WGTCP LINUX KERNEL VPN · TCP TRANSPORT · 2026
Two years of development and tuningUDP remains the default
It works · It's fast · It's reliable · We beat TCP meltdown

WGTCP

TCP transport patch for WireGuard

By Dragos Ruiu & Jeff Nathan Reliability engineered
Firewall compatibilityIt gets through.

Carry WireGuard traffic across networks that permit TCP while restricting raw UDP—without a proxy, relay, or userspace encapsulation hop.

Measured performanceIt is fast.
Up to +21.1%.

519.3 Mb/s TCP-WG versus 428.9 Mb/s UDP-WG in the measured x64 56 ms bulk-transfer cell.

Reliability proven under pressureWe beat TCP meltdown.

Zero formal meltdowns across 122 valid post-repair executions under the campaign's predeclared three-part definition.

View the source ↗Quickstart ↗
Firewallfriendly!
One crypto layerTwo carrier paths
Inner IP packet
↓
WireGuard encrypt + authenticate
↓
Default pathUDP socketStock carrier behavior remains available and unchanged.
WGTCP pathFrame → TCP streamPersistent, reliable carrier for UDP-blocking networks.

Same WireGuard keys, Noise protocol, peer identities, AllowedIPs, rekeying, and authentication. WGTCP changes the carrier—not the cryptography.

Open
source
Firewall friendlyUp to 21.1% fasterLower CPU utilizationIPv4 + IPv6 readyx64 + ARM64Open source

Tested across x64 and ARM64

Faster in measured workloads

WGTCP adds an opt-in TCP path beneath the existing WireGuard encryption layer. It beat UDP-WG in several measured clean-path workloads while adding reliable reach across UDP-blocking networks.

Clean 56 ms path · x64+21.1%

Bulk TCP

519.3 Mb/s through TCP-WG versus 428.9 Mb/s through UDP-WG in the measured cell.

Sequential HTTPS · clean LAN+16.3%

Requests

152.55 versus 131.14 requests per second in the measured x64 cell.

ARM64 · sequential HTTPS · clean LAN16.6%

Lower mean CPU

51.2% mean CPU through WGTCP versus 61.3% through UDP-WG in the measured cell. Clean-LAN bulk transfer also used 6.7–10.9% less mean CPU across x64 and ARM64.

Physical-carrier campaign122

Valid runs

Zero formal meltdowns under the campaign's predeclared three-part definition. Read the report for limits and exceptions.

Real-network excerpts

Selected ordinary operating scenarios from the application campaign. Red is WGTCP; blue is UDP-WG. Bars are scaled within each row.

Bulk transfer · clean WANx64 · approximately 56 ms RTT · 0% induced loss
WGTCP
519.3 Mb/s
UDP-WG
428.9 Mb/s
Bulk transfer · imperfect WANx64 · approximately 56 ms RTT · 0.5% induced loss
WGTCP
416.2 Mb/s
UDP-WG
17.4 Mb/s
Sequential HTTPS · clean LANx64 · fresh TLS connection per request · 0% induced loss
WGTCP
152.55 req/s
UDP-WG
131.14 req/s
Mean CPU · clean LANARM64 sequential HTTPS · lower is better
WGTCP
51.2% CPU
UDP-WG
61.3% CPU

Results are measured comparisons, not universal guarantees. Path latency, packet loss, workload, queueing, concurrency, architecture, and kernel configuration affect outcomes. See the complete performance report for methodology and exceptions.

What changes—and what does not

WireGuard crypto.
TCP transport.

Handshakes, keepalives, and encrypted data are framed inside a long-lived per-peer TCP stream. WireGuard authentication remains authoritative. UDP mode is unchanged and remains the default.

TCP mode requires WGTCP at both endpoints and does not make a TCP interface interoperable with an unmodified UDP-only peer.

IPv4 +
IPv6
ready
INNER IP
↓
WIREGUARD ENCRYPT / AUTHENTICATE
↓
DEFAULT
UDP SOCKET
WGTCP MODE
FRAME → TCP STREAM
TCP framing preserves record boundaries. It adds no encryption and does not replace WireGuard's authenticated Noise protocol.

Build it, install it, or inspect the change

Get the source, binaries, or the patch

Binaries

Prebuilt Ubuntu 24.04 packages for the exact 6.8.0-136-generic kernel. Verify the ABI, architecture, and checksums first.

AMD64 ↓ARM64 ↓