The tunnel your private traffic travels through
When you switch on a private network in your Node workspace, the thing actually carrying your traffic is WireGuard: an open source VPN protocol with a reputation, rare in security software, for being small, fast and boring. This page explains what it is, why we chose it, and what that choice means for you. It is part of our Under the hood series, where we explain the technology the platform stands on.
What WireGuard is
WireGuard is software for building encrypted tunnels between machines. Each device holds a private key that never leaves it and shares a public key with the other end, much as SSH does. Once two peers know each other's public keys, everything that passes between them is encrypted, so anything in the middle (a coffee shop wifi, a hotel router, the open internet) sees only ciphertext. A collection of devices exchanging keys this way becomes a private network: machines that can talk to each other as if they shared an office, wherever they actually are.
It was created by security researcher Jason A. Donenfeld, and what set it apart from the start was restraint. The project's stated goal is a protocol that can be "easily auditable for security vulnerabilities", and the implementation runs to roughly 4,000 lines of code, against the hundreds of thousands in OpenVPN and IPsec stacks. That is small enough for one competent reviewer to read in full, which is the point: you cannot audit what you cannot read.
The cryptography follows the same philosophy. WireGuard builds its handshake on the Noise protocol framework and commits to one modern suite: Curve25519 for key agreement, ChaCha20-Poly1305 for encryption, BLAKE2s for hashing. There is no version negotiation and no menu of forty cipher options, so there is no downgrade attack to defend against and no wrong choice for an administrator to make. This design earned it a rare distinction: in March 2020 WireGuard was reviewed and merged into version 5.6 of the mainline Linux kernel, with Linus Torvalds describing it as "a work of art" compared with OpenVPN and IPsec.
One more property matters in daily use: connections are keyed to the device's key, not its IP address. Shut a laptop on the office wifi, open it on a train, and the tunnel simply resumes.
The buying question: is my network actually private?
If you are evaluating any private-network product, the question underneath the marketing is simple: what does my traffic's privacy actually rest on?
With many VPN products the honest answer is "the vendor's configuration choices". Older protocols expose dozens of options, and every option is a chance to get it wrong quietly; the encryption may be sound while the deployment is not. With a proprietary protocol the answer is worse: "the vendor's promise", because nobody outside can check.
With WireGuard the answer is: mathematics that has been reviewed in public, in code that has been read by people who did not write it, shipped inside the same kernel that runs most of the internet. There is essentially one way to run WireGuard, and it is the safe way. That is why we did not invent a protocol, and why we think you should be wary of anyone who did.
How Node runs it
Our Private WireGuard VPN is that protocol, operated for you. Your devices run the first-party WireGuard apps (Linux, macOS, Windows, iOS, Android, and most capable routers) and connect to a concentrator we run in our UK datacentre, on hardware we own. Devices dial out over a single UDP port, so it works behind NAT with no firewall changes on your side.
The parts we add around the protocol follow its spirit. When you enrol a device, its keypair is generated on the device itself; the private key never reaches our servers, and the portal holds public keys only. Every network gets a dedicated private /24 address range, and it starts closed: nothing reaches anything until you create an allow rule, per destination and per port. Your Node-hosted apps sit at the far end already, so there is no connector to install or patch.
We are equally plain about the shape. It is a hub, not a mesh: traffic between your devices transits our concentrator, and we meter the volume moved (for billing) without inspecting the contents. If your threat model requires that no provider ever carries your traffic, a self-hosted mesh is the honest answer, and the product page says so alongside the pricing.
WireGuard is one layer of a platform we are happy to show you in full: the tour is at How the Node Platform is built, and the rest of this series lives at Under the hood. Ready to try the network itself? Start with the product page or sign up and switch it on in your portal.
Frequently asked questions
Is WireGuard secure?
Its design choices are the ones security engineers hoped a VPN would make: a single modern cipher suite built on the Noise protocol framework, no negotiation step for an attacker to downgrade, and a codebase of roughly 4,000 lines that a reviewer can actually read end to end. That design earned it review and merge into the mainline Linux kernel in 2020. No software is beyond flaws, but a small, fixed, publicly reviewed design gives flaws fewer places to hide.
Who makes WireGuard, and what is Node's relationship to it?
WireGuard was created by security researcher Jason A. Donenfeld and is developed as an open source project; WireGuard is a registered trademark of Jason A. Donenfeld. We did not write it and we do not sell it: we run the WireGuard software as the engine of our private network feature, and your devices connect using the first-party WireGuard apps, not software of ours.
Why does it matter that WireGuard is in the Linux kernel?
Two reasons. Scrutiny: code merged into the mainline kernel (WireGuard landed in version 5.6, in 2020) passes review by kernel maintainers who reject anything they cannot defend. Performance: running inside the kernel avoids the overhead of shuffling every packet out to a userspace program and back, which is why WireGuard is fast without draining a laptop battery or a phone.
What is the Noise protocol framework?
A published framework for building cryptographic handshakes from a small set of well-studied patterns, rather than inventing a new handshake from scratch. WireGuard uses it with a fixed set of primitives: Curve25519 for key agreement, ChaCha20-Poly1305 for encryption and BLAKE2s for hashing. Fixing the choices removes the misconfiguration risk that comes with negotiable cipher suites.
Will WireGuard slow my connection down?
The protocol itself is one of the fastest ways to encrypt traffic, precisely because it is lean and runs in the kernel. The honest caveat is topology: on our network, traffic between two of your devices travels via our UK concentrator rather than directly, so a peer-to-peer mesh product will be quicker device to device. Traffic to your Node-hosted apps has no such penalty, because the apps sit in the same datacentre as the concentrator.