Wireguard

WireGuard is an open-source VPN protocol and implementation that creates encrypted network tunnels using UDP. It operates as a network interface at the kernel level, associating public keys with allowed IP addresses through a mechanism called Cryptokey Routing. How it works: - WireGuard adds a virtual network interface (e.g., wg0) to the system, which is configured using standard networking tools alongside the wg(8) utility - Each peer is identified by a public/private key pair, similar to SSH key exchange - IP packets are encrypted and encapsulated over UDP before transmission - The Cryptokey Routing Table maps public keys to lists of allowed IP addresses, functioning as both a routing table (for outbound traffic) and an access control list (for inbound traffic) Key technical characteristics: - Uses modern cryptographic primitives for encryption and authentication - Provides perfect forward secrecy - Supports built-in roaming, allowing peers to change IP addresses without dropping the tunnel - Runs inside the Linux kernel for high throughput, with cross-platform support for Windows, macOS, BSD, iOS, and Android - Minimal codebase designed to be auditable by a single individual, reducing attack surface compared to IPsec or OpenVPN - Supports both IPv4 and IPv6, including encapsulation of one within the other - No connection state management or daemon configuration required beyond key exchange - Suitable for embedded devices, smartphones, and high-capacity routers alike Configuration is done via simple text-based config files specifying private keys, listen ports, peer public keys, and allowed IP ranges. Key distribution is handled out-of-band.