WireGuard is a modern virtual private network (VPN) protocol that enables secure, encrypted connections between devices. With a simple, high-performance code base, it has established itself as a powerful and resource-efficient alternative to older VPN protocols like IPsec and OpenVPN. In this article you learn what sets WireGuard apart from other VPN protocols, how it works and how to install this WireGuard VPN solution on your own system.
What is WireGuard?
WireGuard is an open source VPN protocol used to establish encrypted tunnels between devices. Data flows are routed through this tunnel and are thus protected against unauthorized access over the Internet. In addition to robust encryption, the protocol also offers optimizations for mobile systems and the Internet of Things (IoT). The software is published under the free GPLv2 license and is available on several platforms. WireGuard is written in C and Golang and runs on Windows, macOS, BSD, iOS and Android.
Since 2020, it is directly integrated into the Linux kernel. As Linux is widely used on billions of connected devices around the world, the protocol can be used virtually anywhere. Thanks to its simple configuration and low system load, it is increasingly used by VPN services and businesses.
What features does WireGuard offer?
A central feature of WireGuard is the Cryptokey Routing. In this method, the IP address ranges allowed within a tunnel are associated with the public key of a connection partner. Incoming packets from a partner are decrypted using its public key. An incoming packet is only delivered after decryption if it comes from an IP address matching the key. Otherwise, the packet is discarded.
Unlike older VPN protocols like IPsec and OpenVPN, WireGuard relies on a fixed set of modern encryption primitives, with no negotiation. While traditional protocols define encryption parameters during the handshake, the protocol relies on a combination of algorithms predefined and versioned. If any of these encryption algorithms are found to be outdated or vulnerable in the future, a new version of the protocol is released with updated algorithms, ensuring a high level of security for a WireGuard VPN.
The protocol uses encryption algorithms modern and highly secure, including:
- Noise Protocol Framework for handshake and key exchange processes
- Curve25519 for secure key exchange
- ChaCha20 for symmetric encryption
- Poly1305 for authentication
- BLAKE2 for a fast and secure hashing function
- SipHash24 for generating secure hashes
- HKDF for a secure key derivation process
What are the benefits of WireGuard?
WireGuard offers many benefits that make it a preferred choice for modern VPN connections. Overview of the main advantages:
- Lightweight code base: with only around 4,000 lines of code, the protocol has a significantly smaller code base than OpenVPN or IPsec (around 100,000 to 600,000 lines). This reduction makes the protocol more secure, because bugs are easier to detect, and more resource efficient, since it requires less computing power.
- Superior performance: Thanks to reduced complexity, WireGuard offers higher transfer speed and lower latency than many competing protocols. This makes it ideal for applications requiring a fast and stable connection, such as streaming, online gaming and video conferencing.
- Energy efficiency: WireGuard is only active when there is actually data to transmit. This power saving is particularly beneficial for mobile devices, as it extends battery life.
- Roaming support: WireGuard supports seamless transition between Wi-Fi and mobile networks without connection loss. And if the connection is still interrupted, reconnection is generally faster than with other VPN protocols.
- Simple setup: Compared to other VPN protocols, WireGuard does not require manual setting of a multitude of encryption options. It uses a predefined configuration, accessible to both experienced users and beginners.
WireGuard is a decentralized Peer-to-Peer VPN protocol, which does not rely on a mandatory central server. Instead, a tunnel can be established directly between two devices (“peers”). A WireGuard server is, in this case, simply a device that contains configuration data for multiple peers.
Connection establishment works similar to Secure Shell (SSH): peers generate public and private key pairs, exchange them, and use them for authentication and encryption of transmitted data. The encryption is based on modern encryption methods that guarantee a high level of security.
In addition to creating encryption keys, it is necessary to define on the peers network and routing settings (see our tutorial below). This includes configuring allowed IP address ranges, which are associated with public keys. Only packets from these IP addresses are accepted.
Data is sent via the User Datagram Protocol (UDP), favored for its speed and efficiency. It does not require extensive error correction like Transmission Control Protocol (TCP), which allows for faster transmission.
Configuration is usually done via theWireGuard command line tool and common network tools. For less experienced users, commercial VPN services offer user-friendly apps for easy setup.
In principle, WireGuard can be installed and configured with little effort on a Linux system. On the newer versions of Ubuntu (from 20.04 LTS)the protocol is already integrated as a kernel module, which avoids the additional installation of Personal Package Archive (PPA) repositories. Simply run the following command:
sudo apt install wireguardbash
Installing WireGuard on your own system is simple and can be done with a few commands.
For Ubuntu 20.04 LTS or later:
The protocol is already integrated as a kernel module, so no additional PPA repositories are needed. Simply run the following command:
sudo apt update
sudo apt install wireguardbash
For older versions of Ubuntu:
Here you need to add the WireGuard PPA to proceed with the installation:
sudo add-apt-repository ppa:wireguard/wireguard
sudo apt update
sudo apt install wireguardbash
Generate WireGuard keys
Like many other modern VPN protocols, WireGuard relies on the use of keys to create secure peer-to-peer connections. Each peer needs a private and public key pair. The private key always remains secret, while the public key is shared with other peers.
Run the following commands in the command line to generate a private key and a WireGuard public key :
# Créer le répertoire des clés et définir les permissions
sudo mkdir -p /etc/wireguard/keys
sudo chmod 700 /etc/wireguard/keys
cd /etc/wireguard/keys
# Définir umask pour que seul root puisse lire/écrire
umask 077
# Générer la clé privée et l’enregistrer dans un fichier
wg genkey | tee privatekey | wg pubkey > publickey
# Vérifier l’affichage des clés générées
sudo cat privatekey
sudo cat publickeybash
Note
Keys must be created and stored in a secure environment. The above commands are suitable for testing purposes. In a production environment, additional security measures must be put in place, such as the use of secure directories and access controls.
Configure network settings
Once the keys are generated, some network and routing configurations must be performed on each peer. This configuration is essential to enable secure communication between peers.
Essentially, a configuration file is created, which contains the following information:
- Private and public keys peers
- Allowed IP addresses (the IP ranges with which the peer is allowed to communicate)
- Peer addressesassociated with the respective public keys
An example basic configuration of a WireGuard connection might look like this:
[Interface]
# IP VPN interne du serveur
Address = 10.0.0.1/24
# Clé privée (du serveur)
PrivateKey =
# Port UDP sur lequel WireGuard accepte les connexions
ListenPort = 51820
# Pair client
[Peer]
# Clé publique du client
PublicKey =
# IP VPN interne attribuée au client
AllowedIPs = 10.0.0.2/32 txt
Test the connection and enable WireGuard
Once the protocol is installed and configured on your system, it is time to test the connection and enable the network interface. This can be done via the command line by running the following commands:
1. Enable network interface
You must first activate the WireGuard interface that you have just configured:
sudo systemctl enable --now wg-quick@wg0bash
This command activates the WireGuard interface (wg0) that you created before. If this command runs successfully, the connection should be ready to send data.
2. Test the connection
To make sure the connection works, you can use the ping command to check if the remote device can be reached. Example :
Change the IP address to that of the remote peer you are connected to. If the ping is successful, the VPN connection is working.
3. Troubleshooting
If the connection does not work as expected, check the following:
- Make sure the IP addresses are configured correctly.
- Verify that the public and private keys were correctly exchanged.
- Make sure the firewall is configured on both devices to allow WireGuard traffic (usually through port 51820).
If the problems persist, you can also restart the WireGuard service :
sudo systemctl restart wg-quick@wg0bash
