WireGuard VPN makes it to 1.0.0—and into the next Linux kernel

We’ve been anticipating WireGuard’s inclusion into the mainline Linux kernel for quite some time—but as of Sunday afternoon, it’s official. Linus Torvalds released the Linux 5.6 kernel, which includes (among other things) an in-tree WireGuard. Phoronix has a great short list of the most interesting new features in the 5.6 kernel, as well as a longer “everything list” for those who want to make sure they don’t miss anything.

If this is the first time you’re hearing about WireGuard, the TL;DR is that it’s a relatively new VPN (Virtual Private Network) application that offers a leaner codebase, easier configuration, faster connect times, and the latest and most thoroughly peer-reviewed and approved encryption algorithms. You can find a more detailed introduction in our initial August 2018 coverage.

Can I use this on Windows? Mac? BSD? Android? IOS?

Although WireGuard is now version 1.0.0 in the Linux world, its Windows package is in beta at 0.1.0; it has added significant performance, stability, localization, and accessibility features since our walkthrough preview of an older version.

We’ve used the Windows package a fair amount now, and most users will find it very usable despite being in beta. If you decide to use these pre-release Windows versions, we recommend keeping track of WireGuard news and updates on a regular basis.

Mac and BSD users do not yet have an in-kernel option for WireGuard support but can run the Go language implementation from their respective repositories—pkg install wireguard on FreeBSD, and brew install wireguard-tools, port install wireguard-tools, or even right from the Apple Store itself on the Mac.

IOS users can find WireGuard in the App Store, and Android users can find it in the Play Store, or for those who prefer to roll Google-less, the F-Droid repository. There’s also a tantalizing diff in the Android kernel repository, hinting at an updated in-kernel version Android users might be seeing in a future Android version.

A word to the wise: third-party WireGuard clients exist for these platforms as well, but we recommend sticking to the official WireGuard clients. Detailed instructions and links for downloading and installing WireGuard on everything north of a kitchen toaster can be found here.

WireGuard gets third-party audit, goes 1.0.0

WireGuard itself gets a version bump to 1.0.0 along with its inclusion into the new kernel. Those familiar with open source versioning standards probably weren’t all that put off by its prior 0.8.x or 0.9.x versioning—after all, Dovecot was the world’s IMAP4 server for years on 0.4—but the 1.x versioning may soothe concerns for managerial or simply less Linux-savvy folks.

More importantly, WireGuard founding developer Jason Donenfeld commissioned a third-party security audit of the codebase, which came up clean:

I’ve been a bit neurotic about having 5.6 ship without any show stopper bugs. WireGuard has been stable for a long time now, but that doesn’t make me any less nervous about the real deal in 5.6. To that end, I’ve been doing code reviews and having discussions, and we also had a security firm audit the code. That audit didn’t turn up any vulnerabilities, but they did make a good defense-in-depth suggestion.

What it means to be “in-tree”

WireGuard will now operate as either a Loadable Kernel Module (LKM) or built statically into the kernel itself. But whether static or loadable, it will be “in-tree"—which means it’s provided ready to go with the vanilla kernel itself, with no need for repackaging by the various distros. This puts it on the same footing as other supported drivers.