What a VPN Is and How WireGuard Works

You hear the word VPN in very different contexts. People working from home use it to connect to office systems, people running servers use it to let those servers talk to each other securely, and some install it on their phone to feel safer on a public Wi-Fi network. Behind such different uses lies the same basic idea. And in recent years, among the many ways to build a VPN, one in particular has stood out for its simplicity: WireGuard. It’s worth understanding what a VPN is and why WireGuard has become a reference point.

What a VPN is, in plain terms

VPN stands for Virtual Private Network. Put without jargon, it’s an encrypted tunnel between two points running over a public network like the Internet. Wikipedia’s documentation describes it as a network that “extends a private network across a public network” using encryption and tunneling protocols.

An analogy helps. The Internet is like a crowded room where many messages travel from one side to another, and in principle anyone in the middle can watch them pass. A VPN is like running those messages through a sealed tube: someone watching from outside can tell that something is going through, but can’t read its content. The two key words are exactly these. Encryption: the data is transformed so that only the two ends of the tunnel can decrypt it. Tunnel: the traffic is encapsulated, wrapped in a shell that carries it from one point to the other as if the two ends were on the same local network, even though they’re actually far apart.

What it’s for

The concrete uses of a VPN fall into three families, which Wikipedia lists as typical cases.

Remote access. It lets someone off-site reach the office network securely over the Internet. This is the work-from-home case: you access files, internal applications, and company tools as if you were physically on-site.
Site-to-site connectivity. It joins two separate networks, for example an office and a datacenter, or two servers in different locations that need to exchange data without exposing themselves on the Internet. This is the most common scenario when talking about infrastructure.
Connection privacy. Many commercial services use a VPN to encrypt a user’s traffic and reduce the risk of interception, typically on untrusted networks. It’s worth saying plainly that here the trust shifts to the VPN provider, who still sees the traffic pass through.

The common thread is always the same: connecting two points securely, without having to trust the network in between.

What WireGuard is

Building a VPN requires a protocol, a set of rules that define how the two ends recognize each other, how they encrypt data, and how they route it. For years the most common tools were OpenVPN and IPsec, both solid but also heavy to configure. WireGuard is a more recent project, created by Jason A. Donenfeld, and it comes with a stated goal: to do the same things in a much simpler way.

Its own official page describes it as “an extremely simple yet fast and modern VPN that utilizes state-of-the-art cryptography.” Under the hood, WireGuard encapsulates IP packets inside UDP, one of the Internet’s basic transport protocols. In practical terms, it became part of the Linux kernel with version 5.6, released on 29 March 2020, and it’s also available on Windows, macOS, Android, iOS, and the BSD systems. One detail captures its philosophy well: the documentation says it aims to be “as easy to configure and deploy as SSH.”

Why it has become popular

WireGuard’s success isn’t down to a single flashy feature, but to three underlying choices that, taken together, change the experience of using it.

Simplicity. OpenVPN and IPsec are huge projects, with codebases that are hard to review thoroughly even for teams of experts. WireGuard starts from the opposite idea: few lines of code, meant to be “comprehensively reviewable by single individuals.” Less code means less surface where mistakes can hide and fewer things to configure by hand.

Performance. On Linux systems, WireGuard lives inside the kernel, the core of the operating system, instead of running as a separate program. This avoids constant switching between the two worlds and translates into higher speed, lower latency, and less work for the processor. The official page calls it “considerably more performant than OpenVPN.”

Modern cryptography. WireGuard doesn’t let you pick among dozens of algorithms, as older protocols do. It uses a fixed, up-to-date set based on the Noise protocol framework and primitives like Curve25519, ChaCha20, Poly1305, and BLAKE2. The advantage is subtle but important: where there’s no negotiation over which algorithm to use, there’s also no risk of an attacker forcing it toward a weak choice.

The heart of WireGuard: keys and cryptokey routing

This is the most interesting difference from many traditional systems. WireGuard doesn’t use usernames and passwords, the same key-pair approach behind the cryptographic signatures in Web Bot Auth. Each node on the network has a key pair: a private key, which stays on the machine and never leaves it, and a public key, which is shared with the others. The mechanism is the same as SSH keys: whoever holds my public key can encrypt traffic toward me and verify that it’s really me replying, but can’t impersonate me.

Each party, in WireGuard’s terms, is called a peer: there’s no rigid hierarchy between client and server, just nodes that talk to each other. The glue that holds it all together is what the official documentation calls cryptokey routing: each public key is associated with a list of IP addresses allowed inside the tunnel. This list does two jobs in one. Outbound, it behaves like a routing table: it decides which peer, and with which key, a packet should be encrypted for. Inbound, it behaves like an access control list: it accepts a packet only if it comes from the right peer and from an address that belongs to it.

[Peer]
PublicKey = <the-other-node-public-key>
AllowedIPs = 10.0.0.2/32
Endpoint = other-node.example.net:51820

A few lines say it all: who the other node is (its key), which addresses belong to it, and where to reach it. This link between key and address brings another convenience, roaming: since a peer is identified by its key and not its network address, if it changes connection - say a laptop switching from Wi-Fi to mobile data - the tunnel doesn’t break. WireGuard discovers the new address simply from where the correctly encrypted data arrives.

WireGuard compared to OpenVPN and IPsec

The official page doesn’t dance around it: WireGuard aims to be “faster, simpler, leaner, and more useful than IPsec.” The same idea holds against OpenVPN, with the added benefit of a much smaller codebase that’s therefore easier to review.

This doesn’t mean the older solutions should be thrown away. IPsec is still the most widespread standard for getting network devices from different vendors to talk to each other, and OpenVPN can cross hostile firewalls by passing itself off as ordinary web traffic. They’re mature tools with years of experience behind them. WireGuard’s point is a different one: for the common case of securely connecting systems you control, it delivers the same result with less code, less configuration, and fewer ways to get it wrong.

In short

A VPN is an encrypted tunnel between two points running over the Internet, and it exists to connect them securely: remote access, site-to-site links, or connection protection. WireGuard is a recent way to build one, popular because it combines three things that are hard to have all at once: simplicity, performance, and modern cryptography. Instead of passwords it uses key pairs like SSH, and it ties each key to the addresses allowed in the tunnel. It doesn’t make IPsec and OpenVPN obsolete, but for many scenarios it’s now the most direct path.

# What a VPN Is and How WireGuard Works