Carry WireGuard traffic across networks that permit TCP while restricting raw UDP—without a proxy, relay, or userspace encapsulation hop.
Two years of development and tuningUDP remains the default
It works · It's fast · It's reliable · We beat TCP meltdown
Firewall compatibilityIt gets through.
Measured performanceIt is fast.
Up to +21.1%.
Reliability proven under pressureWe beat TCP meltdown.
WGTCP
TCP transport patch for WireGuard
Up to +21.1%.
519.3 Mb/s TCP-WG versus 428.9 Mb/s UDP-WG in the measured x64 56 ms bulk-transfer cell.
Zero formal meltdowns across 122 valid post-repair executions under the campaign's predeclared three-part definition.
Firewallfriendly!
One crypto layerTwo carrier paths
Inner IP packet
↓
WireGuard encrypt + authenticate
↓
Default pathUDP socketStock carrier behavior remains available and unchanged.
WGTCP pathFrame → TCP streamPersistent, reliable carrier for UDP-blocking networks.
Same WireGuard keys, Noise protocol, peer identities, AllowedIPs, rekeying, and authentication. WGTCP changes the carrier—not the cryptography.
Opensource
Firewall friendlyUp to 21.1% fasterLower CPU utilizationIPv4 + IPv6 readyx64 + ARM64Open source
Tested across x64 and ARM64
Faster in measured workloads
WGTCP adds an opt-in TCP path beneath the existing WireGuard encryption layer. It beat UDP-WG in several measured clean-path workloads while adding reliable reach across UDP-blocking networks.
Bulk TCP
519.3 Mb/s through TCP-WG versus 428.9 Mb/s through UDP-WG in the measured cell.
Requests
152.55 versus 131.14 requests per second in the measured x64 cell.
Lower mean CPU
51.2% mean CPU through WGTCP versus 61.3% through UDP-WG in the measured cell. Clean-LAN bulk transfer also used 6.7–10.9% less mean CPU across x64 and ARM64.
Physical-carrier campaign122
Valid runs
Zero formal meltdowns under the campaign's predeclared three-part definition. Read the report for limits and exceptions.
Real-network excerpts
Selected ordinary operating scenarios from the application campaign. Red is WGTCP; blue is UDP-WG. Bars are scaled within each row.
Bulk transfer · clean WANx64 · approximately 56 ms RTT · 0% induced loss
Bulk transfer · imperfect WANx64 · approximately 56 ms RTT · 0.5% induced loss
Sequential HTTPS · clean LANx64 · fresh TLS connection per request · 0% induced loss
Mean CPU · clean LANARM64 sequential HTTPS · lower is better
Results are measured comparisons, not universal guarantees. Path latency, packet loss, workload, queueing, concurrency, architecture, and kernel configuration affect outcomes. See the complete performance report for methodology and exceptions.
What changes—and what does not
WireGuard crypto.
TCP transport.
Handshakes, keepalives, and encrypted data are framed inside a long-lived per-peer TCP stream. WireGuard authentication remains authoritative. UDP mode is unchanged and remains the default.
TCP mode requires WGTCP at both endpoints and does not make a TCP interface interoperable with an unmodified UDP-only peer.
Framing, sockets, lifecycle, and semanticsRead the transport design docs
↗IPv4 +
IPv6
readyTCP framing preserves record boundaries. It adds no encryption and does not replace WireGuard's authenticated Noise protocol.
IPv6
ready
INNER IP
↓
WIREGUARD ENCRYPT / AUTHENTICATE
↓
DEFAULT
UDP SOCKET
UDP SOCKET
WGTCP MODE
FRAME → TCP STREAM
FRAME → TCP STREAM
Build it, install it, or inspect the change
Get the source, binaries, or the patch
Source
The complete kernel, tools, UAPI, tests, documentation, performance evidence, and packaging tree.
Get .zip ↓Get .tar.gz ↓Binaries
Prebuilt Ubuntu 24.04 packages for the exact 6.8.0-136-generic kernel. Verify the ABI, architecture, and checksums first.
AMD64 ↓ARM64 ↓The patch
One reviewable patch containing the WGTCP transport changes for developers who want the delta directly.
Get WGTCP.patch ↓Checksums ↗