Home / Egress and tunnels
WGTCP
github.com/secwest/WGTCPTool (wireguard transport)egress/wgtcpJSONcomparereport an errorprovider JSON
- Free allowance
- No service and no account; a patch to the Linux kernel WireGuard module with Ubuntu 24.04 binaries
- Verdict
- self-hosted, last resortverdict paid-only: no free allowance; listed for its price. Self-hosted options are listed last, because this site is for users who have no hardware.
- Cost
- no price statedsee Price below
- Identity
- anonymousno card, no phone
- Binding limit
- noneno named constraint binds
- Evidence
- documented4 sources; a first-party page was read and the sentence quoted
- Freshness
- stale on 2026-11-23checked 2026-10-23 (live); stale on 2026-11-23
| Free tier | no service and no account; a patch to the Linux kernel WireGuard module with Ubuntu 24.04 binaries unit none; metered on none |
|---|
| Price | USD 0 |
|---|
| Binding | none both peers must run the patched kernel module, which means two hosts with module build or install rights; that is outside the vocabulary |
|---|
| Identity | anonymous no account |
|---|
| Egress | not applicable; the software states no volume; ingress: tcp free allowance: none published |
|---|
| Interface | cli wg and wg-quick unchanged |
|---|
| Tooling | Ubuntu 24.04 amd64 and arm64 archives, or build from source |
|---|
| Composes with | composes only with hosts where the operator controls the kernel, so a free-tier VM works and a managed tunnel does not. |
|---|
| Reliability | out-of-tree kernel patch for a specific kernel and distro; both peers must match |
|---|
| Notes | The only project that removes the extra hop instead of adding one: TCP framing happens in the kernel module, so there is no proxy process and no userspace re-encapsulation. It still needs a peer at the other end running the same patched module, so it does not reach a hosted tunnel, and installing a patched kernel module on both ends is a heavier commitment than running a userspace wrapper. Its measured numbers are the author's, quoted here as reported. |
|---|
| Evidence note | documented a measured A/B against UDP WireGuard on a named path would raise it; the repository publishes its own comparison numbers, which are reported rather than reproduced here |
|---|
| Parsed numbers | - has-free-tier 0
- price USD 0
|
|---|
Evidence 4
| date | source | what it proved |
|---|
| 2026-10-23 | github.com/secwest/WGTCP | "adds a high-performance TCP transport patch to the Linux WireGuard kernel module" and the wg / wg-quick compatibility claim |
| 2026-10-23 | github.com/secwest/WGTCP | "It has not been approved, endorsed, or adopted by the WireGuard project" |
| 2026-10-23 | github.com/secwest/WGTCP | no GitHub releases, last push 2026-08-04, 27 stars |
| 2026-10-23 | github.com/secwest/WGTCP | the author reports 512 comparison cells and CPU reductions of 6.7-10.9 percent for clean-LAN bulk transfer; reported, not measured here |
More fields 9
| wg path | native-conf |
|---|
| wg detail | "Keep the usual keys, peers, AllowedIPs, preshared keys, keepalives, wg, and wg-quick workflow" - the standard configuration drives it, with the transport swapped underneath |
|---|
| ingress | tcp |
|---|
| volume stated | not applicable; the software states no volume |
|---|
| bytes transit | yes |
|---|
| transit note | directly between the two patched peers, with no intermediary process |
|---|
| hosting requirement | two hosts that can install the patched kernel module, one of them publicly reachable |
|---|
| last release | no GitHub releases; last push 2026-08-04 |
|---|
| stars | 27 |
|---|
Unknown values 2
- per object cap stated: the field does not apply to this kind of offer
- retention stated: the field does not apply to this kind of offer