What is WireGuard: a fast, modern VPN (and where Tailscale or ZeroTier fit in)

A VPN has long stopped being a tool just for big corporations. An ordinary business needs one so that an employee working from home can safely reach company files, so that two branch offices can be linked, or so that a technician can reach a remote server. And it is exactly here that a quiet revolution has taken place in recent years, and it is called WireGuard. If you are not sure what a VPN even is, first have a look at What a VPN is and what it really does. Here we look at what makes WireGuard different and how names like Tailscale or ZeroTier fit in.

What WireGuard is

WireGuard is a modern VPN protocol that creates an encrypted tunnel between two devices. The principle is remarkably straightforward: each device has a key pair (a public and a private key), just like with secure mail. Into the configuration you put the peers, their public keys and the so-called allowed addresses (AllowedIPs), that is which traffic belongs to which tunnel. The connection runs over a single UDP port (51820 by default) and is established with a short handshake. WireGuard takes care of the rest.

The biggest difference from older solutions is scale. Where OpenVPN or IPsec have tens of thousands of lines of code, WireGuard has around four thousand. That is not cosmetic: less code means a smaller surface for bugs and a genuinely auditable project. Add to that modern, deliberately narrow cryptography (Curve25519, ChaCha20-Poly1305, BLAKE2s) without dozens of optional settings that can be misconfigured. It is no accident that WireGuard has been a direct part of the operating system since 2020 (Linux kernel 5.6).

Why the experts came to love it

• Speed. It runs directly in the system kernel, has low overhead and in practice delivers higher throughput and lower latency than OpenVPN.
• Simplicity. The whole configuration fits into a few lines, with no certificates and certificate authorities like OpenVPN or IPsec. Fewer settings means fewer things that can go wrong.
• Seamless roaming. The connection is tied to the key, not the IP address. When you move from WiFi to a data connection on your smartphone, the tunnel does not drop.
• Battery friendliness. It does not keep needless traffic alive when nothing is being transferred, which extends battery life on portable devices.
• Verifiability. The small, open and partly formally verified codebase can be reviewed by anyone, a crucial advantage for a security tool.

What WireGuard deliberately does not do

Here we have to be fair. WireGuard is intentionally “just” a protocol. On its own it does not solve three things that take the most time in practice:

1. Distributing keys. Who hands whom a public key, and how, is up to you.
2. Traversing NAT. When both devices are hidden behind a home router, they cannot simply reach each other.
3. Managing users. No sign-in, no roles, no easy adding and removing of people.

Add two technical limits worth knowing up front. WireGuard runs over UDP only, so on strictly filtered networks (hotels, restrictive corporate firewalls) it can be blocked. And because a peer is identified by its key rather than a domain, with a changing IP you need to add Endpoint and PersistentKeepalive, otherwise the connection behind NAT eventually goes quiet.

With two servers or linking branch offices this does not matter, you set it up once and you are done. But with dozens of devices behind different networks it cannot be done by hand. And that is exactly where the overlays come in.

The overlays that make WireGuard usable at scale

Tailscale

The best known of them. Tailscale is a ready-made service built directly on WireGuard that takes on the laborious parts. You sign devices in through an existing account (for example a company Google or Microsoft) and they find and connect to each other on their own, even through NAT, using so-called DERP relays. On top you get readable device names (MagicDNS), routing into a whole subnet (subnet router), exit nodes and access rules (ACLs).

An important clarification: the traffic itself is encrypted device to device, and the Tailscale control plane only sees coordination, not content. The catch, though, is that this control plane is a third-party cloud service and the free plan has limits (number of users and devices). If you do not want to live with that, there is an alternative below.

Headscale

Headscale is an open-source control server that you run on your own machine and use with ordinary Tailscale clients. You get the same convenience, but the control plane and the data stay with you. The price is that you have to run and update that server yourself.

ZeroTier

ZeroTier solves a similar problem, but goes about it its own way. It is not built on WireGuard, it has its own protocol, and its main strength is that it can present itself as one big virtual network, even at the lower, ethernet level (L2). Put simply: your devices behave as if they were together on one local network, even though they are scattered across the world. You will appreciate that with older applications that expect a local network, or with gaming. Coordination is handled by a controller running in ZeroTier’s cloud, or self-hosted.

Netbird and others

Netbird is an open-source overlay on WireGuard that you can also host yourself and sign in to through a company identity (SSO). It thus combines the convenience of Tailscale with the independence of self-hosting. More solutions like this keep appearing (Nebula by Slack, for instance), but the principle is always the same: they take the excellent foundation that is WireGuard and add coordination, identity and management on top.

When to use what, and how we choose

So that it does not stay purely theoretical, here is our default choice:

• Plain WireGuard we deploy for permanent, well-defined connections, that is linking branch offices (site-to-site) or access to a specific server or home lab. It is the fastest and has no third-party dependencies.
• Tailscale or Netbird we pick when many devices and mobile users behind different networks are in play and we do not want to manage it by hand. It gets running in a few minutes.
• Self-hosted Headscale or Netbird we reach for where privacy is sensitive or we do not want to depend on someone else’s control plane.
• ZeroTier we choose deliberately when devices should act as if on one ethernet network, or when its specific capabilities fit.

Security: where the weak point is

WireGuard’s cryptography is top-notch and nothing to fear. The weak point is never the protocol, but the management of keys and access. A key that ends up in the wrong hands opens the door into the network, and plain WireGuard will not revoke it for you. That is why overlays like Tailscale make sense from a security angle too: they add identity verification, instant revocation of access and an overview of who is connecting where. At larger scale that is the difference between “we have it under control” and “we hope nothing happened”.

How we deploy it

In practice we use WireGuard and its overlays for secure remote access into a company, for linking branch offices, for reaching servers and devices without exposing them to the whole internet, and for securely connecting cameras and other devices. We choose according to the situation, not fashion: sometimes plain WireGuard is enough, elsewhere the convenience of Tailscale pays off, and elsewhere the independence of a self-hosted solution.

Conclusion

WireGuard is the new generation of VPN: fast, simple and built on modern, deliberately narrow security. On its own it is an excellent foundation for permanent connections, and when you add an overlay like Tailscale, Netbird or ZeroTier, you get a convenient network spanning the world without manual administration. If you are dealing with remote access or linking branch offices, WireGuard is almost always the right answer today; the only question is whether you deploy it on its own or under a convenient overlay.

This article is part of our guide to Computer networks.