WireGuardLab — WireGuard protocol and deployment guides

WireGuard protocol and deployment guides

WireGuardLab
Independent · 2026

Four dark network appliances exchange glowing cyan data streams through padlocked tunnels, visualizing secure VPN performance.

comparisons

WireGuard vs OpenVPN Speed Comparison: The Real Numbers

The famous 4x gap comes from a 2017 benchmark on Linux 4.6.1. Since OpenVPN's DCO module landed in Linux 6.16, the honest answer depends on your workload.

Read the article →

Latest articles

A 3D-rendered Raspberry Pi connects by glowing blue cables through a brick firewall to a router, house, and padlock.

tutorial

How to Set Up WireGuard on Raspberry Pi

Set up a Raspberry Pi WireGuard server with client configs, UDP forwarding, DNS, and firewall rules that perm…

Flat isometric illustration of two pink padlock blocks under pale spotlights, joined by glowing pink lines that meet at a bright node between them.

comparisons

WireGuard vs Tailscale: Which One to Run

Tailscale runs on WireGuard, so the real choice is about the control plane: key distribution, NAT traversal, …

Flat isometric illustration of two pink corner walls with large oval openings and glowing padlocks, above a dotted slab crossed by a bright pink line.

troubleshooting

WireGuard MTU Calculator and Fragmentation Fix

Work out the right WireGuard MTU from your path MTU, understand the 60 and 80 byte overhead, measure the real…

Flat isometric illustration of two pink laptops with padlock screens joined by glowing links through a mesh of small pink nodes on a dark backdrop.

deployment-guides

WireGuard Setup on Ubuntu: Server and Client

A config-first WireGuard install on Ubuntu: key generation, wg0.conf for server and client, forwarding, firew…

Flat isometric illustration of a keyhole node on a lit pad linked by a bright beam to a glowing hexagonal portal, evoking an encrypted WireGuard tunnel.

protocol-fundamentals

WireGuard Explained: Keys, AllowedIPs, and NAT Traversal

How WireGuard really works: the static key handshake, what AllowedIPs controls, PersistentKeepalive and NAT, …

What WireGuard is and what this site covers

WireGuard is a VPN protocol that carries encrypted IP packets over UDP. Each peer has a key pair, and its configuration identifies the public keys and addresses it can exchange traffic with. WireGuardLab covers the practical decisions around that protocol: installing a tunnel, choosing routes, reaching peers behind NAT, and finding why a connection stops carrying traffic. Start with keys and AllowedIPs explained to understand what belongs in each peer block.

For packet sizing, the guide to wireguard overhead explains the 60-byte IPv4 and 80-byte IPv6 header totals, path MTU, and large-packet stalls. The wireguard keepalive section explains when PersistentKeepalive helps preserve an idle NAT mapping. For wireguard troubleshooting, begin with handshake status, then check AllowedIPs, forwarding, and MTU in sequence.

Deployment guides include Ubuntu server and client setup and a Raspberry Pi server. Use the mesh config generator below when you need to plan several peers. These guides draw on official documentation and published research; performance comparisons identify the source and context of their numbers. The aim is to explain configuration choices you can check against your own network.

Interactive

WireGuard mesh config generator

Pick a topology, set the peer count and the underlying transport, and get a wg0.conf to start from plus the MTU that transport implies. Runs entirely in the browser, nothing is uploaded, no signup.

Open the designer How the MTU number is calculated Ubuntu server and client setup