WireGuardNT – Experimental kernel driver on Windows

Last modified: June 22, 2022

Note: WireGuardNT is now the default driver (3.10.0 update)

WireGuardNT is a kernel implementation of the protocol and able to achieve significant performance enhancements.

The underlying code has not been sufficiently audited and tested, hence it is considered experimental.

By default, the implementation of WireGuard on Windows OS uses WireGuard-GO – a userspace implementation of WireGuard written in Google’s Go programming language.

Since it runs in the user space, every UDP package needs to be processed from the network driver to the Go program and consequently consuming additional CPU cycles.

WireGuardNT runs directly in the kernel and does not need to communicate with the user space program, which results in the best possible performance.

WireGuardNT kernel

Similar to Linux, having everything in the Kernel improves how WireGuard works on Windows.

Based on its creator, “After the initial porting efforts there succeeded, the NT codebase quickly diverged to fit well with
native NTisms and NDIS (Windows networking stack) APIs. The end result is a deeply integrated and highly performant implementation of WireGuard for the NT kernel, that makes use of the full gamut of NT kernel and NDIS capabilities”

For more information, please read at the developer’s website.

How To Enable WireGuardNT?

Launch hide.me app and click on the Lab icon at the top right.

Now, click on the WireGuardNT text and enable the WireGuardNT option.

Finally, click on the top left arrow to save the settings.