WireGuard is an open-source VPN protocol comparable to OpenVPN, IKEv2, or IPSec with some key differences which have led the creator and lead maintainer of Linux, Linus Torvalds, to praise the technology as a “work of art.” That’s high praise from Torvalds, who is known to have a blunt streak when it comes to assessing open-source code proposed to be merged with the Linux kernel.

On desktop & server distributions of Linux, WireGuard is built into the heart of the operating system as a kernel module, meaning it has a much lower memory overhead compared to conventional VPN protocols like OpenVPN, which run in user space. WireGuard also boasts other desirable security & performance characteristics. The protocol can maintain a connection even as a user roams between Wi-Fi access points and cellular networks – preventing irritating and security-compromising disconnects.

WireGuard servers are stealthy by design; they do not respond to unsolicited packets unless the client presents the server’s public key. This makes it more difficult for adversaries to probe an endpoint to determine if it is running WireGuard. Furthermore, WireGuard is a “quiet” protocol that aims to minimize the bandwidth overhead (e.g. keep-alive packets, symmetric key rotation) required to maintain a secure state when the tunnel is not transmitting data.

This is the web page for the experimental early release of the TunSafe WireGuard Client for OSX. Warning: This is pre-release software. Use at your own risk. In order to use TunSafe you need an account with a VPN provider that supports the WireGuard protocol. You can read more about TunSafe in our User Guide.

At just 3,900 lines of code, WireGuard leverages much more modern cryptographic ciphers compared to old-guard protocols like OpenVPN, which weighs in at 30 times the number of lines of code. This simplicity makes WireGuard much quicker for a cryptographic expert to audit, as well as for the open-source community to identify & correct security weaknesses.

The benefits stemming from the design of WireGuard are not just theoretical. Have you ever been tempted to use a public Wi-Fi network without a VPN to conserve your battery life or avoid slowing down a sluggish connection further? With WireGuard, you will no longer have to make these compromises so you can protect your privacy & security every time.

Setting up a new WireGuard connection is similar to generating & authorizing an SSH key to connect to a Linux server, a routine activity any sysadmin is accustomed to. The WireGuard command, wg, is used to generate a base64-encoded 256-bit public and private key pair for each peer connected to a WireGuard tunnel. The public keys identifying each peer, as well as the connection parameters are exchanged out-of-band prior to establishing a VPN session.

Like any new technology, there are of course, drawbacks that don’t make WireGuard the right tool for every situation. The WireGuard protocol does not have the capability to assign unique IPs to each peer through DHCP. Therefore, address allocations must be managed manually to avoid any IP conflicts. Also, WireGuard supports UDP only, not TCP — Although UDP is usually recommended for VPNs based on performance considerations, TCP VPNs may facilitate more reliable data transfers over slow or unstable connections.

WireGuard is a more recent entry into the world of VPN encryption protocols and is just beginning to gain more traction in the cybersecurity sphere. Mac, iOS and Android.
The WireGuard macOS app is unavailable for older operating systems. Please update your operating system if you can. If you are on a macOS High Sierra (10.13) or earlier, then you can still use WireGuard via their userspace drivers via the process detailed below.

Also, another problem that is particularly troubling for commercial VPN operators is how WireGuard must keep a record of each peer’s connection IP address to negotiate a connection. Many users turn to paid VPN services for enhanced privacy & anonymity, so logging their unmasked IP address is a non-starter for all the companies swearing by their “no logging” policies.

AzireVPN, a Swedish VPN provider among the first to provide a paid VPN service incorporating WireGuard, asked the creator of WireGuard himself to develop them a rootkit module that makes it non-trivial for the operators to observe the client’s’ unprotected IP addresses. This protects the operator from being coerced by any authority to give up server logs that may correlate a VPN user with their real-life identity (through their payment method). If other VPN companies wish to adopt WireGuard, they will likely have to adopt similar mitigations to prevent compromising their users’ privacy.

For site-to-site VPNs and road warriors accessing their corporate network though, WireGuard might be exactly what the doctor ordered. With these applications, anonymity is not the goal, but securing the data travelling through the tunnel using encryption is. Although WireGuard is still pending a security audit and considered experimental for mission-critical applications, it has already been formally verified by some cryptographers.

No security software is guaranteed to be “bug free”, as evidenced by the “replay attack” vulnerability recently revealed in the Cisco AnyConnect, F5 Edge Client, and Palo Alto Networks GlobalProtect VPN clients by the US Department of Homeland Security CERT. Gaping security holes can go unnoticed for a long time in proprietary software, or worse, deliberately introduced by governments & intelligence agencies to eavesdrop on their users. The WireGuard protocol is 100% open source, as are the Linux, Mac OS, Android, and iOS clients. Currently, the Windows client TUNSafe is developed by a third-party developer and parts of it remain closed source, so users download it at their own risk.

If you want to try WireGuard before it is more broadly deployed, you can create your own WireGuard VPN for surfing, using an inexpensive virtual server with a cloud provider such as Linode. The plan starting from $5/mo with 1 CPU and 1GB RAM is sufficient for several connected devices. Any other cloud provider supporting full/paravirtualization, IPv4 forwarding, and custom kernel modules is supported, but going with Linode is significantly less expensive than using AWS for anything more than an experiment. Even Linode’s most inexpensive plan includes at least 1TB outbound bandwidth, whereas AWS charges $0.10/GB after the first 15GB (for the first year, on the free tier).

For this tutorial, we use a CentOS 7 image to install and configure a WireGuard server, then connect a Linux, Mac, Android, and iOS client (Windows coming soon).

Spin up a virtual server on Linode.

Use this link to sign up for an account on Linode if you would like to support us. It costs you nothing additional. To establish your account on Linode, click the link in the verification email and link your payment information.

Then, click “Linodes” on the left sidebar of the Linde Manager to begin deploying your WireGuard instance.

Choose a Distribution: CentOS 7
Region: Choose the data center closest to your physical location.
Linode Plan: Nanode tab > Nanode 1GB
Linode Label: wireguard
SSH Keys: Add your SSH RSA public key.
If you skip this step, you can set a root password to administer the server (less secure).

Add the WireGuard YUM repo.

Connect to the server by SSH as root and do an initial yum update.

yum update

Next, add the WireGuard YUM repo to the server and install the packages.

sudo curl -Lo /etc/yum.repos.d/wireguard.repo https://copr.fedorainfracloud.org/coprs/jdoss/wireguard/repo/epel-7/jdoss-wireguard-epel-7.repo

yum install epel-release

yum install wireguard

Wireguard Mac Download