WireGuard 1G IP Core: Hardware-Based Security and Zero CPU Usage VPN on FPGA

In high-speed networking, security and performance often come at the expense of CPU resources. Design Gateway’s WireGuard 1G IP Core introduces a complete WireGuard VPN tunnel running at a full 1 Gigabit line rate entirely inside the FPGA fabric.

Watch the Full Demonstration

See the full demo: WireGuard1G

🛡️ Beyond CPU Offload: True Hardware-Based Security

WireGuard is rapidly becoming the modern standard for secure tunnels due to its simplicity and modern cryptography built right inside the Linux kernel. However, in a software implementation, every single packet must be encrypted and authenticated by the CPU, resulting in high CPU load and reduced processing power for your core applications.

⚡ Why FPGA Fabric Matters in the Era of AI Agents

Security challenges are evolving. Today, sophisticated AI agents with cyber-security capabilities can explore operating systems, probe software interfaces, and exploit vulnerabilities.

Software VPN Vulnerabilities

Software VPNs live inside the OS, surrounded by drivers, shells, and system layers that remain potential targets for software-based attacks.

FPGA Hardware Protection

The entire tunnel runs as pure hardware logic—eliminating the attack surface entirely because there is no OS, driver, or software interface.

🔍 Inside the WireGuard 1G IP Core Architecture

The entire cryptographic suite—including the handshake, X25519, BLAKE2s, and ChaCha20-Poly1305—runs directly as pure hardware logic with a built-in protocol stack. Even advanced AI agents will find no software stack or operating system to infiltrate inside the FPGA fabric.

🌐 Network Setup & Live Demonstration

The User PC connects directly to the FPGA over a 1 Gigabit Ethernet link. Its single network interface is configured with two IP addresses — one for network communication, and one as the WireGuard tunnel IP.

First, IP address for normal network communication

Second, IP address for the WireGuard tunnel

The FPGA shares the same IP and MAC address as the User PC, so it can transparently intercept traffic. On the other side, encrypted WireGuard traffic is routed out through the Gateway across the network, and delivered to the Endpoint. The Endpoint is reachable through its WireGuard tunnel IP, just like any peer on a private network.

To demonstrate real-world file transfers, we utilize a Samba file share. On the Endpoint PC, a Samba share is already configured and exposed over the WireGuard tunnel IP. We then copy a large file from the User PC into the share. The transfer progresses smoothly — moving across the encrypted tunnel with no special setup required.

🖥️ Easy Configuration with WireGuard Demo GUI

To simplify configuration and monitoring, Design Gateway provides the WireGuard Demo GUI. Users can import an existing .conf file and click Activate. The GUI automatically configures both the FPGA and the User PC.

1. Import tunDemo.Config file.

2. Click Activate.

Once the WireGuard handshake is completed, the GUI displays live connection status, including transfer speed, transferred bytes, and handshake status. This makes it easy to verify that the tunnel is active and operating correctly.

📁 Verifying the Tunnel with Samba File Transfer

After the tunnel is configured, real-world traffic is tested using a Samba file transfer. On the Endpoint PC, a Samba share is exposed over the WireGuard tunnel IP.

The User PC accesses this Samba share through the secure WireGuard tunnel, confirming that normal application traffic can pass through the encrypted FPGA-accelerated VPN connection.

📈 Performance & Line-Rate Stress Testing

To evaluate maximum bandwidth capabilities, we run iperf3 in full-duplex with 4 parallel streams to fully stress the link. Looking at the results, the transmit side reaches 925 Mbps and the receive side reaches 978 Mbps, sustaining near-maximum line rate effortlessly.

Transmit Throughput	Receive Throughput	Combined bidirectional throughput
925 Mbps	978 Mbps	approximately 1.9 Gbps

This result demonstrates that WireGuard 1G IP can deliver high-speed encrypted communication close to the practical performance range of a 1G Ethernet environment.

🏢 Typical Deployment Scenario & Applications

Consider a secured central server with three 1 Gigabit links, aggregating traffic from three remote sites — such as a factory gateway, sensor hub, and remote substation — across an untrusted network.

With VPN processing in hardware, each site can encrypt traffic before it leaves the local network, while keeping the CPU free for other tasks.

As a compact FPGA IP core, WireGuard 1G can be integrated into diverse mission-critical applications:

Industrial Automation

Energy Grids

Video Surveillance

Medical Equipment

Automotive Networks

Aerospace

🎯 Practical Use Cases at 1 Gigabit Line Rate

Encrypted Backups: Securing data backups at full link speed without dropping performance.
Edge-to-Data Center AI: Securely transferring sensitive AI models between edge devices and data centers.
Field Logging: Protecting confidential log data in remote field deployments while keeping the CPU completely free.

🔍 Learn More About WireGuard 1G-IP

Product Page

for AMD Page for Altera Page

Technical Documents

Datasheet (AMD) Datasheet (Altera)

Reference Design (AMD) Reference Design (Altera)

📦 Free Evaluation File

Start your evaluation with reference designs and demo environments prepared for Design Gateway IP core solutions.

for AMD (KR260 Demo) for Altera (Agilex 5 Demo)

for Altera (Arria 10 SX Demo)

🧪 Demo & Evaluation

A demonstration environment is available for developers who would like to evaluate the WireGuard 1G IP Core and experience true hardware-based security with high-speed performance. The demo includes:

Hardware-based cryptographic suite (X25519, BLAKE2s, ChaCha20-Poly1305)
1 Gigabit line-rate throughput and full-duplex iperf3 stress testing
Easy configuration using the WireGuard Demo GUI (tunDemo.Config file integration)
Transparent traffic interception and Samba file transfer verification
Zero host CPU load for encryption processing