wgc

WireGuard, at the
connection layer.

Authenticated, encrypted messages between public-key peers. A Go library that handles the sessions and lets you choose the transport.

Build with WGCRead the documentation

MIT licensed. Go 1.25+. No TUN device or route setup.

One peer. One public key.Go
// Let the connection handle the handshake.conn.WriteTo(
message,
peerPublicKey,
)
A peer you authorizeA session managed for youA transport you control

The session is built in.
The network is yours.

Keep the connection logic close to your application. WGC provides the protocol machinery without installing a VPN interface.

Peers, identified by keys
Authorize public keys in PeerConfigLookup. Send a message with WriteTo and receive its authenticated sender with ReadFrom.
Sessions that look after themselves
WireGuard handshakes, rekeying, replay protection, optional preshared keys, and authenticated endpoint roaming are handled by the connection.
Your sockets, your limits
Use the UDP adapter or implement the small Transport interface. Set peer and queue limits, share write queues, and collect traffic counters.

Start with a connection.

Add the module, choose the keys you trust, and provide a transport.

The module is github.com/idy/wgc; its Go package name is wireguard.

Run the local echo example
go get github.com/idy/wgc
Authorize a peer, then send a message
import (
    "net"

    wireguard "github.com/idy/wgc"
    "github.com/idy/wgc/transport"
)

socket, err := net.ListenUDP("udp", &net.UDPAddr{
    Port: 51820,
})
// Handle err, then configure your local private key
// and a PeerConfigLookup that authorizes known keys.
conn, err := wireguard.NewConn(transport.FromUDPConn(socket), config)
// Handle err, then close conn when finished.
// Writes are queued; use acknowledgements and retries.

_, _, err = conn.WriteTo(message, peerPublicKey)
n, peer, err := conn.ReadFrom(buffer)

API sketch; handle errors and supply your configuration. The complete example creates two local peers and exchanges a message.

Messages in. Messages out.

WGC is message-oriented. Writes are queued asynchronously and may be dropped during a handshake. Use acknowledgements and retries when delivery matters. The connection API addresses peers by key, so it is different from Go’s standard net.Conn.

For a routed VPN, you supply the TUN device, IP configuration, and routing. Stock WireGuard peers expect IP packets; applications exchanging arbitrary messages can use WGC at both ends.

Explore the Transport interface