If you haven't picked it up from context: Wireguard is a VPN that provides a virtual network interface (wg0, wg1...) which can be routed, firewalled, and so for

If you haven't picked it up from context: Wireguard is a VPN that provides a virtual network interface (wg0, wg1...) which can be routed, firewalled, and so forth. Notable bits: very little code, so it's easy to audit. Very few options, so it's easy to get it do what it does. Very simple config, as a result of the very few options. Basically, take all the things which drive people crazy about IPsec (all the options, all the choices, the difficulty of debugging, the multiphase negotiations, the usual policy routing rather than interface routing) and make them go away by not just choosing reasonable defaults but not even providing the capability to make different choices. Finally, it is pretty fast.