WireGuard

This repository holds the main userspace tooling for using and configuring WireGuard tunnels, chiefly the wg and wg-quick utilities. WireGuard itself encapsulates IP packets over UDP: you add an interface, configure it with your private key and your peers' public keys, then send packets across it.

The design goal is to be as easy to deploy as SSH. A connection is made by exchanging public keys, with no daemons to manage, no connection state to track, and roaming between IP addresses handled transparently. Key distribution and pushed configuration are deliberately out of scope, left to other layers rather than absorbed as IKE and OpenVPN absorbed them.

The choices behind the protocol are conservative and documented.

• Cryptography: the Noise protocol framework with Curve25519, ChaCha20, Poly1305, BLAKE2, SipHash24 and HKDF.
• Small surface: the implementation is meant to be auditable by one person, not a team of specialists.
• Performance: fast primitives inside the Linux kernel suit embedded devices and backbone routers alike.
• Ordinary interfaces: a tunnel appears as a normal network interface, configured with the usual address and route tools.
• Whitepaper: the protocol comes out of a documented academic process, with formal verification alongside.

Building the tools needs nothing beyond a C compiler and a sane libc, and installation honors the usual prefix, destdir and man directory variables, plus switches for bash completion, the wg-quick script and systemd units. Linux, OpenBSD, FreeBSD, macOS, Windows and Android are supported. The contrib directory carries scripts and examples meant as inspiration rather than production tools. It is released under GPLv2.