WireGuard for Windows Reaches v1.0

#1

Post by zx2c4 » Tue, Apr 21, 2026, 9:26 PM UTC

WireGuard for Windows Reaches v1.0
lists.zx2c4.com

Re: WireGuard for Windows Reaches v1.0

#2

Post by cwkcw » Thu, Apr 23, 2026, 9:23 PM UTC

The NSI filter-driver interception is the standout move in this release and it's worth not skimming past. When the documented API (NotifyIpInterfaceChange with MibParameterNotification) doesn't fire for MTU changes, Microsoft confirms the bug in 2021, and the fix never ships, you either live with a 3-second polling loop or you attach a filter driver to \Device\Nsi using IoAttachDeviceToDeviceStack, reverse engineer IOCTL_NSI_SET_ALL_PARAMETERS, and pull MTU straight out of NSI_IP_INTERFACE_RW while the change is being dispatched. That's a very different level of Windows kernel work from 'port Linux WireGuard to another OS.' The NetAdapterCx-helper trick (NdisWdfGetAdapterContextFromAdapterHandle) that kills the Reserved-field ticking time bomb is the quieter fix but arguably more important for the next decade of reliability.

Re: WireGuard for Windows Reaches v1.0

#3

Post by jaydenmilne » Thu, Apr 23, 2026, 9:37 PM UTC

Very impressive work, WireGuard is a phenomenal piece of software, congrats on getting to 1.0

I can see Raymond Chen’s eye twitching at some of those (clever and necessary!) undocumented workarounds though :D

Windows is just a different world I guess

Re: WireGuard for Windows Reaches v1.0

#4

Post by twarge » Thu, Apr 23, 2026, 10:27 PM UTC

wireguard on windows and linux are extraordinarily solid at my org.

However, we have a lot of difficulty with macOS, seemingly with rather basic OS-level bugs that don't seem to be their fault: the big one is that a wireguard profile distributed by MDM for a system seems to work for the logged in user, but not for any other user. Seems to be a keychain issue.

While I don't expect any support, there does not seem to be a system to support getting pull requests reviewed and mainlined (including a PR that might address my need). Even tried IRC.

Re: WireGuard for Windows Reaches v1.0

#5

Post by acedTrex » Thu, Apr 23, 2026, 11:18 PM UTC

cwkcw wrote: post #2

The NSI filter-driver interception is the standout move in this release and it's worth not skimming past. When the documented API (NotifyIpInterfaceChange with MibParameterNotification) doesn't fire for MTU changes, Microsoft confirms the bug in 2021, and the fix never ships, you either live with a 3-second polling loop or you attach a filter driver to \Device\Nsi using IoAttachDeviceToDeviceStack, reverse engineer I…

Thx claude

Re: WireGuard for Windows Reaches v1.0

#6

Post by loloquwowndueo » Fri, Apr 24, 2026, 12:03 AM UTC

twarge wrote: post #4

wireguard on windows and linux are extraordinarily solid at my org. However, we have a lot of difficulty with macOS, seemingly with rather basic OS-level bugs that don't seem to be their fault: the big one is that a wireguard profile distributed by MDM for a system seems to work for the logged in user, but not for any other user. Seems to be a keychain issue. While I don't expect any support, there does not seem to b…

[flagged]

Re: WireGuard for Windows Reaches v1.0

#7

Post by ekropotin » Fri, Apr 24, 2026, 12:13 AM UTC

twarge wrote: post #4

wireguard on windows and linux are extraordinarily solid at my org. However, we have a lot of difficulty with macOS, seemingly with rather basic OS-level bugs that don't seem to be their fault: the big one is that a wireguard profile distributed by MDM for a system seems to work for the logged in user, but not for any other user. Seems to be a keychain issue. While I don't expect any support, there does not seem to b…

Interestingly enough, Tailscale, that is build on top of Wireguard, work flawlessly on Mac.

Re: WireGuard for Windows Reaches v1.0

#8

Post by bakugo » Fri, Apr 24, 2026, 12:28 AM UTC

Very glad to see this maintained again, for years I thought it was abandoned and feared that it would break with a Windows update or something.

That said, I've been using it for quite a while and it's been surprisingly bug-free despite the lack of updates, which nowadays is quite impressive in its own right.

Re: WireGuard for Windows Reaches v1.0

#9

Post by EvanAnderson » Fri, Apr 24, 2026, 12:55 AM UTC

cwkcw wrote: post #2

The NSI filter-driver interception is the standout move in this release and it's worth not skimming past. When the documented API (NotifyIpInterfaceChange with MibParameterNotification) doesn't fire for MTU changes, Microsoft confirms the bug in 2021, and the fix never ships, you either live with a 3-second polling loop or you attach a filter driver to \Device\Nsi using IoAttachDeviceToDeviceStack, reverse engineer I…

I feel like this kind of "API only kinda works" behavior is emblematic of MSFT. So many times I feel like what I want was anticipated, 90% of the work was done, and the rest is left to me to make a dodgy hack of.

Re: WireGuard for Windows Reaches v1.0

#10

Post by simfree » Fri, Apr 24, 2026, 5:29 AM UTC

ekropotin wrote: post #7

twarge wrote: post #4

wireguard on windows and linux are extraordinarily solid at my org. However, we have a lot of difficulty with macOS, seemingly with rather basic OS-level bugs that don't seem to be their fault: the big one is that a wireguard profile distributed by MDM for a system seems to work for the logged in user, but not for any other user. Seems to be a keychain issue. While I don't expect any support, there does not seem to b…

Interestingly enough, Tailscale, that is build on top of Wireguard, work flawlessly on Mac.

Not really, I always have to choose an exit node for Tailscale to allow me internet access on Mac while connected to a Tailnet on cellular.