Secure and Fast, But Bad for Privacy?A lot has changed since we looked at WireGuard last year. In this updated WireGuard VPN guide we examine the strengths and weaknesses of this protocol, as well as the best WireGuard VPN services.
- Benefits of WireGuard
- WireGuard privacy problems (and solutions)
- Best WireGuard VPN services
- The future of WireGuard
- WireGuard VPN comparison table
Benefits of WireGuard VPNHere are some of the ‘pros’ that WireGuard offers:
1. Updated encryptionAs explained in various interviews, Jason Donenfeld wanted to upgrade what he considered to be “outdated” protocols with OpenVPN and IPSec. WireGuard uses the following protocols and primitives, as described on its website: You can learn more about WireGuard’s modern cryptography on the official website or in the technical white paper [PDF].
2. Simple and minimal code baseWireGuard really stands out in terms of its code base, which is currently about 3,800 lines. This is in stark contrast to OpenVPN and OpenSSL, which combined have around 600,000 lines. IPSec is also bulky at around 400,000 total lines with XFRM and StrongSwan together. What are the advantages of a smaller code base?
- It is much easier to audit. OpenVPN would take a large team many days to audit. One person can read through WireGuard’s codebase in a few hours.
- Easier to audit = easier to find vulnerabilities, which helps keep WireGuard secure
- Much smaller attack surface in comparison to OpenVPN and IPSec
- Better performance
3. Performance improvementsSpeeds can be a limiting factor with VPNs – for many different reasons. WireGuard is designed to offer significant improvements in the area of performance:
A combination of extremely high-speed cryptographic primitives and the fact that WireGuard lives inside the Linux kernel means that secure networking can be very high-speed. It is suitable for both small embedded devices like smartphones and fully loaded backbone routers.Theoretically, WireGuard should offer improved performance in the way of:
- Faster speeds
- Better battery life with phones/tablets
- Better roaming support (mobile devices)
- More reliability
- Faster at establishing connections/reconnections (faster handshake)
Update: fastest VPN protocol testedWe have now tested out WireGuard extensively with NordVPN and a few other VPN services that support it. We have found NordVPN’s implementation of the WireGuard VPN protocol, which they call NordLynx, offers the fastest speeds. Here we are using NordVPN with the WireGuard VPN protocol (NordLynx) with a server in Seattle (USA). We hit speeds of 445 Mbps on a 500 Mbps connection: This makes WireGuard the fastest VPN protocol we have tested (when used with NordVPN on a nearby server).
4. Cross-platform ease of useAlthough full implementation has been somewhat delayed, WireGuard should work very well across different platforms. WireGuard supports Mac OS, Android, iOS, and Linux, with Windows support still in development. Another interesting feature with WireGuard is that it utilizes public keys for identification and encryption, whereas OpenVPN uses certificates. This does create some issues for utilizing WireGuard in a VPN client, however, such as key generation and management. A few VPNs have already integrated full WireGuard support into their lineup of VPN clients. See for example with NordVPN and also Mullvad.
5. Now merged into Linux kernel and released from betaOn March 29, 2021, it was announced that WireGuard will be officially included in the 5.6 Linux kernel. This is big news that many privacy enthusiasts have been waiting for. Additionally, WireGuard is now out of beta with the release of version 1.0 for Linux. You can get more info on WireGuard for different operating systems here. With these two developments, WireGuard is now considered stable and ready for widespread use. The previous warning on the official website about WireGuard being “not yet complete” has been removed.
