WireGuard
A modern VPN protocol known for its minimal codebase (approximately 4,000 lines of kernel implementation), high performance, and strong encryption. It was merged into the Linux 5.6 kernel mainline in 2020.
Core Facts
Tailscale builds a control plane on top of the WireGuard data plane, automatically completing key exchange, node discovery, and routing configuration; after a user logs in, devices automatically join a private network called a tailnet.
WireGuard's codebase is only approximately 4,000 lines, whereas OpenVPN exceeds 70,000 lines.
WireGuard was developed by Jason Donenfeld in 2015 and was officially merged into the Linux kernel in 2020.
Timeline (last 90 days)
Tailscale's underlying data plane is built on WireGuard; each device generates its own WireGuard key pair, and nodes establish point-to-point encrypted tunnels between them.
Tailscale SSH is a keyless SSH access feature offered by Tailscale that uses the WireGuard network and identity authentication mechanisms to replace traditional SSH key management.
Tailscale is a virtual networking service built on the WireGuard protocol that connects devices across different networks into an encrypted peer-to-peer mesh network, with each device receiving a fixed 100.x.x.x private IP.
WireGuard runs on Linux as a kernel module, and its codebase is far smaller than OpenVPN's, making it easier to audit and lower in latency.
WireGuard employs a silent design that does not respond to unauthenticated packets, making its presence undetectable by port scanning.
NetBird uses a peer-to-peer mesh architecture where devices establish direct WireGuard tunnels with each other whenever possible, falling back to a relay server only when a direct connection is not feasible.
NetBird is a zero-trust mesh network platform based on WireGuard, adding an identity management, NAT traversal, and policy distribution layer on top of WireGuard.
Tailscale/WireGuard relies on centralized coordination servers, ZeroTier also has central nodes, whereas Yggdrasil's routing is fully decentralized.
Deep packet inspection (DPI) can identify the presence of VPN traffic to a certain extent—for example, detecting that a connection is using the OpenVPN or WireGuard protocol.
WGDashboard has built-in WireGuard functionality, enabling one-stop management of peers, configurations, and traffic data.
28 more timeline events
All Facts (20)
Tailscale builds a control plane on top of the WireGuard data plane, automatically completing key exchange, node discovery, and routing configuration; after a user logs in, devices automatically join a private network called a tailnet.
75%VerifiedWireGuard's codebase is only approximately 4,000 lines, whereas OpenVPN exceeds 70,000 lines.
75%VerifiedWireGuard was developed by Jason Donenfeld in 2015 and was officially merged into the Linux kernel in 2020.
75%VerifiedWireGuard uses a fixed cryptographic combination of Curve25519 for key exchange, ChaCha20 for symmetric encryption, and Poly1305 for message authentication.
70%VerifiedTailscale is a zero-configuration VPN service built on the WireGuard protocol, enabling different devices to communicate directly through secure encrypted tunnels.
65%VerifiedWireGuard, as the underlying protocol of Tailscale, has only approximately 4,000 lines of Linux kernel module code.
65%VerifiedWireGuard was developed by Jason Donenfeld in 2015 with a codebase of approximately 4,000 lines, compared to the hundreds of thousands of lines in OpenVPN.
65%VerifiedWhen UDP is completely blocked by a firewall, Tailscale ensures connectivity through DERP (Designated Encrypted Relay for Packets) relay servers, and end-to-end encryption prevents the relay servers from decrypting data content.
65%UnverifiedTailscale's coordination server does not relay users' actual data traffic; data is always transmitted end-to-end between devices through WireGuard tunnels with encryption.
70%UnverifiedThe Noise Protocol Framework was proposed by Trevor Perrin, the designer of the Signal protocol; its IK pattern enables zero-RTT encrypted transmission when the initiator already knows the responder's static public key.
60%UnverifiedWireGuard's encryption is performed at the network layer (Layer 3), transparently encrypting data of any protocol.
60%UnverifiedDERP relay servers can only see the ciphertext encrypted by WireGuard and cannot decrypt the actual transmitted content.
60%UnverifiedWireGuard uses the IK mode of the Noise Protocol, achieving a 1-RTT handshake and providing forward secrecy.
60%UnverifiedTailscale SSH is a keyless SSH access feature offered by Tailscale that uses the WireGuard network and identity authentication mechanisms to replace traditional SSH key management.
50%UnverifiedTailscale's underlying data plane is built on WireGuard; each device generates its own WireGuard key pair, and nodes establish point-to-point encrypted tunnels between them.
50%UnverifiedTailscale is a virtual networking service built on the WireGuard protocol that connects devices across different networks into an encrypted peer-to-peer mesh network, with each device receiving a fixed 100.x.x.x private IP.
50%UnverifiedWireGuard runs on Linux as a kernel module, and its codebase is far smaller than OpenVPN's, making it easier to audit and lower in latency.
50%UnverifiedNetBird is a zero-trust mesh network platform based on WireGuard, adding an identity management, NAT traversal, and policy distribution layer on top of WireGuard.
50%UnverifiedNetBird uses a peer-to-peer mesh architecture where devices establish direct WireGuard tunnels with each other whenever possible, falling back to a relay server only when a direct connection is not feasible.
50%UnverifiedWireGuard employs a silent design that does not respond to unauthenticated packets, making its presence undetectable by port scanning.
50%