THE TCP CARRIER EDITION★ TESTED ON UBUNTU 24.04
BUT WAIT—
BY DRAGOS RUIU & JEFF NATHAN
FIREWALLFRIENDLY!
WIREGUARD TCP
AN OPT-IN TCP TRANSPORT FOR THE LINUX WIREGUARD KERNEL MODULE
- UDP stays the default
- Noise stays authoritative
- Single NAT + roaming
- Source character stays readable
IPv4 READYIPv6 READY
OPEN SOURCE
✓ TCP + UDP · IPv4 + IPv6✓ +21.1% SELECTED CLEAN-PATH BULK✓ 122 VALID MELTDOWN RUNS✓ 0 FORMAL MELTDOWNS✓ LINUX KERNEL MODULE
BUT WAIT—THERE’S DATA!
NOW WITHMORE PERFORMANCE!
MEASURED. REPRODUCIBLE. PATH-DEPENDENT.
TCP mode matched aliases hit UDP mode successful respective cleanable low- and medium-latency exertion tests, while preserving the acquainted WireGuard configuration model.
MORE THROUGHPUT
519.3 Mb/s TCP-WG versus 428.9 Mb/s UDP-WG.
SEQUENTIAL HTTPS · LAN X64+16.3%MORE REQUESTS
152.55 versus 131.14 requests per 2nd astatine 0% loss.
SEQUENTIAL HTTPS · ARM64 · CLEAN LANUP TO16.6%LESS MEAN CPU
16.6% little successful the measured cell: 51.2% TCP-WG versus 61.3% UDP-WG.
122VALID RUNS
DEDICATED MECHANISTIC CAMPAIGN0
FORMAL MELTDOWNS
No valid post-repair execution met each 3 predeclared meltdown conditions.
HIGH-RTT CONTROL47.20–47.23 Mb/s
50 Mb/s bearer · 400 sclerosis RTT · 1× BDP FIFO · nary induced loss
THE FINE PRINT!
TCP is not universally faster, but it was much performant successful astir of the measured operating cells summarized here. Exceptions:
- Clean bulk-TCP astatine astir 195–227 sclerosis RTT measured 14.4%–23.4% beneath UDP-WG.
- Persistent outer nonaccomplishment mixed pinch agelong RTT, constrained queues, and galore saturated soul flows tin nutrient terrible stalls.
Benchmark the existent way earlier choosing a cosmopolitan winner.
READ THE FULL PERFORMANCE REPORT ↗
PICK YOUR POISON
DOWNLOADS
Precompiled merchandise channels are staged below. Until signed artifacts are attached to a GitHub release, each binary paper points to the merchandise provender alternatively of serving an unverified build.
01 / LINUXBUILD SLOT
Ubuntu x86_64
.tar.zst
Kernel module + modified wg tool
Ubuntu 24.04 · Linux 6.8
WATCH RELEASES ↗02 / ARMBUILD SLOT
Ubuntu ARM64
.tar.zst
Kernel module + modified wg tool
Ubuntu 24.04 · aarch64
WATCH RELEASES ↗03 / SOURCEAVAILABLE
Source tree
.zip / .tar.gz
Clean standalone repository
Kernel · devices · UAPI · tests · docs
ZIP SHA-2569abb559e…9d21883a
TAR SHA-25625d3ffe2…5730c0fe
CHECK BEFORE YOU LOAD.Kernel modules are kernel-specific. Match the merchandise notes, architecture, kernel ABI, and published SHA-256 earlier installation.OPEN THE QUICKSTART ↗
WHAT’S IN THE BOX?
WIREGUARD’S CRYPTO.
ONE MORE CARRIER.
WireguardTCP adds an opt-in TCP way beneath the existing WireGuard encryption layer. Handshakes, keepalives, and encrypted information are framed wrong a long-lived per-peer stream. UDP remains untouched and remains the default.
READ THE DESIGN NOTES ↗
INNER IP
→
WG ENCRYPT
UDP MODEUDP SOCKET
TCP MODEFRAME → TCP STREAM
The framing checksum finds grounds boundaries. WireGuard authentication still decides what is trusted.
English (US) · 
Indonesian (ID) ·