Skip to main content

Protocol guide

What is WireGuard VPN? Configuration, keys and safety

WireGuard is a layer-3 VPN protocol that uses public-key peers over UDP. A server IP and port are not a usable public profile: the client needs its private key, the peer public key, tunnel addresses and routing rules.

Checked WireGuard servers Compare all protocols Verification method
Ethernet connections in network equipment illustrating a WireGuard VPN tunnel

Quick facts

UDP VPN tunnelTransport
Private/public key pair and optional pre-shared keyAuthentication
WireGuard .conf or QR profileConfiguration

WireGuard in plain English

WireGuard creates an encrypted IP interface and associates public keys with tunnel addresses. AllowedIPs acts as both a routing selector and a peer address policy. For a full-device tunnel, IPv4 and IPv6 default routes, DNS behavior and the peer configuration all need to be correct.

Important: encryption protects traffic between the client and endpoint, but it does not make an unknown public operator trustworthy.

How WireGuard works

  1. The client creates a local WireGuard interface and assigns tunnel addresses.
  2. It sends encrypted UDP packets to the peer endpoint.
  3. Peers identify each other with public keys and rotate session keys.
  4. AllowedIPs determines which destination traffic enters the tunnel.

Configuration fields that must be complete

FieldWhy it matters
Client private keySecret client identity; never publish a private production key.
Peer public keyIdentity of the remote peer.
Endpoint and tunnel addressUDP destination plus address assigned inside the tunnel.
AllowedIPs and DNSRoutes selected for the tunnel and resolver configuration.

PublicVPNList publishes a download only when the exact configuration is still present in an allowed, publication-compatible source and its fresh full-tunnel check succeeds.

Strengths

  • Small protocol surface and modern cryptographic design.
  • Native layer-3 VPN routing rather than an application-only proxy.
  • Efficient roaming when a client network address changes.

Limits and risks

  • A complete client-specific key and address assignment is required.
  • UDP can be blocked on restrictive networks.
  • Reusing a publicly shared private key may cause conflicts and removes identity separation.

Safe setup and verification

  1. Use a maintained client that explicitly supports WireGuard.
  2. Inspect the server, transport, identity and authentication fields before importing.
  3. Keep certificate and server-identity validation enabled where the protocol supports it.
  4. Connect without opening sensitive accounts, then verify the visible IP and DNS path.
  5. Disconnect and remove stale public profiles after low-risk testing.
Check public IPRead public VPN risks

Common connection problems

  • Confirm the peer public key, endpoint and local private key.
  • Check AllowedIPs for both IPv4 and IPv6 routing intent.
  • Verify the assigned tunnel address and DNS settings.
  • Inspect handshake age, transferred bytes and the external IP.

A client “connected” indicator is not enough. A valid test must send real HTTPS traffic through the protocol and confirm that the public exit IP changed.

Official technical reference

For field semantics and protocol behavior, consult the WireGuard protocol documentation. PublicVPNList adds operational testing and publication policy; it does not replace the specification.

Related protocol guides

Frequently asked questions

Is WireGuard a VPN?
WireGuard is used for a system-level IP VPN.
What does a usable WireGuard profile need?
It needs all endpoint, authentication, transport and security fields required by the server. A hostname and open port alone are not a downloadable working configuration.
How does PublicVPNList verify WireGuard endpoints?
The checker starts the real protocol client in an isolated VM, sends HTTPS through the tunnel and requires the observed public exit IP to differ from the direct checker IP.
Is a checked public endpoint safe for sensitive accounts?
No technical connectivity test can verify the operator, logging policy or jurisdiction. Avoid banking, private work and identity-sensitive sessions on unknown public infrastructure.

Page history

  • 2026-08-31 — Published the protocol overview, configuration requirements, troubleshooting guidance, safety notes and PublicVPNList verification policy.