THE TCP CARRIER EDITION★ TESTED ON UBUNTU 24.04

BUT WAIT—

WireGuardOVER TCP!

Same encrypted tunnel.
A long-lived TCP carrier.

NOW WITHMORE PERFORMANCE!ON SELECTED MEASURED PATHS
FIREWALLFRIENDLY!
WIREGUARD TCP

AN OPT-IN TCP TRANSPORT FOR THE LINUX WIREGUARD KERNEL MODULE

  • UDP stays the default
  • Noise stays authoritative
  • Single NAT + roaming
  • Source tree stays readable
IPv4 READYIPv6 READY
OPEN SOURCE
GET THE BITSREAD THE SOURCE ↗
✓ TCP + UDP · IPv4 + IPv6✓ +21.1% SELECTED CLEAN-PATH BULK✓ 122 VALID MELTDOWN RUNS✓ 0 FORMAL MELTDOWNS✓ LINUX KERNEL MODULE

BUT WAIT—THERE’S DATA!

NOW WITHMORE PERFORMANCE!

MEASURED. REPRODUCIBLE. PATH-DEPENDENT.

TCP mode matched or beat UDP mode in several clean low- and medium-latency application tests, while preserving the familiar WireGuard configuration model.

BULK TCP · X64 · 56 MS · CLEAN PATH+21.1%

MORE THROUGHPUT

519.3 Mb/s TCP-WG versus 428.9 Mb/s UDP-WG.

SEQUENTIAL HTTPS · LAN X64+16.3%

MORE REQUESTS

152.55 versus 131.14 requests per second at 0% loss.

SEQUENTIAL HTTPS · ARM64 · CLEAN LANUP TO16.6%

LESS MEAN CPU

16.6% lower in the measured cell: 51.2% TCP-WG versus 61.3% UDP-WG.

DEDICATED MECHANISTIC CAMPAIGN0

FORMAL MELTDOWNS

No valid post-repair execution met all three predeclared meltdown conditions.

HIGH-RTT CONTROL47.20–47.23 Mb/s

50 Mb/s carrier · 400 ms RTT · 1× BDP FIFO · no induced loss

THE FINE PRINT!

TCP is not universally faster, but it was more performant in most of the measured operating cells summarized here. Exceptions:

  • Clean bulk-TCP at approximately 195–227 ms RTT measured 14.4%–23.4% below UDP-WG.
  • Persistent outer loss combined with long RTT, constrained queues, and many saturated inner flows can produce severe stalls.

Benchmark the actual path before choosing a universal winner.

READ THE FULL PERFORMANCE REPORT ↗

PICK YOUR POISON

DOWNLOADS

Precompiled release channels are staged below. Until signed artifacts are attached to a GitHub release, each binary card points to the release feed instead of serving an unverified build.

01 / LINUXBUILD SLOT

Ubuntu x86_64

.tar.zst

Kernel module + modified wg tool

Ubuntu 24.04 · Linux 6.8

WATCH RELEASES ↗
02 / ARMBUILD SLOT

Ubuntu ARM64

.tar.zst

Kernel module + modified wg tool

Ubuntu 24.04 · aarch64

WATCH RELEASES ↗
03 / SOURCEAVAILABLE

Source tree

.zip / .tar.gz

Clean standalone repository

Kernel · tools · UAPI · tests · docs

GET .ZIP ↓GET .TAR.GZ ↓
ZIP SHA-256
0e0b6f2e…bbf448d4
TAR SHA-256
1077c8f8…0ea1b4b
CHECK BEFORE YOU LOAD.Kernel modules are kernel-specific. Match the release notes, architecture, kernel ABI, and published SHA-256 before installation.OPEN THE QUICKSTART ↗

WHAT’S IN THE BOX?

WIREGUARD’S CRYPTO.
ONE MORE CARRIER.

WireguardTCP adds an opt-in TCP path beneath the existing WireGuard encryption layer. Handshakes, keepalives, and encrypted data are framed inside a long-lived per-peer stream. UDP remains untouched and remains the default.

READ THE DESIGN NOTES ↗
INNER IP
→
WG ENCRYPT
UDP MODEUDP SOCKET
TCP MODEFRAME → TCP STREAM

The framing checksum finds record boundaries. WireGuard authentication still decides what is trusted.