spb/tools-spboucher-ai

1{2  "slug": "wireguard",3  "name": "WireGuard",4  "aliases": ["wg", "wireguard-go"],5  "vendor": { "name": "WireGuard project (Jason A. Donenfeld)", "slug": "wireguard-project", "website": "https://www.wireguard.com" },6  "homepage_url": "https://www.wireguard.com/",7  "docs_url": "https://www.wireguard.com/quickstart/",8  "repo_url": "https://git.zx2c4.com/wireguard-linux/",9  "license_url": "https://git.zx2c4.com/wireguard-tools/tree/COPYING",10  "product_type": "application",11  "product_status": "active",12  "summary": "Minimal, high-speed VPN protocol and implementation built on modern cryptography, included in the Linux kernel and available on macOS, iOS, Windows, Android and BSD",13  "description": "WireGuard is a layer-3 VPN protocol and set of implementations created by Jason A. Donenfeld. It replaces the configuration-heavy model of IPsec and OpenVPN with a single fixed cryptographic suite built on the Noise protocol framework (Curve25519 key exchange, ChaCha20-Poly1305 encryption, BLAKE2s hashing) and a peer model in which each endpoint is identified by a public key and a set of allowed IP ranges. The reference implementation lives in the Linux kernel since version 5.6 under GPL-2.0; a userspace implementation in Go, wireguard-go (MIT), powers the macOS, iOS, Windows and Android apps, and the `wg` and `wg-quick` tools manage interfaces and configuration files.\n\nIts configuration is short enough to read at a glance: an interface section with a private key and address, and one peer section per remote with its public key, endpoint and allowed IPs. Because peers roam freely and the protocol is stateless from the user's perspective, it suits hub-and-spoke setups where many machines connect to one gateway, site-to-site links between servers, and the data plane of overlay networks such as Tailscale. On UDP it handles NAT traversal when at least one side has a reachable port.\n\nWhat WireGuard does not provide is key distribution, identity or access policy: every peer's public key and allowed ranges must be placed on the other side by some external process, and there is no built-in user authentication or certificate model. Networks with many nodes therefore add a coordination layer or configuration management. The protocol is also UDP-only, which some restrictive networks block.",14  "capabilities": ["Encrypted layer-3 tunnels using Noise, Curve25519, ChaCha20-Poly1305 and BLAKE2s", "In-kernel implementation on Linux and userspace implementations for other platforms", "Public-key peer identity with AllowedIPs-based cryptokey routing", "Roaming endpoints and NAT traversal over UDP", "wg and wg-quick tools with simple INI-style configuration files", "Official apps for macOS, iOS, Windows and Android"],15  "workflows": ["Connect a fleet of machines to a public gateway host so a reverse proxy can reach them", "Build a site-to-site tunnel between two servers", "Give a laptop secure access to a home or lab network", "Serve as the data plane under an overlay such as Tailscale"],16  "advantages": ["Small code base that has been formally analyzed", "High throughput thanks to the kernel implementation", "Configuration fits in a few lines", "Available on every mainstream operating system"],17  "limitations": ["No built-in key distribution, identity or access control", "UDP only; blocked on some networks unless a port such as 443 is used", "Static configuration does not scale to large meshes without tooling", "Kernel module availability depends on the host OS version"],18  "prerequisites": ["Linux kernel 5.6+ or the WireGuard app/wireguard-go on other systems", "A reachable UDP port on at least one peer"],19  "audiences": ["Network and systems administrators", "Self-hosters connecting home and cloud machines", "Developers building overlay networks"],20  "alternatives": ["tailscale", "openssh", "cloudflare-tunnel"],21  "comparison_notes": "Tailscale wraps WireGuard with a coordination service that distributes keys, assigns addresses and enforces access policies, trading some control for far less configuration. OpenSSH tunnels and port forwards provide encrypted access to individual services without a network interface, which is simpler for one-off use but not for routing. Cloudflare Tunnel publishes services outbound through Cloudflare's edge and needs no open ports at all, but routes traffic through a third party rather than directly between peers.",22  "categories": [{ "slug": "tunneling-remote-access", "primary": true }],23  "tags": ["vpn", "networking", "cryptography", "open-source", "self-hosted", "linux", "macos", "cli"],24  "use_cases": ["expose-local-services", "connect-private-networks"],25  "operating_systems": ["linux", "macos", "windows", "ios", "android"],26  "execution_modes": ["self-hosted", "local"],27  "interfaces": ["cli", "desktop", "mobile"],28  "deployment_models": ["on-premises"],29  "integrations": ["Linux kernel", "Tailscale", "systemd", "NetworkManager", "OPNsense/pfSense"],30  "data_formats": ["wg INI configuration"],31  "languages": ["C", "Go"],32  "source_model": "open-source",33  "license_spdx": "GPL-2.0-only",34  "pricing_model": ["open-source", "free"],35  "self_hostable": true,36  "sources": [37    { "url": "https://www.wireguard.com/", "type": "official_site", "title": "WireGuard: fast, modern, secure VPN tunnel", "supports": ["name", "summary", "capabilities", "operating_systems"], "checked_at": "2026-11-02" },38    { "url": "https://www.wireguard.com/quickstart/", "type": "official_docs", "title": "WireGuard Quick Start", "supports": ["workflows", "data_formats", "prerequisites"], "checked_at": "2026-11-02" },39    { "url": "https://git.zx2c4.com/wireguard-tools/tree/COPYING", "type": "license_page", "title": "wireguard-tools COPYING (GPL-2.0)", "supports": ["license_spdx", "source_model"], "checked_at": "2026-11-02" },40    { "url": "https://github.com/WireGuard/wireguard-go", "type": "repository", "title": "WireGuard/wireguard-go", "supports": ["languages"], "checked_at": "2026-11-02", "note": "Userspace Go implementation under the MIT license." }41  ],42  "confidence": "high",43  "uncertainty_note": "license_spdx reflects the Linux kernel module and wireguard-tools (GPL-2.0); wireguard-go and the platform apps use the MIT license.",44  "discovery_method": "editorial-research",45  "depth": "deep",46  "editorial_status": "reviewed",47  "visibility": "public",48  "featured": false,49  "author": "batch-B2"50}51