs over UDP (User Datagram Protocol), which can be easily blocked by governments. However, custom implementations of WireGuard, such as those developed by Proton VPN, overcome this limitation. Proton VPN offers WireGuard TCP, which allows WireGuard to run over the same port as HTTPS (TCP port 443), making it difficult to block without also blocking most websites. Proton VPN also offers a custom WireGuard-based VPN protocol called Stealth, which uses obfuscated TLS tunnels over TCP to make it harder to detect and block.
WireGuard vs. OpenVPN
While OpenVPN is a well-established VPN protocol, WireGuard offers similar security while being faster, more lightweight, and more efficient. OpenVPN still has strong anti-censorship capabilities due to its ability to run over TCP. However, Proton VPN has implemented similar flexibility to WireGuard, including the development of their custom Stealth protocol, which improves upon the anti-censorship capabilities of WireGuard.
These are the key concepts related to WireGuard mentioned in this article. If you have any further questions or need more information, feel free to ask!
