Travelling
Hotel, airport and mobile networks vary a lot. If you can’t connect, try a different protocol. Some networks block VPNs, and we can’t promise any protocol will connect.
Using a VPN while travellingEncryption and protocols
WireGuard VPN protocol
WireGuard is a modern VPN protocol built to be simple: a small amount of code and one fixed set of modern cryptography. It’s one of the WireGuard, OpenVPN, IKEv2 and IPSec protocols our network supports.
- A small codebase that’s easier to review than older protocols
- One fixed set of modern cryptography, with no weak options to pick
- Open source, and part of the Linux kernel
- 30-day money-back guarantee on your first purchase (14 days on monthly plans)
- Up to 5 devices at once
- Windows, macOS, iOS, Android and Fire TV
What it is
What is WireGuard?
In short
WireGuard is a VPN protocol: a set of rules for how two devices build an encrypted tunnel and send data through it. It was designed to be much simpler than older protocols, with a small codebase and a single, fixed set of modern cryptography instead of a menu of options to configure.
How it works
How WireGuard works
Every WireGuard connection is built from the same few pieces.
- Encrypted VPN tunnel
- Normal internet connection
Read this diagram as text
One row. Your device encrypts traffic before it leaves; the local network sees encrypted traffic; the encrypted tunnel carries it, scrambled, to a VPN server; the server decrypts it and sends it on; and websites see the server’s IP address rather than yours. A protocol such as WireGuard defines how that encrypted tunnel is built and how data travels through it.
One row. Your device encrypts traffic before it leaves; the local network sees encrypted traffic; the encrypted tunnel carries it, scrambled, to a VPN server; the server decrypts it and sends it on; and websites see the server’s IP address rather than yours. A protocol such as WireGuard defines how that encrypted tunnel is built and how data travels through it.
Each side has a key pair
Your device and the VPN server each hold a public and a private key, a bit like a padlock and the only key that opens it.A short handshake
The two sides exchange a brief set of messages to confirm who they are and agree fresh session keys.Data is sealed and sent
Traffic is encrypted with ChaCha20-Poly1305, which also detects tampering, and sent to the server over UDP.Keys are refreshed
The handshake repeats regularly, so session keys change over time. That gives WireGuard forward secrecy.
WireGuard’s big idea is subtraction. Older protocols let you choose between many ciphers and settings, which leaves room for weak or mistaken configurations. WireGuard picks one modern set and leaves nothing to negotiate.
That simplicity also keeps the code small, so it’s easier for security researchers to read and review. WireGuard is one of the protocols our network supports, alongside OpenVPN, IKEv2 and IPSec. Which protocols you can choose depends on your device.
None of this is something you need to manage. Keys, handshakes and encryption are handled by the protocol each time the tunnel is built; your part is choosing a server and connecting.
Why it matters
Where it makes a difference
You don’t need to understand the protocol to benefit from it, but it helps to know when your choice of protocol matters.
Gaming
Some games and platforms behave differently over a VPN. Trying another protocol is a sensible first step; whether a game accepts VPN connections is up to the game.
VPNs and gamingStudent networks
Campus networks often restrict traffic. If one protocol won’t connect, another might, though some networks block VPNs altogether.
VPNs for students
Side by side
How it compares
WireGuard alongside the other protocols our network supports.
| WireGuard | OpenVPN | IKEv2 | IPSec | |
|---|---|---|---|---|
| First released | Late 2010s | Early 2000s | 2005, as a standard | Mid 1990s |
| Size of the code | Very small | Large | Varies by implementation | Varies by implementation |
| Cryptography | A fixed, modern set | Chosen from options | Chosen from options | Chosen from options |
| Openness | Open source | Open source | Open standard | Open standard |
| Typical role | Modern, general-purpose VPN | Flexible, long-established VPN | Sets up keys, usually for IPSec | Encrypts traffic between devices and networks |
General properties of each protocol, not measurements of our service. Which protocols you can choose depends on your device and app.
The honest bit: what it can’t do
- A protocol doesn’t change what a VPN can do. It builds the encrypted tunnel, and a VPN’s usual limits still apply.
- Which protocols you can choose depends on your device and app.
- Some networks block VPN traffic. Switching protocol may help on some networks, but we can’t promise any protocol will connect.
- Like any VPN protocol, the server has to know your device’s current IP address while you’re connected, so it can send traffic back to you.
WireGuard
Common questions
What is WireGuard?
A modern, open-source VPN protocol designed for simplicity, with a small codebase and one fixed set of modern cryptography.
Is WireGuard secure?
It uses well-studied modern cryptography, including ChaCha20-Poly1305 for encryption, and its small codebase is easier to review than older protocols. As with any protocol, security also depends on the devices at each end.
How is WireGuard different from OpenVPN?
OpenVPN is older, highly configurable and has a much larger codebase. WireGuard fixes its cryptography and keeps its code small. Both are open source. The table above compares their general properties.
Why does WireGuard use UDP?
WireGuard sends its encrypted packets over UDP, a lightweight way of moving data across the internet. Some restrictive networks limit UDP traffic, which is one reason trying another protocol can help if you can’t connect.
What is forward secrecy?
It means session keys change over time and are designed so that exposing one doesn’t reveal traffic protected by the others. WireGuard’s regular handshakes provide it.
Which protocol should I use?
If you’re connecting without problems, there’s no need to change anything. If a particular network gives you trouble, trying a different protocol is a sensible step. The options available depend on your device.
Is WireGuard included on every plan?
Every plan includes every feature. The protocols you can choose depend on your device, not your plan. See plans.
Included on every plan
Every plan includes every feature, for up to 5 devices at once. Renewal prices are shown before you pay.
- 30-day money-back guarantee on your first purchase (14 days on monthly plans)
- Up to 5 devices at once
- Windows, macOS, iOS, Android and Fire TV
Related features
Last reviewed