Open-Source FPGA WireGuard: Hardware VPN for Under $200

Your VPN is bottlenecked by your CPU — wireguard-fpga fixes that with open-source FPGA hardware under $200. Software WireGuard pushes maybe 1–2 Gbps on a modern core, but a single ChaCha20-Poly1305 operation eats hundreds of cycles. Add routing, NAT, and multiple tunnels and that number drops fast. And the only hardware alternative, Blackwire, costs $3,000+ per card and its company folded. So that gap is exactly what wireguard-fpga — an open-source project with 1,336★ on GitHub — aims to fill.

What It Is

So wireguard-fpga tackles this in hardware. It implements the WireGuard data plane entirely in RTL on an Artix7 FPGA. Key exchange, handshake, session management runs on an on-chip RISC-V soft CPU. So the result is a standalone hardware VPN node, no PC required, on a sub-$200 ALINX AX7201 development board with four 1,000Base-T Ethernet ports.

And the whole thing uses a fully open-source toolchain: PipelineC for high-level synthesis, PeakRDL for register management, OpenXC7 for place-and-route, VProc for co-simulation, and SV2V for SystemVerilog-to-Verilog conversion. Every line of gateware is BSD-3-Clause licensed. Nothing is hidden behind a Vivado license or a corporate NDA.

How FPGA WireGuard Works

The architecture? It splits into two clear domains. The control plane runs on a RISC-V CPU with DDR3 memory, handling the WireGuard handshake protocol, key derivation (Curve25519, BLAKE2s, HKDF), and cryptokey routing table updates. The data plane is pure RTL: incoming packets hit a header parser, get decrypted through a dedicated ChaCha20-Poly1305 hardware block, pass through an IP lookup engine, and exit through the encryption block on the other side.

Worth noting — the data plane uses separate encrypt and decrypt hardware paths running in parallel. That’s the fundamental advantage over software: dedicated silicon for every crypto operation, no pipeline stalls.

I spent an afternoon walking through their architecture documentation and simulation test bench. The co-simulation setup is clever — a VProc virtual processor lets you co-simulate embedded software with the RTL at near-native speeds, no FPGA board needed just to test a firmware change.

Open vs Closed FPGA Hardware

Here’s how wireguard-fpga stacks up against its only real comparison point:

Blackwire hit 100 Gbps but needed a $3,000 Alveo U50 card, a PCIe host PC, and AMD’s proprietary Vivado toolchain. Its company (BrightAI) ran out of funding and ceased operations — the code they released carries unresolved ownership questions. Wireguard-fpga targets the opposite end of the spectrum: cheap, independent, fully auditable.

Where It Stands Right Now

Now let me be direct about the state of this project. Phase 1 is a proof of concept — not a deployable product. The README explicitly says “Until all checkmarks are in place, anything you get from here is w/o guaranty — Use at own risk.” Two major deliverables — Take 4 (session maintenance) and Take 5 (OpenXC7 testing) — aren’t done yet.

Even so, the Artix7 FPGA runs at roughly 100 MHz Fmax. The actual throughput is unverified — there are no published benchmarks yet. And the project itself acknowledges that Blackwire, despite a much larger budget, failed due to funding issues.

Still, the architecture is sound. The documentation is thorough — detailed block diagrams, packet flow analysis, a working simulation test bench. And it’s clear this isn’t a weekend hobby project. Still, the NLnet Foundation funding adds credibility.

What This Means for VPN Users

If you’re reading this hoping to buy a $200 FPGA board and replace your Mullvad subscription — not yet. Not this year.

But if you’re a technical VPN user who’s wondered why your WireGuard connection maxes out at 800 Mbps on a 1 Gbps line, this project shows you the answer. CPU-bound encryption is the bottleneck. Dedicated hardware is the fix. Curious how different VPN protocols manage encryption overhead? Our WireGuard vs OpenVPN vs IKEv2 comparison explains why WireGuard’s crypto design is the reason hardware acceleration is even worth pursuing. And the fact that this fix is now being built in open-source Verilog, on commodity hardware, is a meaningful shift.

I’ll be watching this project through Phase 2. If they hit their targets, a $200 hardware WireGuard appliance that runs at line speed with zero CPU overhead becomes a real possibility. For now, it’s the best look at where VPN hardware is headed.

Think this is overkill for your setup? For most home connections, software WireGuard is plenty. Check our WireGuard setup guide for a free software solution, or compare the top VPN providers in our Speed Test Benchmarks 2026 for something that just works out of the box.