WireGuard

WireGuard is a VPN protocol created by Jason A. Donenfeld and merged into Linux kernel 5.6 in March 2020. Its codebase is much smaller than IPsec or OpenVPN, which makes independent auditing easier. Cryptography is not negotiable. It uses the Noise protocol framework with Curve25519 for key exchange, ChaCha20-Poly1305 for encryption and integrity, and BLAKE2s for hashing. Because the suite is fixed, configuration mistakes such as choosing weak algorithms cannot happen.

Each endpoint is identified by a public/private key pair. In what WireGuard calls cryptokey routing, every peer's public key is bound to the IP ranges that may be received from and sent to that peer (AllowedIPs), so the key defines both identity and routing. The protocol runs only over UDP (commonly port 51820) and keeps no persistent connection state, so a tunnel simply carries on when a mobile device switches networks.

Endpoints behind NAT need PersistentKeepalive (typically 25 seconds) to keep the tunnel open. The usual tunnel MTU is 1420 bytes. Lowering it on links that already run over PPPoE or another tunnel avoids fragmentation problems. WireGuard itself offers no username/password authentication or dynamic address assignment. Those tasks are left to the management layer above it.

Many routers, notably MikroTik RouterOS v7, support WireGuard natively. It is a lightweight, reliable choice for linking distributed hotspot locations to a central core, carrying RADIUS and syslog traffic across the internet encrypted, and managing devices at remote sites.