RU Русский | EN English

Install AmneziaWG 3.1 / 2.0 VPN on Ubuntu and Debian VPS

One-command, self-hosted AmneziaWG 3.1 VPN for Ubuntu 24.04 / 26.04 and Debian 13, with AmneziaWG 2.0 for older clients and routers. Kernel-native DKMS, no Docker, no web panel, runs on any cheap VPS.

In-kernel, no Docker or panels - zero overhead  |  VPN-only server, hardened by default  |  set it and forget it  |  QR or one-tap vpn:// import

Facts as of 2026-10-04. Installer 5.37.1. OS support dates verified against vendor data on 2026-08-29.

For a new server	Ubuntu 24.04, Debian 13
Also supported	Ubuntu 26.04
Not for new servers	Debian 12 - no longer under standard vendor support
Architectures	x86_64, ARM64, ARMv7
Kernel module	DKMS from the Amnezia PPA; on kernels older than 6.7 (a stock Debian 12) a pinned 2.0 module built from source; prebuilt packages for some ARM targets
Config profile	AmneziaWG 3.1 for a new install; 2.0 with --protocol=2.0, or automatically where 3.1 cannot run (kernel older than 6.7, ARM); a running server keeps its generation

🚀 Quick Start

wget -O install_amneziawg_en.sh https://github.com/bivlked/amneziawg-installer/releases/latest/download/install_amneziawg_en.sh
chmod +x install_amneziawg_en.sh
sudo bash ./install_amneziawg_en.sh

What it does: installs AmneziaWG (kernel module via DKMS, or a prebuilt package on some ARM boards; AmneziaWG 3.1 by default, when you need 2.0 is covered in AmneziaWG 3.1 by default), sets up the server and forwarding, offers to turn on the UFW firewall, and creates two clients, my_phone and my_laptop. Their configs, QR codes and vpn:// links are saved in /root/awg/; how to get them onto your phone is in After installation. Adding a friend or a device later is a single add command. Have a router on stock firmware, Hiddify, or apps that have not been updated for a long time? Add --protocol=2.0 to the last command, here is why. 3 commands. 2 reboots along the way. About 20 minutes to a working VPN. For a clean Ubuntu/Debian VPS, not a home router or shared hosting. Details →

📘 Full deployment guide: Install AmneziaWG VPN server on Ubuntu/Debian VPS - covers VPS choice, ARM, troubleshooting, and uninstall.

🔐 Integrity: the installer is downloaded over HTTPS from the latest GitHub release. You can check it before running with its minisign signature: Verifying a release. The helper scripts it fetches itself (awg_common, manage) come from the tag of its own version and are checked against SHA256 hashes built into it, so the installer's signature covers them too (unless you override AWG_BRANCH). Threat model: docs/SIGNING_DESIGN.md; how to report a vulnerability: SECURITY.md.

What the installer changes on your server (transparency)

The script runs as root. Below are the main changes it makes to the system.

