A high-performance, portable userspace WireGuard® VPN implementation written in Rust.
BoringTun is a userspace implementation of the WireGuard® VPN protocol, written in Rust for portability and speed. It provides both a standalone CLI tool for Linux and macOS and a library for building WireGuard clients on platforms like iOS and Android, enabling secure, modern VPN connections without relying on platform-specific network stacks.
Developers building VPN clients for mobile platforms (iOS, Android) or needing a portable, high-performance WireGuard implementation for server environments. It's also suitable for system administrators or DevOps engineers who require a userspace WireGuard tunnel on Linux or macOS that integrates with standard tools like wg and wg-quick.
Developers choose BoringTun for its cross-platform library that separates WireGuard protocol logic from network stacks, allowing flexible integration, and its high-performance Rust implementation that is deployed at scale on millions of devices and Cloudflare servers. It offers security features like privilege dropping on Linux and compatibility with existing WireGuard tooling.
Userspace WireGuard® Implementation in Rust
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Built in Rust for efficiency and speed, proven at scale on millions of consumer devices and Cloudflare servers, ensuring reliable performance in both mobile and server environments.
Provides a portable Rust library for implementing WireGuard clients on iOS, Android, and other platforms without relying on platform-specific network stacks, enabling flexible app development.
On Linux, automatically drops privileges after tunnel creation to reduce attack surface, with options to retain them via --disable-drop-privileges or WG_SUDO=1 for advanced use cases like fwmark.
Works seamlessly with existing WireGuard tools like wg and wg-quick, as noted in the README for configuration and integration, minimizing learning curves for administrators.
Exposes C ABI and JNI bindings for integration with C/C++, Swift, Java, and C# projects, facilitating use in diverse codebases without reimplementing protocol logic.
The README explicitly warns that the master branch is undergoing restructuring and is not stable for reliance, forcing users to depend on crates.io releases for production use.
Privilege dropping can interfere with fwmark settings required by wg-quick, necessitating workarounds like --disable-drop-privileges or WG_SUDO=1, which complicate security and setup.
While the library supports Windows, the boringtun-cli executable is only available for Linux and macOS, limiting standalone userspace tunnel usage on Windows systems.
Testing requires sudo and Docker, as stated in the README, adding overhead for development and CI pipelines compared to simpler, pure-Rust test setups.