The modern VPN protocol
WireGuard is the modern VPN protocol — fast, simple, cryptographically uncompromising. It was merged into the Linux kernel in 2020 and now runs natively on every major platform. Tailscale, Mullvad, NordLynx, and many others build on top of it.
Why WireGuard wins on every axis
| Property | WireGuard | OpenVPN |
|---|---|---|
| Code size | ~4,000 lines | ~100,000+ lines |
| Performance | Kernel-level, near wire speed | Userspace, slower |
| Handshake | 1-RTT | Multi-step TLS |
| Cryptography | Fixed: Curve25519, ChaCha20, BLAKE2s | Configurable (and easy to misconfigure) |
| State | Stateless when idle (no keepalives needed) | Persistent connections |
| Config | Tiny INI files | Lengthy configs + cert management |
Why "fixed cryptography" is a feature
WireGuard uses the Noise protocol framework with one specific set of modern primitives. There are no cipher negotiations, no legacy modes, no "let me pick which AES variant." One known-good combination, no knobs that can be turned to insecurity. This is why WireGuard is so much harder to misconfigure than OpenVPN or IPsec.