Definition
Standard WireGuard gives each peer a static internal IP address that the server keeps in memory while the connection is configured. NordVPN built NordLynx on top of WireGuard and added its own layer to avoid linking that address to a specific account.
How it works
With NordLynx, every user gets the same local IP inside the tunnel, and a second NAT layer on the server assigns a unique address for the session. NordVPN says the dynamic address is removed once the session ends. The encryption is WireGuard's: ChaCha20 for data, Poly1305 for authentication and Curve25519 for key exchange.
Why it matters
For NordVPN users NordLynx is normally the fastest choice and the app default. The double NAT design addresses a common privacy criticism of plain WireGuard, but it is a provider-specific claim, so independent no-logs audits remain the evidence to check.