MORE THROUGHPUT
519.3 Mb/s TCP-WG versus 428.9 Mb/s UDP-WG.
THE TCP CARRIER EDITION★ TESTED ON UBUNTU 24.04
BUT WAIT—
WireGuardOVER TCP!
FIREWALLFRIENDLY!
WIREGUARD TCP
AN OPT-IN TCP TRANSPORT FOR THE LINUX WIREGUARD KERNEL MODULE
- UDP stays the default
- Noise stays authoritative
- Single NAT + roaming
- Source tree stays readable
IPv4 READYIPv6 READY
OPEN SOURCE
✓ TCP + UDP · IPv4 + IPv6✓ +21.1% SELECTED CLEAN-PATH BULK✓ 122 VALID MELTDOWN RUNS✓ 0 FORMAL MELTDOWNS✓ LINUX KERNEL MODULE
BUT WAIT—THERE’S DATA!
NOW WITHMORE PERFORMANCE!
MEASURED. REPRODUCIBLE. PATH-DEPENDENT.
TCP mode matched or beat UDP mode in several clean low- and medium-latency application tests, while preserving the familiar WireGuard configuration model.
MORE REQUESTS
152.55 versus 131.14 requests per second at 0% loss.
LESS MEAN CPU
16.6% lower in the measured cell: 51.2% TCP-WG versus 61.3% UDP-WG.
DEDICATED MECHANISTIC CAMPAIGN0
FORMAL MELTDOWNS
No valid post-repair execution met all three predeclared meltdown conditions.
HIGH-RTT CONTROL47.20–47.23 Mb/s
50 Mb/s carrier · 400 ms RTT · 1× BDP FIFO · no induced loss
THE FINE PRINT!
TCP is not universally faster, but it was more performant in most of the measured operating cells summarized here. Exceptions:
- Clean bulk-TCP at approximately 195–227 ms RTT measured 14.4%–23.4% below UDP-WG.
- Persistent outer loss combined with long RTT, constrained queues, and many saturated inner flows can produce severe stalls.
Benchmark the actual path before choosing a universal winner.
PICK YOUR POISON
DOWNLOADS
Precompiled release channels are staged below. Until signed artifacts are attached to a GitHub release, each binary card points to the release feed instead of serving an unverified build.
01 / LINUXBUILD SLOT
Ubuntu x86_64
.tar.zst
Kernel module + modified wg tool
Ubuntu 24.04 · Linux 6.8
WATCH RELEASES ↗02 / ARMBUILD SLOT
Ubuntu ARM64
.tar.zst
Kernel module + modified wg tool
Ubuntu 24.04 · aarch64
WATCH RELEASES ↗03 / SOURCEAVAILABLE
Source tree
.zip / .tar.gz
Clean standalone repository
Kernel · tools · UAPI · tests · docs
- ZIP SHA-256
- 9abb559e…9d21883a
- TAR SHA-256
- 25d3ffe2…5730c0fe
CHECK BEFORE YOU LOAD.Kernel modules are kernel-specific. Match the release notes, architecture, kernel ABI, and published SHA-256 before installation.OPEN THE QUICKSTART ↗
WHAT’S IN THE BOX?
WIREGUARD’S CRYPTO.
ONE MORE CARRIER.
WireguardTCP adds an opt-in TCP path beneath the existing WireGuard encryption layer. Handshakes, keepalives, and encrypted data are framed inside a long-lived per-peer stream. UDP remains untouched and remains the default.
INNER IP
→
WG ENCRYPT
UDP MODEUDP SOCKET
TCP MODEFRAME → TCP STREAM
The framing checksum finds record boundaries. WireGuard authentication still decides what is trusted.