WireGuard is a VPN protocol and implementation that creates encrypted tunnels over UDP. It is intentionally small, with a code base far smaller than IPsec or OpenVPN, and uses a fixed set of modern cryptographic primitives rather than negotiating options.
Why it matters
Fewer choices mean fewer ways to misconfigure it and less code to audit. Peers are identified by public keys, similar to SSH keys, and each peer lists the IP ranges it is allowed to send from (AllowedIPs), which also acts as a routing table. It is built into the Linux kernel and has clients for other platforms, and it reconnects quickly when a device changes networks. It does not hand out addresses or manage users by itself, so large deployments add tooling around it.
Example
[Interface]
PrivateKey = <client-private-key>
Address = 10.8.0.2/32
[Peer]
PublicKey = <server-public-key>
Endpoint = vpn.example.com:51820
AllowedIPs = 0.0.0.0/0AllowedIPs = 0.0.0.0/0 sends all traffic through the tunnel; a narrower range sends only that subnet.
Common mistakes
- Sharing one key pair between several devices.
- Forgetting keepalives behind NAT, so the tunnel goes silent.
- Expecting it to hide the server's UDP port from blocking networks.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.