How does NymVPN implement Wireguard?

NymVPN is designed to provide the best possible user experience, combining advanced privacy features with everyday speed. In addition to our “Anonymous” 5-hop mixnet mode for maximum privacy, we offer a “Fast”, everyday privacy solution using a decentralized VPN mode, powered by WireGuard.

To enhance privacy for our users, we’ve configured WireGuard with a 2-hop tunnel-in-a-tunnel setup:

• 2-hop: Your traffic is routed through two separate WireGuard nodes. The first node may see your IP address but has no visibility into your online activities, as all traffic is fully encrypted. The second node can see your online activity but cannot identify who you are.
• Tunnel-in-a-tunnel: Traffic from your device is doubly encrypted using an "onion" encryption model. The first node decrypts only the outer layer, and the second node decrypts the final layer before sending the traffic to its destination. Traditional 2-hop WireGuard setups don't provide this added layer of privacy, potentially revealing more information to the first node.
• AmneziaWG: NymVPN incorporates AmneziaWG (client-side), adding an extra layer of protection against censorship. By introducing decoy packets before the handshake initiation message, AmneziaWG disrupts simple rules often used to detect WireGuard traffic, making it harder for censorship mechanisms to identify and block connections. This ensures not only enhanced privacy but also greater reliability in restrictive environments. 

You can read more about NymVPN implementation of Wireguard in this blog post.