WireGuard privacy problems (and solutions)While WireGuard may offer advantages in terms of performance and security, by design it is not ideal for privacy. Many VPN providers have expressed concerns about WireGuard and its impact on privacy. IVPN noted that WireGuard “was not designed with commercial VPN providers who offer privacy services in mind.” Similarly, NordVPN also voiced concerns with the inherent privacy issues of WireGuard:
By implementing the out-of-the-box WireGuard protocol in our service, we would have put your privacy at risk. And we would never do this.Fortunately, the dust has settled and there are some good solutions to these problems. WireGuard in 2021 is now a stable VPN protocol and a few VPNs have found effective solutions for deploying it while still ensuring user privacy. To understand the tradeoff between privacy and security with WireGuard, IVPN did a good job distinguishing the two as follows:
The security of the protocol is concerned with protecting the data in a tunnel from being accessed by adversaries: either by breaking the encryption, MITM attacks, or by any other means, no matter how complicated. Privacy is concerned with whether an adversary can learn anything about you, your communication or any party you’ve communicated with. It has more to do with the metadata rather than the actual data. Privacy can be violated, even when security is rock solid. For example, when the fact that two parties communication can be determined. Or when a certain piece of information about a party becomes known after the communication took place. However, it should be noted that, if security is weak, privacy cannot be guaranteed at all.Now that we’ve covered the basics, let’s examine some privacy problems with WireGuard.
Problem 1: WireGuard stores user IP addresses on the VPN server indefinitelyAs others have pointed out, WireGuard was not built for anonymity and privacy, but rather security and speed. By default, WireGuard saves connected IP addresses on the server . These user IP addresses are saved indefinitely on the server, or until the server is rebooted. This makes the out-of-the-box version of WireGuard incompatible with no-logs VPN services. So how are VPN services deploying WireGuard while still ensuring user privacy?
SolutionsBased on our research, the solution to this privacy problem varies by the VPN provider. We’ll examine a few below.
NordVPN double NAT system with WireGuardNordVPN takes a unique approach to the privacy issues with what they call a “double NAT system” deployed with NordLynx:
The first interface assigns a local IP address to all users connected to a server. Unlike in the original WireGuard protocol, each user gets the same IP address. Once a VPN tunnel is established, the second network interface with a dynamic NAT system kicks in. The system assigns a unique IP address for each tunnel. This way, internet packets can travel between the user and their desired destination without getting mixed up. The double NAT system allows us to establish a secure VPN connection without storing any identifiable data on a server. Dynamic local IP addresses remain assigned only while the session is active.This is NordVPN’s unique solution to WireGuard’s privacy flaws, and they are referring to it as NordLynx. You can get more info on NordLynx and NordVPN on their website here.
Mullvad and OVPN erase IP address logs after the VPN session endsAnother way VPN providers have addressed the problem with logs is to configure their servers to erase these logs when the session ends. Two examples of this are with Mullvad and OVPN, both of which are secure VPN services based in Sweden. OVPN explains:
We have programmed our VPN servers so that user information is not stored forever in the VPN server’s memory. Users who have not had a key exchange for the past three minutes are removed, which means we have as little information as possibleMullvad takes a similar approach:
We added our own solution in that if no handshake has occurred within 180 seconds, the peer is removed and reapplied. Doing so removes the public IP address and any info about when it last performed a handshake.Now let’s look at another issue/drawback of WireGuard.
Problem 2: WireGuard does not assign dynamic IP addressesVPN providers have also voiced concerns about how IP addresses are assigned with WireGuard. Mullvad had this to say in a blog post:
We acknowledge that keeping a static IP for each device, even internally, is not ideal. Why? Because if a user experiences WebRTC leaks, that static internal IP address could leak externally. As another example, applications running on your device can find out your internal IP, and if you’ve installed software that is malicious, it can also leak that information.Similarly, OVPN also acknowledges these drawbacks:
At present, WireGuard requires that each key pair (which can be viewed as a device) is assigned a static internal IP address. This works without issues for smaller installations, but can quickly become complex when tens of thousands of customers need to connect. Development is underway for a model called wg-dynamic, but it is not yet finished.Additionally, there are certain scenarios in which these IP addresses can be exposed, namely with WebRTC leaks.
SolutionsBoth OVPN and Mullvad have come up with ways to securely generate keys and manage IP addresses. Each service allows you to regenerate keys and therefore rotate IP addresses, which helps to neutralize this problem. You can get specific details on each of the respective VPN websites. Block or disable WebRTC – WireGuard relies on statically assigned IP addresses, and as we have covered before, a WebRTC leak can expose your internal and/or external IP address. This is not an issue with your VPN service, but rather a problem with your web browser. Here are some helpful guides to solve these issues: Now that we’ve covered some different problems and solutions, let’s look at the best WireGuard VPN providers.
