VPNs that support a WireGuard derivative

A WireGuard derivative is a provider’s own build of WireGuard — the same cryptography and tunnel, with changes around it. NordLynx is the example: WireGuard behind a double NAT so that the server does not need to keep a client’s address against its key.

On security the tunnel is WireGuard’s and inherits its strength. What differs is the part the vendor added, which is where any privacy fix lives and also where the independent review stops. It therefore sits a step behind WireGuard itself on evidence, and ahead of a closed protocol: the core is public even where the wrapper is not.