• System update. apt-get upgrade --with-new-pkgs: it never removes packages, but a new kernel can arrive. Before that it writes /etc/apt/apt.conf.d/99-amneziawg-lock-timeout (wait up to 5 minutes for the dpkg lock) and marks as manually installed the packages the server needs to boot and keep its network (udev, initramfs-tools, openssh-server, netplan.io and others).
• Package removal, with your consent: if the server has no snaps, Enter means yes, and --yes counts as consent; keep the packages with --keep-packages. It removes modemmanager, networkd-dispatcher, unattended-upgrades (security updates stop installing automatically), packagekit and udisks2. On Ubuntu also snapd with /snap, /var/snap, /var/lib/snapd, and lxd-agent-loader. cloud-init goes, with /etc/cloud and /var/lib/cloud, only when it does not manage the network.
• Packages installed. curl, wget, gpg, sudo, amneziawg-dkms, amneziawg-tools, wireguard-tools, dkms, build-essential, dpkg-dev, qrencode, kernel headers, ufw, fail2ban (plus python3-systemd on Debian). When the 2.0 module is built from source, git is added; stale kernel headers bring gcc-13. On some ARM boards a prebuilt module package from the arm-packages release is installed instead of a build.
• Repository. The Amnezia PPA: /etc/apt/sources.list.d/amnezia-ppa.sources (.list on Debian 12) and the key /etc/apt/keyrings/amnezia-ppa.gpg. The key ships inside the installer, is checked by its full fingerprint and is trusted for this repository only.
• Kernel module. amneziawg is built via DKMS and loaded at boot (/etc/modules-load.d/amneziawg.conf). After a kernel update the module is rebuilt automatically by /usr/local/sbin/amneziawg-ensure-module, the apt hook /etc/apt/apt.conf.d/99-amneziawg-post-kernel and the amneziawg-ensure-module.service unit, with a log in /var/log/amneziawg-ensure-module.log. ARM hosts with a prebuilt package do not get this: after a kernel change, run the installer again.
• sysctl, in /etc/sysctl.d/99-amneziawg-security.conf: forwarding, host IPv6 off (keep it with --allow-ipv6), BBR, buffers sized to RAM, rp_filter = 2, no redirects, SYN cookies, vm.swappiness = 10, net.netfilter.nf_conntrack_max = 65536, kernel.sysrq = 0, kernel.printk = 3 4 1 3.
• Swap. When swap is below 1 GB (up to 2 GB of RAM) or below 512 MB (more RAM), it creates /swapfile and adds a line to /etc/fstab.
• Firewall. UFW: incoming denied, SSH rate-limited on the detected port (or --ssh-port), the VPN UDP port open, and a forwarding rule from awg0 to the external interface. If UFW is not on yet, the installer asks whether to enable it (with --yes it is enabled without asking). Fail2Ban protects SSH, with its settings in /etc/fail2ban/jail.d/amneziawg.conf. The SSH server configuration is not touched.
• VPN. The server config /etc/amnezia/amneziawg/awg0.conf with iptables rules in PostUp, the awg-quick@awg0 service, the /root/awg/ directory (keys, client configs, log, management scripts) with 700/600 permissions, and the cron job /etc/cron.d/awg-expiry for clients with an expiry date.
• Reboots. There are two: after the system update and after the module install. After each one, run the same command again.
• Rollback: --uninstall removes its own module, configs, sysctl files, cron jobs, the VPN-port UFW allow rule and the awg0 UFW route rule. It disables UFW and purges Fail2Ban only if it enabled/installed them itself; if UFW was already active before install, the SSH rate-limit rule it added stays. It does not restore swap settings or removed packages, and the dependency packages it added (dkms, the compiler, kernel headers) stay. By default, --yes included, it first creates the archive /root/awg_uninstall_backup_*.tar.gz with the configs and private keys; it stays on the server, so delete it yourself once you no longer need it.

--no-tweaks leaves packages, swap, sysctl hardening, UFW and Fail2Ban alone. Forwarding is enabled anyway, in /etc/sysctl.d/99-amneziawg-forwarding.conf, and the same file turns host IPv6 off unless you pass --allow-ipv6; the system update runs as usual. What stays after an uninstall is in INSTALL_VPS.md, the threat model in docs/SIGNING_DESIGN.md, signature verification in Verifying a release.

Non-interactive installation (for automation)

sudo bash ./install_amneziawg_en.sh --yes --route-all

All parameters are accepted automatically. Details: ADVANCED.en.md#cli-params-adv

🎯 Pick your case

Your situation	What to add
Plain cheap VPS, you just need a VPN	Nothing - the command above already does it
Mobile data, DPI cuts the link (TSPU, Iran, school or office)	During install, add --mobile - the obfuscation preset plus port 443/udp in one go (tested carriers)
ARM: Raspberry Pi, Oracle Ampere, Hetzner CAX	Same command - ready-made ARM kernel modules are selected automatically (details)
Time-limited access for a friend or guest	After install: sudo bash /root/awg/manage_amneziawg.sh add guest --expires=7d

---

Why this project • AmneziaWG 3.x • AWG vs WG • CLI vs panels • Similar tools • Quick Start • Features • Carriers • Requirements • Hosting • Installation • Verifying a release • After installation • Management • More • FAQ • Troubleshooting • Ecosystem • License

💡 Why this project

AmneziaWG is a fork of WireGuard with traffic obfuscation. The obfuscation makes the traffic hard for DPI systems to tell apart from random noise, so where plain WireGuard gets detected and blocked, AmneziaWG usually keeps working.

This set of scripts turns a clean VPS into a ready-to-use VPN server. No Linux knowledge required - the script configures the firewall, optimizes the system, and generates client configs and QR codes automatically.

The server is tuned for a single job - VPN: extra packages are removed, the kernel, network stack and swap are tuned to the hardware, and the firewall and baseline hardening are enabled. AmneziaWG runs in the kernel, so overhead is minimal - fast and lean. Set it up once for your home or family and forget it: adding a friend or a new device a month later takes a minute, with the config and QR generated by a single command.

Recommended: Ubuntu 24.04 LTS and Debian 13. Ubuntu 26.04 is supported as well: the module from the PPA does not build for its kernel 7.0.0-38 on its own, and since v5.37.1 the installer fixes its source itself; details are in the known limitations. Debian 12 installs and runs too, but it is past regular support, and Ubuntu 25.10 is out of vendor support altogether and is not supported since v6.0.0 - the dates are in the compatibility table below. Any cheap VPS with 1 GB RAM is enough.