WireGuard VPN servicesOk, so you want to try out WireGuard and are wondering what are the best VPN services to do this. The list of VPN services supporting WireGuard continues to grow and we do our best to keep up with the latest developments and update this guide accordingly. Here are the best VPNs for WireGuard:
1. NordVPN – Best all-around WireGuard VPN
|Logs||No logs (audited)|
|Support||24/7 Live chat|
- Double-VPN servers – Encrypt traffic across two different VPN servers for an added layer of security and encryption.
- Tor-over-VPN servers – These are VPN servers that exit onto the Tor network.
- CyberSec – This feature blocks ads, trackers, and malware domains and is activated directly in the VPN app.
- Obfuscated servers – These servers will help you to get around VPN blocks, such as when using a VPN in China, at school, or with work networks.
2. Mullvad – Swedish VPN with full WireGuard support
3. OVPN with WireGuard
|Support||Email and chat|
4. AzireVPN with WireGuard
Other VPN services that support WireGuardThis list is not exhaustive, but here are some other VPNs that support WireGuard. We have not tested these services yet, but they all offer a refund window allowing you to test it out risk-free.
- VPN.ac – Based in Romania, VPN.ac offers a secure VPN with full WireGuard support through the WireGuard clients.
- TorGuard – TorGuard is a US VPN service (Five Eyes warning) that offers full support for the WireGuard protocol. You can use WireGuard with TorGuard through the WireGuard clients.
- IVPN – IVPN is a well-regarded VPN service in Gibraltar. Like NordVPN and Mullvad, IVPN has successfully integrated WireGuard into their own VPN clients. It is one of the most expensive WireGuard VPNs, but does well in the privacy category.
- Private Internet Access – PIA is a US VPN service that has rolled out support for WireGuard in their desktop and mobile clients. (Note that PIA is owned by Kape Technologies, an Israeli firm with a history of producing malware that now also owns CyberGhost VPN and Zenmate.)
The future of WireGuardWireGuard’s future is looking bright. Many VPN services have adopted WireGuard into their infrastructure as it becomes more popular with VPN users worldwide. And with improved speeds, reliability, and upgraded encryption, we can expect WireGuard popularity to continue growing. The VPN protocol itself, however, certainly has room for improvement. It remains flawed from a privacy standpoint with the issues we discussed above. However, many VPNs have already found good workarounds to ensure user privacy while still enjoying the benefits that WireGuard offers. Now that WireGuard has been released under version 1.0 and incorporated into the Linux kernel, it is safe to say this VPN protocol is ready for mainstream use.
WireGuard VPN Comparison Table
Final Disclaimer and Instructions from NetTodays
NetTodays is a platform for Best VPN Review and Which VPN Service is Best for you. How to get Best Free VPN Review without the expense. NetTodays suggest how to utilize the most recent VPN and reviews about What is the Best VPN for Netflix. Best VPN built for speed, you can select a server at the country or city level and can favorite a location for future use. NetTodays help you to understand that What is the Best VPN on the Market. NetTodays provide you all these reviews and recondition about Best VPNs for Gaming
A VPN is a service that both encrypts your data and hides your IP address by bouncing your network activity through a secure chain to another server miles away. This obscures your online identity, even on public Wi-Fi networks, so you can browse the internet safely, securely, and anonymously.
NetTodays gives you answers to all questions which are in your mind about VPN.
NetTodays also suggest continually utilizing Best VPN when you are using a newer Wi-Fi Network. Here is a decent dependable guideline: If you’re away from the workplace or home, and you’re utilizing another person’s Wi-Fi (even that of a relative or a companion, since you can’t be sure whether they’ve been compromised), utilize a VPN. It’s especially significant in case you’re getting to help that has specifically distinguishing data. Keep in mind, a great deal goes on in the background, and you never truly know whether at least one of your applications is verifying behind the scenes and putting your data in danger.Last updated on September 3, 2021.