WireguardTCP — WireGuard over TCP
THE TCP CARRIER EDITION★ TESTED ON UBUNTU 24.04<br>BUT WAIT—<br>WireGuardOVER TCP!<br>BY DRAGOS RUIU & JEFF NATHAN<br>Same encrypted tunnel.<br>A long-lived TCP carrier.<br>NOW WITHMORE PERFORMANCE! ON SELECTED MEASURED PATHS
FIREWALL FRIENDLY!<br>WIREGUARD TCP<br>AN OPT-IN TCP TRANSPORT FOR THE LINUX WIREGUARD KERNEL MODULE<br>UDP stays the default<br>Noise stays authoritative<br>Single NAT + roaming<br>Source tree stays readable<br>IPv4 READYIPv6 READY<br>OPEN SOURCE<br>ϟ GET THE BITSREAD THE SOURCE ↗<br>✓ TCP + UDP · IPv4 + IPv6✓ +21.1% SELECTED CLEAN-PATH BULK✓ 122 VALID MELTDOWN RUNS✓ 0 FORMAL MELTDOWNS✓ LINUX KERNEL MODULE
BUT WAIT—THERE’S DATA!<br>NOW WITHMORE PERFORMANCE!
MEASURED. REPRODUCIBLE. PATH-DEPENDENT. TCP mode matched or beat UDP mode in several clean low- and medium-latency application tests, while preserving the familiar WireGuard configuration model.
BULK TCP · X64 · 56 MS · CLEAN PATH+21.1% MORE THROUGHPUT<br>519.3 Mb/s TCP-WG versus 428.9 Mb/s UDP-WG.
SEQUENTIAL HTTPS · LAN X64+16.3% MORE REQUESTS<br>152.55 versus 131.14 requests per second at 0% loss.
SEQUENTIAL HTTPS · ARM64 · CLEAN LANUP TO16.6% LESS MEAN CPU<br>16.6% lower in the measured cell: 51.2% TCP-WG versus 61.3% UDP-WG.
122VALID RUNS<br>DEDICATED MECHANISTIC CAMPAIGN0 FORMAL MELTDOWNS<br>No valid post-repair execution met all three predeclared meltdown conditions.
HIGH-RTT CONTROL47.20–47.23 Mb/s 50 Mb/s carrier · 400 ms RTT · 1× BDP FIFO · no induced loss
THE FINE PRINT! TCP is not universally faster, but it was more performant in most of the measured operating cells summarized here. Exceptions:<br>Clean bulk-TCP at approximately 195–227 ms RTT measured 14.4%–23.4% below UDP-WG.<br>Persistent outer loss combined with long RTT, constrained queues, and many saturated inner flows can produce severe stalls.<br>Benchmark the actual path before choosing a universal winner.
READ THE FULL PERFORMANCE REPORT ↗
PICK YOUR POISON<br>DOWNLOADS
Precompiled release channels are staged below. Until signed artifacts are attached to a GitHub release, each binary card points to the release feed instead of serving an unverified build.
01 / LINUXBUILD SLOT<br>Ubuntu x86_64<br>.tar.zst<br>Kernel module + modified wg tool<br>Ubuntu 24.04 · Linux 6.8<br>WATCH RELEASES ↗<br>02 / ARMBUILD SLOT<br>Ubuntu ARM64<br>.tar.zst<br>Kernel module + modified wg tool<br>Ubuntu 24.04 · aarch64<br>WATCH RELEASES ↗<br>03 / SOURCEAVAILABLE<br>Source tree<br>.zip / .tar.gz<br>Clean standalone repository<br>Kernel · tools · UAPI · tests · docs<br>GET .ZIP ↓GET .TAR.GZ ↓<br>ZIP SHA-2569abb559e…9d21883a<br>TAR SHA-25625d3ffe2…5730c0fe
CHECK BEFORE YOU LOAD. Kernel modules are kernel-specific. Match the release notes, architecture, kernel ABI, and published SHA-256 before installation.OPEN THE QUICKSTART ↗
WHAT’S IN THE BOX?<br>WIREGUARD’S CRYPTO.<br>ONE MORE CARRIER.<br>WireguardTCP adds an opt-in TCP path beneath the existing WireGuard encryption layer. Handshakes, keepalives, and encrypted data are framed inside a long-lived per-peer stream. UDP remains untouched and remains the default.<br>READ THE DESIGN NOTES ↗<br>INNER IP<br>WG ENCRYPT<br>UDP MODEUDP SOCKET<br>TCP MODEFRAME → TCP STREAM
The framing checksum finds record boundaries. WireGuard authentication still decides what is trusted.
LIVE!<br>YOU’VE READ THE CODE—<br>NOW MEET THE PEOPLE WHO BREAK IT.<br>CanSecWest 2026<br>SEPT. 30 – OCT. 1 PINNACLE HARBOURSIDE · VANCOUVER, CANADA
REGISTER NOW! ↗