---

🆕 AmneziaWG 3.1 by default

Since version 6.0.0 a new install gets AmneziaWG 3.1 by default: both the server and the client profiles carry third-line parameters - header encryption (HeaderProtectionKey) and extra padding inside the encrypted part (ContentPaddingAddition). The install command is the same, no flags needed. Junk packets Jc, padding S1-S4 and the I1 concealment packet stay. H1-H4 are set to 1-4 in the 3.1 profile: header encryption now hides the message type, and random ranges no longer conceal anything.

Who needs --protocol=2.0. A client without 3.1 support will not accept a 3.1 profile: there is no handshake, and there may be no error message either. So if any of your devices runs such a client, install the server on 2.0 from the start:

sudo bash ./install_amneziawg_en.sh --protocol=2.0

Still without 3.1 support: routers on stock firmware (stable KeeneticOS, OpenWrt with an old amneziawg package), Hiddify, and apps that have not been updated for a long time. Which clients understand 3.1 and from which version is in the client table. Better decide before installing: the generation of a running server changes only through a reinstall, and then every client profile is issued again.

Where the installer picks 2.0 by itself. On kernels older than 6.7 (a stock Debian 12 with kernel 6.1), on ARM, and where the installed awg tools or the kernel module do not understand third-line parameters, 3.1 cannot run. If you did not choose a generation, the installer installs 2.0 by itself, explains the reason in the log and repeats it in the final report. An explicit --protocol=3.1 on such a machine stops the install and names the reason.

Servers that already run keep their generation: updating the scripts and manage do not change it. Moving from 2.0 to 3.1 means removing the install (--uninstall) and installing again, and every client profile is issued again. Back from 3.1 to 2.0 works the same way: --uninstall (it removes the server and its 3.1 profiles, keeping a backup copy by default), then an install with --protocol=2.0 and new profiles for every client.

The installer prints the generation in the final report, on the "Protocol generation" line. Versions of the tools and of the loaded module:

awg --version                        # tools version
cat /sys/module/amneziawg/version    # version of the loaded module

The detailed write-up - what changes on the wire, what has to match between server and client, and what the 3.1 profile is made of - lives in ADVANCED.en.md.

---

⚖️ AmneziaWG vs WireGuard

	WireGuard	AmneziaWG 2.0
DPI detection	Fingerprinted by fixed packet sizes and magic bytes	Hard to fingerprint - randomized headers, padding, protocol mimicry
Blocked in	China, Russia, Iran, UAE, Turkmenistan	Nothing to block by fixed signature - there is none. Address and UDP port blocking remain: another port or --mobile can help
Server setup	Manual: keys, iptables, sysctl, systemd	One command, 20 min, fully automatic
Hardening	DIY: UFW, Fail2Ban, sysctl	Automatic: firewall + brute-force protection + kernel tuning
Client management	Edit configs by hand, restart	add/remove/list/stats with hot-reload
Temporary access	Not built-in	--expires=7d with auto-cleanup
Server requirements	-	Same - any $3-5/mo VPS, 1 GB RAM
Speed overhead	Baseline	Kernel module: encryption and obfuscation run in kernel space, no userspace round-trip

On speed: on a server with a single shared vCPU the CPU becomes the bottleneck, because encryption and obfuscation run on that same core. Diagnostics: FAQ in ADVANCED.

If WireGuard works for you and isn't blocked - keep using it. If it's blocked or throttled - AmneziaWG 2.0 is the drop-in replacement.

---

⚙️ CLI Installer vs Web Panels

The goal: set up a VPN on a cheap VPS in 20 minutes. The script doesn't pull in Docker, a web server, or a database. After installation only AWG and the firewall are running - minimal footprint, maximum resources for VPN.

	This project (CLI)	Docker-based web panels
AWG module	Kernel module - runs at kernel level	Userspace inside a container
Server requirements	Any VPS with 512 MB RAM	Needs PHP/Python, database, web server, Docker
Attack surface	SSH + UDP VPN port	+ HTTP panel, database, Docker
Installation	Single command on the server, 20 minutes	docker-compose + giving SSH access to the panel
After reboot	Resumes installation from the same step	Depends on container and database state
Web interface	❌ None, SSH only (managed via the manage script)	✅ GUI, browser-based management
Multiple protocols	AmneziaWG only	WireGuard, OpenVPN, VLESS and others

Need a VPN without GUI on a dedicated server - this project. Need a web panel with multiple protocols - look for Docker-based solutions.

