WireGuardOVER TCP!

THE TCP CARRIER EDITION★ TESTED ON UBUNTU 24.04

BUT WAIT—

WireGuardOVER TCP!

BY DRAGOS RUIU & JEFF NATHAN

Same encrypted tunnel. A long-lived TCP carrier.

NOW WITHMORE PERFORMANCE!ON SELECTED MEASURED PATHS

FIREWALLFRIENDLY!

WIREGUARD TCP

ϟ

AN OPT-IN TCP TRANSPORT FOR THE LINUX WIREGUARD KERNEL MODULE

• UDP stays the default
• Noise stays authoritative
• Single NAT + roaming
• Source tree stays readable

IPv4 READYIPv6 READY

OPEN SOURCE

ϟ GET THE BITSREAD THE SOURCE ↗

✓ TCP + UDP · IPv4 + IPv6✓ +21.1% SELECTED CLEAN-PATH BULK✓ 122 VALID MELTDOWN RUNS✓ 0 FORMAL MELTDOWNS✓ LINUX KERNEL MODULE

BUT WAIT—THERE’S DATA!

NOW WITHMORE PERFORMANCE!

MEASURED. REPRODUCIBLE. PATH-DEPENDENT.

TCP mode matched or beat UDP mode in several clean low- and medium-latency application tests, while preserving the familiar WireGuard configuration model.

BULK TCP · X64 · 56 MS · CLEAN PATH+21.1%

MORE THROUGHPUT

519.3 Mb/s TCP-WG versus 428.9 Mb/s UDP-WG.

SEQUENTIAL HTTPS · LAN X64+16.3%

MORE REQUESTS

152.55 versus 131.14 requests per second at 0% loss.

SEQUENTIAL HTTPS · ARM64 · CLEAN LANUP TO16.6%

LESS MEAN CPU

16.6% lower in the measured cell: 51.2% TCP-WG versus 61.3% UDP-WG.

122VALID RUNS

DEDICATED MECHANISTIC CAMPAIGN0

FORMAL MELTDOWNS

No valid post-repair execution met all three predeclared meltdown conditions.

HIGH-RTT CONTROL47.20–47.23 Mb/s

50 Mb/s carrier · 400 ms RTT · 1× BDP FIFO · no induced loss

THE FINE PRINT!

TCP is not universally faster, but it was more performant in most of the measured operating cells summarized here. Exceptions:

• Clean bulk-TCP at approximately 195–227 ms RTT measured 14.4%–23.4% below UDP-WG.
• Persistent outer loss combined with long RTT, constrained queues, and many saturated inner flows can produce severe stalls.

Benchmark the actual path before choosing a universal winner.

READ THE FULL PERFORMANCE REPORT ↗

PICK YOUR POISON

DOWNLOADS

Precompiled release channels are staged below. Until signed artifacts are attached to a GitHub release, each binary card points to the release feed instead of serving an unverified build.

01 / LINUXBUILD SLOT

Ubuntu x86\_64

.tar.zst

Kernel module + modified wg tool

Ubuntu 24.04 · Linux 6.8

WATCH RELEASES ↗

02 / ARMBUILD SLOT

Ubuntu ARM64

.tar.zst

Kernel module + modified wg tool

Ubuntu 24.04 · aarch64

WATCH RELEASES ↗

03 / SOURCEAVAILABLE

Source tree

.zip / .tar.gz

Clean standalone repository

Kernel · tools · UAPI · tests · docs

GET .ZIP ↓GET .TAR.GZ ↓

ZIP SHA-2569abb559e…9d21883a

TAR SHA-25625d3ffe2…5730c0fe

CHECK BEFORE YOU LOAD.Kernel modules are kernel-specific. Match the release notes, architecture, kernel ABI, and published SHA-256 before installation.OPEN THE QUICKSTART ↗

WHAT’S IN THE BOX?

WIREGUARD’S CRYPTO.

WireguardTCP adds an opt-in TCP path beneath the existing WireGuard encryption layer. Handshakes, keepalives, and encrypted data are framed inside a long-lived per-peer stream. UDP remains untouched and remains the default.

READ THE DESIGN NOTES ↗

INNER IP

→

WG ENCRYPT

UDP MODEUDP SOCKET

TCP MODEFRAME → TCP STREAM

The framing checksum finds record boundaries. WireGuard authentication still decides what is trusted.