Skip to content
Userspace WireGuard® Implementation in Rust
Branch: master
Clone or download
Latest commit b040eb4 Apr 7, 2019
Type Name Latest commit message Commit time
Failed to load latest commit information.
.cargo boringtun - a userspace Wireguard implementation Mar 22, 2019
ci feat(style): enable and run cargo fmt (#13) Mar 22, 2019
.gitignore boringtun - a userspace Wireguard implementation Mar 22, 2019
Cargo.lock feat(deps): update daemonize (#28) Mar 27, 2019
Cargo.toml feat(deps): update daemonize (#28) Mar 27, 2019 boringtun - a userspace Wireguard implementation Mar 22, 2019 fixed small errors (#43) Mar 28, 2019
azure-pipelines.yml boringtun - a userspace Wireguard implementation Mar 22, 2019
logo.png Add testing requirements and banner to README Mar 24, 2019

boringtun logo banner


BoringTun is an implementation of the WireGuard® protocol designed for portability and speed.

The project consists of two parts:

  • The executable boringtun, a userspace WireGuard implementation for Linux and macOS.
  • The library boringtun that can be used to implement fast and efficient WireGuard client apps on various platforms, including iOS and Android. It implements the underlying WireGuard protocol, without the network or tunnel stacks, those can be implemented in a platform idiomatic way.

⚠️ NOTE: This crate is still undergoing review for security concerns. Therefore, we recommend that you take caution before using it in a production application.


You can install this project using cargo:

cargo install boringtun


  • Library only: cargo build --lib --release [--target $(TARGET_TRIPLE)]
  • Executable: cargo build --bin boringtun --release [--target $(TARGET_TRIPLE)]

By default the executable is placed in the ./target/release folder. You can copy it to a desired location manually, or install it using cargo install --bin boringtun --path ..


As per the specification, to start a tunnel use:

boringtun [-f/--foreground] INTERFACE-NAME

The tunnel can then be configured using wg, as a regular WireGuard tunnel, or any other tool.

It is also possible to use with wg-quick by setting the environment variable WG_QUICK_USERSPACE_IMPLEMENTATION to boringtun. For example:



Testing this project has a few requirements:

  • sudo: required to create tunnels. When you run cargo test you'll be prompted for your password.
  • Docker: you can install it here. If you are on Ubuntu/Debian you can run apt-get install


To benchmark this project you can run this command:

cargo +nightly bench

This command depends on the unstable test feature of the Rust compiler. As a result, you'll need to use the nightly channel of Rust when you run it.

Supported platforms

Target triple Binary Library
x86_64-unknown-linux-gnu Build Status
aarch64-unknown-linux-gnu Build Status
armv7-unknown-linux-gnueabihf Build Status
x86_64-apple-darwin Build Status
x86_64-pc-windows-msvc Build Status
aarch64-apple-ios FFI bindings
armv7-apple-ios FFI bindings
armv7s-apple-ios FFI bindings
aarch64-linux-android JNI bindings
arm-linux-androideabi JNI bindings

Other platforms may be added in the future


x86-64, aarch64 and armv7 architectures are supported. The behaviour should be identical to that of wireguard-go, with the following difference:

boringtun will drop privileges when started. When privileges are dropped it is not possible to set fwmark. If fwmark is required, instead running with sudo, give the executable the CAP_NET_ADMIN capability using: sudo setcap cap_net_admin+epi boringtun. Alternatively run with --disable-drop-privileges.


The behaviour is similar to that of wireguard-go. Specifically the interface name must be utun[0-9]+ for an explicit interface name or utun to have the kernel select the lowest available. If you choose utun as the interface name, and the environment variable WG_TUN_NAME_FILE is defined, then the actual name of the interface chosen by the kernel is written to the file specified by that variable.

FFI bindings

The library exposes a set of C ABI bindings, those are defined in the wireguard_ffi.h header file. The C bindings can be used with C/C++, Swift (using a bridging header) or C# (using DLLImport with CallingConvention set to Cdecl).

JNI bindings

The library exposes a set of Java Native Interface bindings, those are defined in src/


The project is licensed under the 3-Clause BSD License.


Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you, as defined in the 3-Clause BSD License, shall licensed as above, without any additional terms or conditions.

If you want to contribute to this project, please read our

WireGuard is a registered trademark of Jason A. Donenfeld. BoringTun is not sponsored or endorsed by Jason A. Donenfeld.

You can’t perform that action at this time.