WireGuard

WireGuard encapsulates IP packets inside encrypted UDP datagrams sent between peers that identify each other by public key. Setting up a link resembles exchanging SSH keys: each side stores the other's public key together with the address ranges that peer is allowed to send and receive. The cipher suite is fixed rather than negotiated, built on Curve25519, ChaCha20, Poly1305, BLAKE2s and the Noise protocol framework, which removes the negotiation step where older tunnel protocols can be downgraded and keeps the codebase far smaller than IPsec or OpenVPN.

On Windows the client runs on top of the WireGuardNT kernel driver and presents a compact tunnel manager: you import or paste a configuration, then activate and deactivate it from the window or the notification area. Tunnels can be scoped so that all traffic or only selected subnets pass through them, which is also how the kill-switch behavior is expressed. Connections survive endpoint changes, so moving between Wi-Fi and a mobile hotspot resumes without a reconnect dialog. Administrators get standalone MSI packages and registry settings for locked-down deployments, and the supported range covers Windows 10 and 11 as well as Server 2016 through 2025.

This is the protocol and the client, not a commercial VPN service. There is no server network, no country list and no account to sign in to; you need an endpoint of your own, whether that is a home router, a self-hosted server, a company gateway or a cloud instance. That makes it a good fit for remote access to a private network, site-to-site links and homelab setups, where the configuration files can be generated once and reused.

Anyone who simply wants to click a button and appear in another country will find the manual key and configuration handling inconvenient, and should look at a hosted provider instead, though many of those run the WireGuard protocol under their own front end. Mobile and other desktop platforms have their own official clients, so the same configuration can be reused across devices.