{"id":14906,"date":"2025-12-19T11:49:07","date_gmt":"2025-12-19T18:49:07","guid":{"rendered":"https:\/\/jasonsblog.ddns.net\/?p=14906"},"modified":"2025-12-19T11:49:07","modified_gmt":"2025-12-19T18:49:07","slug":"announcing-gotatun-the-future-of-wireguard-at-mullvad-vpn","status":"publish","type":"post","link":"https:\/\/jasonsblog.ddns.net\/index.php\/2025\/12\/19\/announcing-gotatun-the-future-of-wireguard-at-mullvad-vpn\/","title":{"rendered":"Announcing GotaTun, the future of WireGuard at Mullvad VPN"},"content":{"rendered":"\n

They’re moving from Go to Rust for Wireguard, and there will be a security audit in the beginning of 2026. And Mullvad VPN is one of the few VPN services that I trust for their commitment to privacy and not paying influencers to recommend their service.<\/p>\n\n\n\n

https:\/\/mullvad.net\/en\/blog\/2025\/12\/19\/announcing-gotatun-the-future-of-wireguard-at-mullvad-vpn<\/a><\/p>\n\n\n

<\/div><\/div><\/div>\n\n\n

GotaTun<\/a> is a WireGuard\u00ae implementation written in Rust aimed at being fast, efficient and reliable.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

GotaTun is a fork of the BoringTun<\/a> project from Cloudflare. This is not a new protocol or connection method, just WireGuard\u00ae written in Rust<\/a>. The name GotaTun is a combination of the original project, BoringTun, and G\u00f6tatunneln<\/a>, a physical tunnel located in Gothenburg. We have integrated privacy enhancing features like DAITA<\/a> & Multihop<\/a>, added first-class support for Android and used Rust to achieve great performance by using safe multi-threading and zero-copy<\/a> memory strategies.<\/p>\n\n\n\n

Last month we rolled it out to all our Android users, and we aim to ship it to the remaining platforms next year.<\/p>\n\n\n\n

Why GotaTun?<\/h2>\n\n\n\n

Our mobile apps have relied on wireguard-go for several years, a cross-platform userspace implementation of WireGuard\u00ae in Go. wireguard-go has been the de-facto userspace implementation of WireGuard\u00ae to this date, and many VPN providers besides Mullvad use it. Since mid-2024 we have been maintaining a fork of wireguard-go to support features like DAITA & Multihop. While wireguard-go has served its purpose for many years it has not been without its challenges.<\/p>\n\n\n\n

For Android apps distributed via the Google Play Store, Google collects crash reports and makes them available to developers. In the developer console we have seen that more than 85% of all crashes reported have stemmed from the wireguard-go. We have managed to solve some of the obscure issues over the years (#6727<\/a> and #7728<\/a> to name two examples), but many still remain. For these reasons we chose Android as the first platform to release GotaTun on, allowing us to see the impact right away.<\/p>\n\n\n\n

Another challenge we have faced is interoperating Rust and Go. Currently, most of the service components of the Mullvad VPN app are written in Rust with the exception of wireguard-go. Crossing the boundary between Rust and Go is done using a foreign function interface<\/a> (FFI), which is inherently unsafe and complex. Since Go is a managed language with its own separate runtime, how it executes is opaque to the Rust code. If wireguard-go were to hang or crash, recovering stacktraces is not always possible which makes debugging the code cumbersome. Limited visibility insight into crashes stemming from Go has made troubleshooting and long-term maintenance tedious.<\/p>\n\n\n\n

Outcome<\/h3>\n\n\n\n

The impact has been immediate. So far not a single crash has stemmed from GotaTun, meaning that all our old crashes from wireguard-go are now gone. Since rolling out GotaTun on Android with version 2025.10 in the end of November we\u2019ve seen a big drop in the metric user-perceived crash rate<\/a>, from 0.40% to 0.01%, when comparing to previous releases. The feedback from users’ have also been positive, with reports of better speeds and lower battery usage.<\/p>\n\n\n\n

\"\"\/
User-perceived crash rate<\/em><\/figcaption><\/figure>\n\n\n\n

Looking ahead<\/h3>\n\n\n\n

We\u2019ve reached the first major milestone with the release of GotaTun on Android, but we have a lot more exciting things in store for 2026.<\/p>\n\n\n\n

    \n
  • A third-party security audit will take place early next year.<\/li>\n\n\n\n
  • We will replace wireguard-go\u00a0with GotaTun across all platforms, including desktop and iOS.<\/li>\n\n\n\n
  • More effort will be put into improving performance.<\/li>\n<\/ul>\n\n\n\n

    We hope you are as excited as we are for 2026!<\/p>\n","protected":false},"excerpt":{"rendered":"

    They’re moving from Go to Rust for Wireguard, and there will be a security audit in the beginning of 2026. And Mullvad VPN is one of the few VPN services that I trust for their commitment to privacy and not paying influencers to recommend their service. https:\/\/mullvad.net\/en\/blog\/2025\/12\/19\/announcing-gotatun-the-future-of-wireguard-at-mullvad-vpn GotaTun is a WireGuard\u00ae implementation written in Rust […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":["post-14906","post","type-post","status-publish","format-standard","hentry","category-tech"],"blocksy_meta":[],"featured_image_src":null,"author_info":{"display_name":"Jason","author_link":"https:\/\/jasonsblog.ddns.net\/index.php\/author\/jturning\/"},"_links":{"self":[{"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/posts\/14906","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/comments?post=14906"}],"version-history":[{"count":1,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/posts\/14906\/revisions"}],"predecessor-version":[{"id":14908,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/posts\/14906\/revisions\/14908"}],"wp:attachment":[{"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/media?parent=14906"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/categories?post=14906"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/tags?post=14906"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}