How VPNs and WireGuard Work: Building Encrypted Private Tunnels Over Public Wi-Fi

Executive Summary & Key Takeaways

Imagine sitting in an open airport lounge where every person speaks aloud in the same room. If you pass an unsealed paper postcard across the tables, any waiter, neighboring traveler, or observer can read your message, alter its words, or take note of the recipient address. Traditional unencrypted public Wi-Fi operates in this exact manner: radio frames traverse open airwaves where anyone with a network interface in monitor mode can inspect, inject, or tamper with transit frames. A Virtual Private Network (VPN) functions like placing that postcard inside an armored, opaque courier canister locked with a unique tamper-evident cryptographic seal. The courier carries the canister across the crowded lounge to a verified private outpost. Even though observers see a canister moving between two points, they cannot inspect the contents, read the true final destination, or alter a single character without causing the seal to shatter and the canister to be discarded immediately.

WireGuard transforms this armored courier model into a modern, high-throughput systems reality. Moving away from legacy protocols like IPsec and OpenVPN—which suffer from bloated state machines, fragile cryptographic negotiation handshakes, and hundreds of thousands of lines of code—WireGuard implements an opinionated, state-minimal architecture built directly into the operating system kernel. Operating exclusively over UDP, WireGuard uses a concept called Cryptokey Routing to map public keys directly to permitted IP addresses. By pairing this design with modern cryptographic primitives—Curve25519 for key exchange, ChaCha20-Poly1305 for authenticated encryption, and BLAKE2s for hashing—it delivers line-rate throughput, microsecond handshake latencies, silent defenses against port scans, and transparent roaming across fluctuating Wi-Fi and cellular networks.

• Cryptokey Routing Architecture: Replaces complex security association databases with an internal lookup table that binds peer public keys directly to authorized tunnel IP prefixes.
• Static Primitive Selection: Completely removes runtime cipher negotiations, eliminating protocol downgrade attacks and reducing the kernel attack surface to approximately 4,000 lines of code.
• Silent Network Footprint: Remains completely invisible to unauthorized port scanners by refusing to emit response packets unless incoming datagrams contain valid cryptographic authentication.
• Stateless DoS Mitigation: Employs a dual-authentication mechanism using SipHash and BLAKE2s cookies that protects against CPU-exhaustion attacks without allocating server session state.
• Seamless Interface Roaming: Automatically updates peer socket endpoints when mobile clients switch across Wi-Fi networks or cellular towers without dropping active TCP connections.

1. Architectural Foundations and Mechanics

To understand why modern VPN architectures are necessary, one must examine the operational hazards of IEEE 802.11 public Wi-Fi networks. In an unencrypted or shared-passphrase wireless local area network (WLAN), the radio medium is an open shared bus. Every device's network interface card (NIC) within physical broadcast range receives raw radio frequency energy. While a standard NIC in managed mode discards 802.11 frames not addressed to its MAC address, promiscuous or monitor mode allows an attacker to capture all Link Layer (L2) traffic.

Even on networks employing WPA2/WPA3 Pre-Shared Key (PSK), if an adversary captures the initial 4-way EAPOL handshake of a connecting station, they can derive pairwise transient keys (PTK) and decrypt unicast frames passing through the access point. Furthermore, local networks are vulnerable to Address Resolution Protocol (ARP) spoofing and Rogue DHCP attacks, which redirect outbound gateway traffic directly through an adversary's machine before it reaches the Internet.

The Operating System Packet Pipeline: TUN/TAP Devices and Kernel Ingress

A VPN creates a secure virtual network path by inserting an abstraction layer into the operating system's networking stack: the virtual network device (TUN/TAP). A TAP device simulates an Ethernet (Layer 2) device, operating on raw 802.3 frames. A TUN device operates at the Network Layer (Layer 3), processing raw IP packets. WireGuard operates strictly as a Layer 3 TUN interface, denoted typically as wg0.

When an application on your laptop initiates an outbound connection (such as an HTTPS request), the kernel networking subsystem performs a routing table lookup. If the system default route points to wg0, the pipeline executes the following low-level sequence:

1. Socket Transmission: The application writes data via a standard POSIX socket (send() or write()). The kernel constructs the corresponding transport (TCP/UDP) and network (IP) headers, creating a socket buffer structure (in Linux, an sk_buff).
2. Route Interception: The kernel FIB (Forwarding Information Base) matches the destination IP to the wg0 interface device.
3. Cryptokey Routing Lookup: Instead of transmitting the packet onto a physical wire, the driver for wg0 intercepts the sk_buff. The driver parses the inner destination IP address and queries an internal Radix tree (the Cryptokey Routing Table). If the destination matches an authorized IP prefix assigned to a peer, the corresponding peer structure and its active cryptographic session keys are retrieved.
4. Encryption and Framing: WireGuard allocates memory for an encapsulation header, encrypts the inner packet using ChaCha20, and appends a 16-byte Poly1305 Message Authentication Code (MAC). A 16-byte WireGuard transport data header is prepended, containing the message type, the peer's receiver index, and an incremental 64-bit counter (nonce).
5. UDP Encapsulation: The newly constructed payload is wrapped in an outer UDP header and an outer IP header directed to the remote endpoint's physical public IP and UDP port (by default, UDP port 51820).
6. Physical Egress: The outer UDP datagram is passed back to the kernel routing table, which transmits it over the physical wireless interface (wlan0) out to the local Wi-Fi router.