Windows WireGuard Client WireSock BoringTun • WinpkFilter

WireSock Secure Connect: WireGuard VPN Client for Windows

A high-performance WireGuard VPN client for Windows built on WireSock BoringTun (a maintained fork of Cloudflare BoringTun) and Windows Packet Filter. Features precise per-application split tunneling, transparent packet redirection, AmneziaWG obfuscation support, and multi-gigabit throughput.

Download WireSock → View on GitHub ← All Tools & Ecosystem
Core Engine: WireSock BoringTun (Rust)
Forwarding Modes: Virtual Adapter & Transparent (both WinpkFilter)
Protocols: WireGuard • AmneziaWG (AWG 1.0 / 2.0)
Platform: Windows 11: x64, ARM64; Windows 10: x64, x86; 8.1 / 7 SP1: legacy limitations
Dual-Mode Architecture

Application-Aware Tunneling for Windows

WireSock Secure Connect provides two Windows integration modes built around the same application and IP-based traffic policy. Virtual Adapter Mode exposes a Windows network interface for features that require one, while Transparent Mode operates without creating a virtual adapter. Both modes use WinpkFilter for packet interception and policy enforcement.

Tunneling Architecture

WireSock Dual-Mode Packet Processing Paths

Virtual Adapter Mode vs. Transparent Mode (Unified Policy Model)
WireSock Dual-Mode Architecture Diagram showing unified application and IP traffic policy evaluated across Virtual Adapter Mode and Transparent Mode, both processed with Windows Packet Filter and encrypted by the WireSock BoringTun engine to a remote VPN endpoint via low-level tunnel packet egress. TRAFFIC POLICY Common Policy Engine Shared split-tunneling rules Application Rules AllowedApps DisallowedApps IP Rules AllowedIPs DisallowedIPs Decision Tunnel / Bypass Evaluated for both modes MODE A: VIRTUAL ADAPTER MODE Virtual Interface with WinpkFilter Processing Provides a Windows network interface WinpkFilter processes traffic on virtual-interface path Common application/IP policy selects tunnel or bypass Interface features: application adapter binding MODE B: TRANSPARENT MODE Direct NDIS Interception (WinpkFilter) WinpkFilter intercepts traffic without a virtual adapter Common application/IP policy selects tunnel or bypass No virtual network interface required Direct NDIS integration: zero route leaks, no TAP/TUN WIRESOCK CORE ENGINE WireSock BoringTun Fork of Cloudflare BoringTun Rust WireGuard + AmneziaWG extensions AWG / PROTOCOL EXTENSIONS Padding & protocol imitation TUNNEL PACKET EGRESS Remote VPN Endpoint Initial handshake via UDP socket Tunnel UDP/IP packets built directly by WireSock (generates IP & UDP headers) Low-level egress via real adapter ChaCha20-Poly1305 encrypted payload
Dual Integration Modes & Tunnel Egress: Both modes share the same application and IP policy engine. Virtual Adapter Mode exposes a Windows network interface for adapter binding and, in beta releases, DNS search domains, while Transparent Mode operates directly on existing interfaces without a virtual adapter. WireSock BoringTun uses a standard Windows UDP socket only for the initial handshake; all subsequent tunnel UDP/IP datagrams are constructed directly by WireSock and sent via its low-level packet path toward the physical adapter.

Per-Application Split Tunneling

Route traffic from specific executable binaries through the VPN tunnel while allowing the rest of your system to connect directly through local interfaces.

WinpkFilter Transparent Mode

Direct NDIS packet interception and injection without virtual adapters. Bypasses routing table conflicts, preserves native MTU, and reduces system overhead.

AmneziaWG Obfuscation

Integrated support for AmneziaWG junk packet injection (Jc, Jmin, Jmax) and handshake obfuscation (H1, H2, H3, H4) to defeat protocol-based DPI filtering.

System Architecture

Desktop GUI and Background Windows Service

WireSock Secure Connect operates as an unattended Windows background service paired with a desktop graphical user interface. The UI communicates with the service over local IPC, allowing the VPN tunnel to initialize before user logon and remain connected continuously even when the application window is closed.

Desktop Management GUI

End users manage tunnel profiles, configure per-application rules, select integration modes, and monitor live traffic via WireSockConnect.exe. Closing the GUI window leaves the active tunnel intact.

Background Windows Service

The multi-threaded background service (wiresock-connect-service.exe) manages tunnel lifecycle and driver state. It can start before user logon for unattended headless or enterprise environments.

Service Management CLI

For command-line automation and scripting, the installed service includes wiresock-connect-cli.exe to connect profiles, query connection status, and perform administrative operations against the running service.

Alternative Tool

SDK Console Client

For SDK integrations and lightweight command-line use, WireSock also provides a minimal console client (wiresock-client.exe). It is separate from the main C# service and GUI. The SDK console client can also be used as a backend for alternative front ends such as WireSockUI.

Windows Command Prompt / PowerShell • wiresock-client.exe

# Start the SDK console client in transparent mode (default WinpkFilter redirection):

wiresock-client.exe run -config "wg0.conf"


# Start in Virtual Adapter Mode (spawns virtual network interface):

wiresock-client.exe run -config "wg0.conf" -lac


# Stop the console client:

# Press Ctrl+C in the active console window