The Server That Doesn't Answer
When you port-scan a machine running OpenVPN or IPSec, the server responds. It might send a "connection refused" or a protocol banner. Either way, it reveals its presence. Attackers use this to find VPN servers and target them with exploits.
WireGuard operates differently. It listens on a UDP port, but it is completely silent to unauthorized senders. If you send a packet to a WireGuard port without the correct cryptographic credentials, the server does not respond at all. It drops the packet and moves on.
To a network scanner like nmap, a WireGuard port is indistinguishable from a closed or filtered port. The server is effectively invisible to anyone who doesn't already have the correct public/private key pair. This property is sometimes called stealth mode or port knocking by default.
Stateless Roaming
Traditional VPN protocols maintain connection state. They track your IP address as part of the session. When your IP changes — because you switched from WiFi to cellular, or because your DHCP lease renewed — the session breaks. You have to reconnect.
WireGuard has no persistent connection state. Each packet is independently authenticated. When the server receives a valid packet from a new source IP, it simply updates its record of where to send replies. The transition is seamless:
- You are connected over WiFi. Your public IP is
203.0.113.10. - You walk away from WiFi. Your device switches to 5G. Your public IP is now
198.51.100.44. - Your device sends the next WireGuard packet from
198.51.100.44. - The server decrypts it, verifies the key, and updates your endpoint to
198.51.100.44:51820. - Traffic continues without interruption.
An SSH session running over WireGuard survives this transition without dropping. The SSH server never knew anything changed — from its perspective, the TCP connection stayed alive.
The PersistentKeepalive setting exists to handle a specific edge case: NAT devices. Most home routers and corporate firewalls use Network Address Translation (NAT), which maps many internal IPs to one external IP. NAT devices maintain a table of active connections, but they expire entries after a period of inactivity (often 25–30 seconds). If WireGuard goes quiet, the NAT entry expires, and incoming packets can no longer find their way back to your device. Setting PersistentKeepalive = 25 causes WireGuard to send a small keepalive packet every 25 seconds, preventing the NAT entry from expiring. This is only needed on the client side (the device behind NAT), not on a server with a public IP.
A common interview question: "How does WireGuard handle roaming compared to IPSec?" The key insight is that WireGuard's stateless design means the endpoint IP is just metadata updated on each valid packet — there's no session to tear down and rebuild. Contrast this with IPSec's IKE (Internet Key Exchange) protocol, which must renegotiate the security association when the IP changes. WireGuard's roaming is a direct consequence of its architecture, not a feature bolted on afterward.