Protocol Lab Shows WireGuard Traffic as Both Encrypted and Plaintext Simultaneously

A hands-on networking tutorial from the Protocol Lab series demonstrates how WireGuard VPN tunnels handle traffic by building a tunnel between two container nodes. The lab captures the same ping request at two different points: on the physical underlay link (eth1), only encrypted UDP traffic on port 51820 is visible, while the inner ICMP packet remains hidden. On the virtual tunnel interface (wg0), the decrypted ICMP traffic is fully readable, illustrating where WireGuard hands off the decrypted packet. WireGuard authenticates peers using public keys rather than usernames or passwords, and transports all traffic over UDP regardless of the inner protocol. The exercise draws comparisons to TLS and DNS-over-HTTPS, noting that WireGuard applies the same encrypt-and-authenticate principle but operates at the IP packet layer for any protocol.