WireGuard: Next Generation Abuse-Resistant Kernel Network Tunnel
summary
A kernel-space IPv4/IPv6 layer‑3 VPN implemented as a Linux interface uses UDP, Curve25519 and a 1-RTT handshake (NoiseIK) to give perfect forward secrecy with ephemeral keys rotated about every two minutes, authenticated encryption via ChaCha20-Poly1305, and novel IP‑binding cookie MACs to mitigate UDP DoS. Configuration uses a crypto-key routing table mapping short public keys to allowed IPs; the whole implementation is <4,000 lines of C, runs at or above IPsec/OpenVPN speeds, and successfully tunnels packets while remaining stealthy to unauthenticated probes.
AI-written summary · about
chapters (30)
- 0:00Introduction
- 0:25Who am I
- 1:15WireGuard
- 3:16Auditable
- 4:46Pluto
- 4:58Simple Interface
- 7:22CryptoKey Routing
- 8:23Configuration File
- 9:20Implementation
- 10:49Configuration
- 12:14Recap
- 12:59Design Principle 3
- 16:15Noise Protocol
- 20:32Key Exchange
- 21:43DiffieHellman
- 24:20Initiator
- 26:55Responder
- 28:00Summary
- 28:42Primitives
- 29:35Stateless
- 30:16Events
- 31:17Denial of Service
- 32:34Cookies TCP
- 33:22Cookies DTLS
- 35:00Host Identity Protocol
- 35:45WireGuard Variant
- 39:31Performance
- 41:41Performance Comparison
- 42:11General Design
- 43:17Demo
related talks
37mWireGuard and the Future of Cloud Networking
01h 14mTutorial: Securing Access to and from Remote Systems with WireGuard and Linux
25mOver view of linux tunnels- 01h 14mTutorial: Securing Access to and from Remote Systems with WireGuard and Linux
29mSecuring Data-in-Transit with Wireguard for Kubernetes Cluster
46mZero Trust Cloud VPN Based on VPP and WireGuard- 29mSecuring Data-in-Transit with Wireguard for Kubernetes Cluster
11mRethinking Remote Access in a Remote First World