Kernelspace wireguard. I found there were performance tradeoffs with tailscale because it's userspace.