When you use one of the best VPNs out there, your choice of VPN protocol can make a big difference. Put simply, a VPN protocol is the rule set that your VPN will use to transmit data across the internet. It determines how that data is encrypted and decrypted, authenticated, and sent across a network.
WireGuard is one of the most popular protocols, but it's far from the only one. Older protocols like OpenVPN and IKEv2 are still available, and, depending on what you want to do, may be a better choice.
Like many VPN features, such as split tunneling, each specific protocol has its pros and cons. In this guide, we're going to explore WireGuard, what it is, how using it could benefit you, and when you may want to consider picking one of its more venerable counterparts.
What is WireGuard?
Despite its widespread adoption across the industry, WireGuard is very new. The work of one man, a security researcher named Jason A. Donenfeld, it only came into being back in 2015.
Driven by a worry that the vulnerabilities of existing VPN protocols, combined with their complexity, was hindering the security of VPNs, he decided to create a more secure alternative that would be simple to use. As it turns out, his work has led to a sea change in the world of VPNs and how they work.
In its first version, WireGuard was specifically made for Linux. However, it has since been made more widely available with versions across Windows, Mac, Android, iOS, and even BSD, for those who think Linux is a little too mainstream.
Benefits of WireGuard
WireGuard's tenets of security, speed, and simplicity are made clear in its code. The protocol has fewer than 5,000 lines of code in total, which, while it may sound like a lot, is comparatively tiny compared to the older VPN protocols like OpenVPN or IKEv2.
Don't mistake this design simplicity for compromised security, though. The leaner, tighter code results in fewer bugs and security vulnerabilities. It also means there is less CPU usage and therefore faster connection times. This smaller amount of code is seen in newer VPN protocols like WireGuard or ExpressVPN’s Lightway.
The leaner code also makes it significantly easier for WireGuard to be deployed across devices that lack the punch of a desktop PC. Mobile phones, routers, and even Smart TV devices like the Fire Stick.
As a result, WireGuard is often seen in use on some of the fastest VPNs that are available today.
WireGuard forgoes the standard 256-bit AES encryption. That, on the face of it, sounds bad, but it is one of WireGuard’s strengths. Instead, WireGuard uses more modern encryption protocols including Curve25519, ChaCha20, Poly1305 and BLAKE2.
These cryptography systems make WireGuard more secure and efficient and a frequent feature on some of the most secure VPNs.
Unlike a VPN protocol such as OpenVPN, WireGuard can run inside the Linux kernel. This makes it more efficient, as Linux does not have to context switch (a method of moving between different tasks).
This aids performance, making WireGuard faster and able to transmit more data overall.
Drawbacks of WireGuard
So, this all sounds brilliant. Why would anyone choose to use one of the older VPN protocols, then? Much like anything else in the world of online security, there are tradeoffs to be made, though they're likely not what you think.
As mentioned above, simplicity, speed and security are WireGuard's specialities. This does mean it has some drawbacks in other areas.
Most noticeably, WireGuard lacks some features its competitors have, such as the ability to allocate dynamic IP addresses. These are IP addresses that aren’t static but will change over time.
WireGuard also doesn’t automatically delete your IP address when you disconnect from the server, and there is no forward secrecy. This is a system that encrypts VPN data using a new private key every session.
This isn't necessarily a big issue if you're using your VPN for general protection, but if your main focus is privacy, it could be. Every quality consumer VPN service has patched WireGuard to ensure that your real IP address is never stored, but that doesn't mean the issue is solved.
If you plan on using WireGuard as the protocol for a VPN that you'll spin up yourself, however, it becomes more of a concern, and one that you'll need to take steps to remedy yourself.
Another feature WireGuard doesn’t have is the ability to obfuscate your traffic, so it can be vulnerable to Deep Packet inspection. While this isn’t found in all VPN protocols, it is becoming more common. If you're someone for whom VPN obfuscation is very important, you'll likely want to look for another VPN protocol.
A final consideration of WireGuard is that it only supports UDP. Most VPN providers offer both TCP and UDP. That’s a lot of acronyms but what it crucially means is more efficient data transfers but it can cause transmission and reception issues.
WireGuard, like a lot of other VPN protocols, is very open about its problems. It has a full page addressing them on its website.
Bottom line
One of WireGuard’s biggest weaknesses is its lack of some key features found in other VPNs, including obfuscation and TCP support. That doesn't mean that it's any less secure on a fundamental level, but, depending on your priorities, it might make another VPN protocol a better choice for you.
In fact, some of the best VPNs have come up with their own app and server-based solutions using WireGuard.
NordVPN, one of the most popular VPNs around, has their own Nordlynx protocol. This gets around WireGuard revealing a home IP address to the VPN server. Additionally, NordVPN can assign fresh "dynamic" IP addresses to users each time they connect to the service. Another example of this can be found in Proton VPN's protocol, codenamed ProTUN internally, which our colleagues over at TechRadar noted as key to its new upgrade.
While WireGuard is lacking in some areas, it makes up for it with speed, security and its ease of use.
