Mesh VPN and WireGuard: QUIC as an alternative

WireGuard, an excellent foundation

WireGuard is simple, fast, small in code size and well studied. It is a very good choice for many use cases, and several consumer mesh solutions build on it. This guide does not try to disqualify it: it explains why VIGIL-MESH chose QUIC as its transport.

Why VIGIL chose QUIC over WireGuard

• Connection-level migration: a QUIC session is identified independently of the IP address and survives a network change without re-establishing the tunnel.
• Reliable streams + datagrams in the same connection: service streams travel in order, real-time control goes over unreliable datagrams.
• A single UDP port 443, indistinguishable from HTTP/3: gets through most firewalls.
• Built-in TLS 1.3 and a hybrid post-quantum key exchange (X25519 + ML-KEM768) on every session.
• One QUIC connection as the universal unit: direct, relay or peer chain are merely interchangeable carriers (see /en/docs/reseau-mesh).

Transport details at /en/docs/vpn-quic.

What a QUIC mesh VPN adds on top

Beyond the transport, VIGIL-MESH carries broadcast across the network: IP broadcast and multicast cross the encrypted mesh as if on a switch (mDNS, SSDP, LAN games, business UDP) — something a WireGuard VPN does not do natively. Multicast is encrypted end to end and the relay replicates it without being able to read it. See /en/docs/l2-multicast.