WireGuard 10G IP Core — Full-Speed VPN Encryption in Pure HW Logic

Design Gateway Hot! News
July 2nd Issue

WireGuard 10G IP Core — Hardware-Accelerated VPN for High-Speed Networks

WireGuard-IP for AMD WireGuard-IP for Altera

[ NEW RELEASE ]
WireGuard 10G IP Core — Full-Speed VPN Encryption in Pure HW Logic

WireGuard is loved for its simplicity and lean, modern security — but in software, even a capable CPU tops out near ~5 Gbps of tunnel throughput. Encryption becomes the bottleneck long before a 10G link is full, and the host burns cycles it needs for real work. The WireGuard 10G IP core runs the entire protocol — Noise handshake, X25519, BLAKE2s, and ChaCha20-Poly1305 — directly in FPGA logic. The result: full 10 Gbps line-rate encryption with zero CPU load and no external memory, proven interoperable with standard WireGuard software on real hardware.

Why Move WireGuard Into Hardware

When encryption runs on the CPU, VPN throughput is capped by processing overhead and competes with every other task on the host. Moving the full protocol into FPGA logic changes the economics completely — the link runs at wire speed while the CPU is freed for application work.

iperf3 Benchmark on ZCU106 — Full-Duplex Encrypted Tunnel

9.2

Gbps TX

Encrypted transmit

8.3

Gbps RX

Encrypted receive

17.5

Gbps Total

Combined bidirectional

Use Case: Multi-Site Secure Networking at Full 10G links

A hub-and-spoke topology where branch offices and remote data centers establish hardware-accelerated WireGuard tunnels back to a secured central server across 10G fiber.

WireGuard 10G IP Core solution diagram — multi-site topology and hardware vs software throughput

Why WireGuard 10G-IP Core

🔒

Full Protocol in Hardware

Noise handshake, X25519, BLAKE2s, and ChaCha20-Poly1305 all run in FPGA logic — no software crypto library.

⚡

10G Line Rate

>9 Gbps per direction and ~17.5 Gbps combined — the full capacity of the 10GbE link, not a ~5 Gbps software ceiling.

🧠

Zero CPU

WireGuard VPN runs entirely in FPGA logic with no external memory required, keeping the host CPU completely free.

🧱

Integrated Network Stack

Built-in UDP/IP and ARP controllers, IPv4 without fragmentation, jumbo frames, 64-bit AXI4-Stream.

✅

Interop-Proven

Validated against standard WireGuard software on ZCU106 — demonstrated with Samba file transfer and iperf3.

Technical Specifications

Parameter	Value
Protocol	Full WireGuard VPN — Noise handshake, ChaCha20-Poly1305, X25519, BLAKE2s — 100% in hardware
Support Devices	AMD Kintex UltraScale+ KCU116, Zynq UltraScale+ ZCU106 Altera Agilex 5 Coming Soon
Data / MAC Interface	64-bit `AXI4-Stream` on user data and Ethernet MAC sides
Network Stack	Integrated UDP/IP + ARP · IPv4 without fragmentation · Jumbo frame support · 10G Ethernet
Peak Throughput	9.2 Gbps TX / 8.3 Gbps RX — ~17.5 Gbps combined full-duplex (iperf3)
Host CPU / Memory	Zero CPU — VPN traffic runs entirely in FPGA logic · No external memory required
Getting Started	Program FPGA → launch GUI → configure keys & activate tunnel → verify with Samba / iperf3

See the WireGuard 10G IP Core in Action

Watch the live demo: full 10G WireGuard VPN encryption on FPGA, verified with Samba file transfer and iperf3 throughput on real hardware.

Featured Demo

WireGuard 10G IP Core — Hardware-Accelerated VPN Demo

Subscribe on YouTube

Free, time-limited evaluation demos are available — verify full 10G WireGuard throughput on real hardware before you commit.

➡ Request Free Evaluation Demo