WireSock VPN Client is a lightweight command line WireGuard VPN client for Windows that has advanced features not available in the official WireGuard for Windows such as selective application tunneling and disallowed IP addresses. WireSock VPN Client is easy to set up and is free*.
WireSock VPN Client combines the power of Windows Packet Filter and BoringTun (user space WireGuard implementation in Rust) to provide exceptional performance, security and scalability.
Key Features
- Transparent mode. Unlike most VPN software, WireSock VPN Client supports two modes of operation. The former (enabled with the
-lac
command line switch) works through the virtual network adapter associated with the VPN connection, while the latter (default mode) does not change your network settings and is completely transparent. - Tunneling only certain applications. “AllowedApps” and “DisallowedApps” are WireSock extension options that allow only selected applications to be tunneled. For example, the Chrome browser can be configured to go through a VPN tunnel, while Firefox will connect directly through your normal internet connection.
- Ability to exclude subnets from ‘AllowedIPs‘. ‘DisallowedIPs’ is a WireSock extension parameter which allows exclusion of specified subnets or individual IP addresses from AllowedIPs without complex calculations.
- High performance. WireSock VPN Client is much faster than user-space WinTun based implementation in Go and competes with kernel mode WireGuardNT (though normally has slightly higher CPU impact due to user-space nature). Below are comparison throughput (upload/download) test results using a nine-year-old Intel® NUC DC3217IYE (Core i3-3217u) on the client side. In each test, iperf3 has been using 4 TCP sessions (one per vCPU). The topmost results were taken from a series of 10 sequential tests.
iperf3 -c 10.66.66.1 -P 4 (upload) | iperf3 -c 10.66.66.1 -R -P 4 (download) | |
WireSock VPN Client v1.0.46 | 879 Mbits/sec | 892 Mbits/sec |
WireGuard for Windows (kernel driver) v0.5 | 892 Mbits/sec | 719 Mbits/sec |
WireGuard for Windows (WinTun) v0.4.1 | 288 Mbit/sec | 325 Mbits/sec |
TunSafe v1.4 | 435 Mbits/sec | 284 Mbits/sec |
Core i3-3217u, Windows 10 x64 1809, 1Gbps wired connection
- Lightweight. WireSock VPN Client binaries take approximately 1.5 MB storage on disk, and runtime RAM footprint is under 10 MB.
- Double VPN (with nested tunnels). WireSock VPN Client is compatible and can be used with official WireGuard for Windows to organize nested WireGuard tunnels completely on the client side. In such configuration, the official client organizes the external tunnel (to the first WireGuard Server instance) and WireSock VPN Client the internal one (to the second WireGuard Server instance). You only need to remember to adjust MTU parameter for the internal tunnel accordingly to avoid fragmentation and throughput degradation.
- Windows 10 Mobile hotspot support. When WireSock VPN Client is active, Mobile hotspot connected devices are also forwarded over the WireGuard tunnel. This functionality is not available in the official WireGuard for Windows.
- SOCKS5 for WireGuard handshake. The easiest way to block WireGuard VPN is based on identifying handshake and handshake response packets (both fixed length and known format). This feature allows these packets to be passed through a SOCKS5 proxy, making identification more difficult. Note that only the handshake and handshake response packets go through the SOCKS5 proxy, all other tunnel packets are sent directly.
- Fallback WireGuard configuration. Allows you to add another WireGuard configuration that will be used if the main tunnel is down (unavailable).
Quick Start Guide
Download and install the appropriate WireSock VPN Client installer for your target platform:
- wiresock-vpn-client-x64-1.2.24.msi – MSI for Windows [Desktop 7, 8, 8.1, 10, 11 / Server 2012, 2016, 2019, 2022] x64 (64 bit)
- wiresock-vpn-client-x86-1.2.24.msi – MSI for Windows [Desktop 7, 8, 8.1, 10, 11 / Server 2012, 2016, 2019, 2022] x86 (32 bit)
- wiresock-vpn-client-ARM64-1.2.24.1.msi – MSI for Windows [Desktop 10, 11] ARM64 (64 bit)
For enhanced user experience and management with WireSock VPN Client in application mode**, we recommend using WireSockUI as your preferred UI option. There are several other options available, such as TunnlTo and EpexGUI, but WireSockUI provides a more refined and user-friendly interface with tighter integration to Wiresock.
WireSockUI is a C# project started by Rob van Oostenrijk, building upon the foundation laid by EpexGUI. The interface design is inspired by the official WireGuard for Windows interface, ensuring familiarity and ease of use. WireSockUI works directly with the Wiresock core DLL, providing more flexibility and enhanced control over the VPN client. We appreciate Rob van Oostenrijk’s valuable efforts and contributions in creating WireSockUI.
All the options mentioned above, including WireSockUI, offer several convenient features, such as importing and editing Wireguard configurations and switching between tunnels, which can greatly simplify the user experience when using the WireSock VPN Client.
Newest Versions of WireSockUI:
- WireSockUI-v0.1.2-AnyCPU.zip – Tailored for Windows 10/11 x86/x64 systems, this package ensures smooth performance on both 32-bit and 64-bit architectures.
- WireSockUI-v0.1.2-ARM64.zip – Optimized for Windows 10/11 ARM64 devices, this package provides a reliable and efficient VPN experience on the latest ARM-based hardware.
