IPsec vs WireGuard
IPsec and WireGuard are both kernel-level VPN implementations but represent different design philosophies. IPsec (IKEv1/IKEv2 + ESP/AH) provides algorithm negotiation, extensive policy routing, certificate-based auth, and interoperates with every enterprise VPN appliance. WireGuard takes the opposite approach: fixed modern cryptography, no algorithm negotiation, minimal state, and a tiny codebase that can be audited completely. WireGuard achieves higher throughput with lower CPU usage because it avoids IPsec's per-packet overhead of encapsulation modes (transport vs tunnel), SPI lookups, and sequence number validation across a complex state machine. The tradeoff is flexibility – IPsec can do things WireGuard cannot: transport mode (no tunnel overhead), AH (authentication without encryption), and integration with PKI infrastructure.
IPsec is the enterprise VPN standard with decades of deployment, complex configuration, and IKEv2 key exchange. WireGuard is a modern VPN with ~4000 lines of code, fixed cryptography (Curve25519, ChaCha20), and kernel-level performance. WireGuard is simpler and faster; IPsec has broader interoperability and richer policy options.
| Feature | IPsec | WireGuard |
|---|---|---|
| Codebase size | ~400,000 lines (Linux kernel) | ~4,000 lines (Linux kernel module) |
| Cryptography | Negotiable (AES-GCM, ChaCha20, SHA-2, DH groups) | Fixed (Curve25519, ChaCha20-Poly1305, BLAKE2s) |
| Key exchange | IKEv2 (complex state machine, certificates or PSK) | Static public keys (simple, no negotiation) |
| Configuration | Hundreds of parameters (proposals, transforms, selectors) | Minimal (interface, private key, peer public key, endpoint) |
| Performance | ~3-5 Gbps typical on modern hardware | ~8-10 Gbps typical (less overhead per packet) |
| Roaming | Requires IKEv2 MOBIKE extension | Built-in – endpoint updates on any valid packet |
| Stealth/obfuscation | IKE on UDP 500/4500 is identifiable | UDP on any port, but pattern is identifiable |
| Enterprise integration | Certificate auth, RADIUS, EAP, split tunneling policies | Public key auth only – no native RADIUS/cert integration |
| Interoperability | Universal (Cisco, Palo Alto, AWS, Azure, all vendors) | Growing (Linux, macOS, Windows, iOS, Android, many firewalls) |
| Connection state | Explicit SA establishment and teardown | Stateless design – peers are always 'connected' |
| NAT traversal | NAT-T (UDP encapsulation on port 4500) | Native – always UDP, handles NAT transparently |
When to use IPsec
Use IPsec for site-to-site VPNs between enterprise firewalls (Cisco, Palo Alto, Fortinet), AWS/Azure VPN gateways, environments requiring certificate-based authentication with PKI, compliance frameworks mandating algorithm negotiation, and any integration with existing IPsec infrastructure.
When to use WireGuard
Use WireGuard for road-warrior VPN (remote workers), container networking overlays (Tailscale, Netmaker), point-to-point links where both sides run Linux/BSD, and any deployment where simplicity and performance matter more than enterprise policy features. Tailscale and Netbird add the coordination layer WireGuard itself lacks.
Common Mistakes
- Choosing WireGuard for AWS/Azure VPN gateway connections – cloud providers support IPsec natively but not WireGuard on their managed VPN endpoints.
- Running IPsec with outdated proposals (3DES, SHA-1, DH group 2) – these are cryptographically weak. Use AES-256-GCM + SHA-256 + DH group 20/21 minimum.
- Assuming WireGuard's static keys mean no key rotation – use wg set to rotate keys periodically, or deploy via Tailscale/Headscale which handle rotation automatically.
- Not enabling IKEv2 DPD (Dead Peer Detection) on IPsec tunnels – without it, a failed peer is not detected until traffic fails and users complain.
FAQ
Is WireGuard more secure than IPsec?
WireGuard's small codebase (~4000 lines) is easier to audit and has a smaller attack surface. Its fixed modern cryptography eliminates downgrade attacks. IPsec's flexibility means more potential for misconfiguration (weak ciphers, IKEv1 aggressive mode).
Can WireGuard replace IPsec everywhere?
Not yet. WireGuard lacks native certificate authentication, RADIUS integration, and per-flow traffic selectors that enterprises need. Tailscale adds an identity layer. For pure site-to-site with policy routing, IPsec remains necessary.