How does NymVPN implement Wireguard?

NymVPN is designed to provide the best possible user experience, combining advanced privacy features with everyday speed. In addition to our “Anonymous” 5-hop mixnet mode for maximum privacy, we offer a “Fast”, everyday privacy solution using a decentralized VPN mode, powered by WireGuard.

To enhance privacy for our users, we’ve configured WireGuard with a 2-hop tunnel-in-a-tunnel setup:

• 2-hop: Your traffic is routed through two separate WireGuard nodes. The first node may see your IP address but has no visibility into your online activities, as all traffic is fully encrypted. The second node can see your online activity but cannot identify who you are.
• Tunnel-in-a-tunnel: Traffic from your device is doubly encrypted using an "onion" encryption model. The first node decrypts only the outer layer, and the second node decrypts the final layer before sending the traffic to its destination. Traditional 2-hop WireGuard setups don't provide this added layer of privacy, potentially revealing more information to the first node.

You can read more about NymVPN implementation of Wireguard in our blog post.