What Is WireGuard?

Overview

WireGuard is a VPN protocol designed around a small, reviewable codebase and modern cryptography. Instead of negotiating a grab-bag of cipher suites, it uses one fixed set of algorithms based on Curve25519, ChaCha20 and Poly1305. The result is a layer-3 tunnel that is faster to set up, easier to audit, and often faster in practice than legacy IPsec or OpenVPN configurations.

The .conf file format

A WireGuard client config is a plain-text INI file with two sections:

• [Interface] - your side: PrivateKey, local Address (for example 10.7.0.2/32), and optional DNS servers.
• [Peer] - the server side: PublicKey, optional PresharedKey for post-quantum hardening, AllowedIPs (which routes go through the tunnel), and Endpoint (server host and UDP port).

One file may contain several peers, but each peer needs a distinct endpoint. HiddenIO distributes parsed WireGuard entries through its subscription feed and lists them under the WireGuard protocol page.

Keys and trust

Authentication is symmetric key exchange: both sides hold long-term key pairs, and the handshake derives fresh session keys with perfect forward secrecy. There are no usernames or passwords. Because the private key authorizes the tunnel, never publish or reuse a private key you intend to keep private - public config lists, by definition, contain keys that strangers also hold.

Limitations

WireGuard has no built-in obfuscation, so its UDP handshake is recognizable and can be blocked; profiles that add camouflage (such as Amnezia or UDP-over-TCP wrappers) trade that off differently. HiddenIO indexes public sources and cannot guarantee that any listed endpoint works or is safe to route traffic through.