- WireSockUI-v0.1.2-AnyCPU-no-uwp.zip – Compatible with Windows 7/8 x86/x64 systems, this version omits UWP (Universal Windows Platform) support to ensure compatibility with older Windows operating systems.
WireSock VPN Client CLI
Apart from the WireSockUI option mentioned earlier, the WireSock VPN Client can also be initiated from the command line as a Windows console application (wiresock-client.exe) or executed in the background as a Windows service. When running wiresock-client.exe from the command line without any parameters, the output displayed is as follows:
WireSock LightWeight WireGuard VPN Client
Parameters:
install [-start-type <2..4> -account <account-name> -password <account-password> -config <wireguard-client-config-full-pathname> [-fallback-config <wireguard-fallback-client-config-full-pathname>] -log-level <none | info | debug | all>]
- to install the service.
service start types are:
2 - service started automatically by the service control manager during system startup.
3 - service started manually or by calling StartService function from another process.
4 - service installed in the "disabled" state, and cannot be started until enabled.
run [-config <wireguard-client-config-full-pathname> [-fallback-config <wireguard-fallback-client-config-full-pathname>] -log-level <none | info | debug | all>]
- to start as a regular process (not a service)
uninstall
- to remove the service.
If you already have the WireGuard configuration file, you can run WireSock VPN Client as an application using the command line below:
wiresock-client.exe run -config [config_full_path_name] -log-level none
To start WireSock VPN Client in virtual network interface mode you can use the command below:
wiresock-client.exe run -config [config_full_path_name] -log-level none -lac
Please note to use -log-level none
unless you need to debug the application because it affects the performance.
To install as auto-starting Windows Service, use the following:
wiresock-client.exe install -start-type 2 -config [config_full_path_name] -log-level none
OR (to install in virtual network adapter mode)
wiresock-client.exe install -start-type 2 -config [config_full_path_name] -log-level none -lac
Wiresock VPN Client Service can be started/stopped using the Services applet (services.msc) or commands below (requires Administrator privilege):
sc start wiresock-client-service
sc stop wiresock-client-service
The service can be uninstalled (remember to stop the service first) using:
wiresock-client.exe uninstall
OR
sc delete wiresock-client-service
Application vs Service mode
As you have already noticed, you can use Wiresock VPN Client as a Windows service or as a normal application. It is worth mentioning one limitation of running it as a normal application. When a Wiresock VPN client is started in this way, it can only split tunnel processes that are accessible (e.g., started) by the current user (others will be labeled as SYSTEM).
Extended configuration parameters
In addition to WireGuard standard configuration parameters, WireSock VPN Client supports the following (parameters below should be specified in the Peer section of the configuration file):
- AllowedApps – specifies comma separated list of application names (or partial names) to forward over VPN tunnel. This parameter narrows AllowedIPs, so the traffic to be tunneled should match both AllowedIPs and AllowedApps. For example, ‘AllowedApps = chrome’ and ‘AllowedIPs = 0.0.0.0/0’ will result in forwarding only Chrome browser over the VPN connection, everything else will bypass the tunnel.
- DisallowedApps – specifies comma separated list of application names (or partial names) to be excluded from the tunneling. This parameter is the opposite of AllowedApps. Please note that AllowedApps takes precedence, and if both are specified, then AllowedApps is matched first.
- DisallowedIPs – specifies comma separated list of IP subnets to be excluded from the tunneling. For example,
AllowedIps = 0.0.0.0/0
andDisallowedIPs = 192.168.0.1/24
will exclude 192.168.0.1/24 from the tunneling. - WireGuard handshake over SOCKS5 proxy parameters:
- Socks5Proxy – specifies SOCKS5 proxy endpoint, e.g.
Socks5Proxy = socks5.sshvpn.me:1080
orSocks5Proxy = 13.134.12.31:1080
- Socks5ProxyUsername – specifies SOCKS5 username (optional)
- Socks5ProxyPassword – specifies SOCKS5 password (optional)
- Socks5Proxy – specifies SOCKS5 proxy endpoint, e.g.
In the example configuration below, the WireSock VPN Client will tunnel only Google Chrome browser for all destination IP addresses except LAN (192.168.1.0/24 ):
[Interface]
PrivateKey = AD9GaupPbRlfjPTfhLm1/lm5qtgwvFcB1rGpKOZkXXE=
Address = 10.66.66.2/32, fd42:42:42::2/128
DNS = 94.140.14.14, 94.140.15.15
MTU = 1420
[Peer]
PublicKey = tRb3/FxzJBhinaVPY/tyoX40PS7EY1mmzFyrL/dAnwY=
AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = ora.sshvpn.me:51820
AllowedApps = chrome
DisallowedIPs = 192.168.1.0/24
Troubleshooting
If you experience any problems, then first try starting the application/service with ‘-log-level all‘ command line parameter. If you run it as an application, then it dumps the debug log directly on the console, while service will save the log into the file located in C:\ProgramData\NT Kernel Resources\WireSock VPN Client. In both cases, all processed network packets will be stored in PCAP files (can be opened and analyzed in Wireshark) in the C:\ProgramData\NT Kernel Resources\WireSock VPN Client.
Please note that ‘-log-level all‘ exists for debug purposes only and significantly affects the application performance.
License
WireSock VPN Client is free for personal (non-commercial), or educational (including non-profit organization) use.
Support
Please ask questions in our support forum.