---

🔧 Comparison with similar tools

There are a few other ways to get AmneziaWG running. Each picks a different trade-off:

Tool	Path	Best for
This installer	SSH + one bash command	Headless VPS, single-purpose box, no Docker or panel, ARM prebuilts
wiresock/amneziawg-install	SSH + bash, optional native web panel and obfuscation proxy (Rust)	Want a browser panel without Docker, or traffic masking via a separate service
wg-easy	Docker + web UI	Home-lab boxes that already run Docker; want a browser panel for peers
spcfox/amnezia-wg-easy	Docker fork of wg-easy	Existing wg-easy users who specifically want AmneziaWG instead of plain WireGuard
Amnezia VPN app	Desktop/mobile GUI, deploys the server side in Docker over SSH	Click-through setup with no terminal; want a graphical client

Quick pick:

• Frequently add and rotate peers and prefer a browser GUI - a web panel: wiresock (native, no Docker) or wg-easy (Docker). Note: a panel is an extra always-on service, an open port and ongoing resource use; for a set-and-forget box it is needless overhead.
• Cheap or low-spec VPS, ARM (Raspberry Pi, Oracle Ampere) - this installer, with ready-made prebuilts and no module-build wait.
• One-tap phone import (QR or vpn://), time-limited clients (--expires), mobile-carrier presets - this installer.
• Point-and-click setup with no terminal - the Amnezia VPN desktop client.

When this project is not your best fit:

• Frequently add and rotate peers and want a browser panel - pick wiresock or wg-easy. There is no panel here by design: if peers change rarely, an always-on panel only burns server resources, and management is done from the CLI (manage add/remove/list) over SSH.
• You want resistance to active probing - masking the traffic as another protocol (such as QUIC or DNS): wiresock has a separate obfuscation proxy for that (the server-side masking works with any standard client; the full bidirectional capability pairs with their commercial WireSock Secure Connect client). Here the obfuscation lives in the protocol itself - the AmneziaWG 2.0 I1-I5/CPS parameters - and is aimed at everyday mobile DPI, with no separate proxy daemon and no paid client.
• You want a graphical client or point-and-click setup with no terminal - the Amnezia VPN desktop client.

How it differs from the official Amnezia app

The official Amnezia app is the official graphical client: you install the app, point it at a server, and it deploys the server side in Docker over SSH. Handy when all you want is a GUI. This installer is built for a different goal - to get the most out of a single dedicated VPS as a VPN server. That is where the differences come from:

• No Docker, and none of its overhead. AmneziaWG runs as a kernel module rather than inside a container. There is no Docker daemon sitting in the background, so RAM and CPU use stay lower. On a cheap VPS that matters a lot, and it does no harm on a bigger one either.
• The whole server is tuned to the hardware. The script reads the server's RAM, then sets sysctl buffers and swap size and turns on BBR - it wrings the most out of the plan you are paying for. The official app deploys its containers and does not optimize or tune the server itself.
• Smaller attack surface. Unneeded packages and services are stripped, so the box does one thing - VPN. On top of that: UFW deny-all, Fail2Ban, strict file permissions, and sysctl hardening.
• Fine control over the obfuscation. A mobile-network preset (--preset=mobile), direct access to the AmneziaWG parameters, and field data on carriers and DPI - you can tune it for a specific network or carrier.
• Headless and scriptable. One SSH command, every parameter as a flag, CLI client management, time-limited guests (--expires), QR or vpn:// import, and prebuilt modules for ARM.

The protocol and the DPI resistance are the same - it is the same AmneziaWG protocol underneath. The code is open under the MIT license, it is readable bash you can review before running, and it has 2000+ automated tests. It installs the same upstream AmneziaWG - this is automation and server tuning, not a fork of the protocol.

Detailed comparison: amneziawg-installer vs the official Amnezia app.

---

✨ Features

• DPI bypass - AmneziaWG 3.1 (or 2.0 for older clients) with traffic obfuscation. DPI cannot detect the connection
• One command - working VPN - from a clean VPS to a running server with client configs and QR codes
• Secure by default - UFW, Fail2Ban, sysctl hardening, strict file permissions (600/700)
• Easy management - add/remove clients, temporary clients with auto-removal, traffic stats, backups
• Broad OS support - Ubuntu 24.04, 26.04 and Debian 13; Debian 12 for moving an existing server across
• x86_64 and ARM - cloud VPS, Raspberry Pi 3/4/5, ARM64 servers (AWS Graviton, Oracle Ampere, Hetzner)
• Mobile network optimization - --preset=mobile for Tele2, Yota, Megafon and other carriers with DPI blocking. Fine-tune with --jc, --jmin, --jmax (details)
• Optional dual-stack IPv6 - the --allow-ipv6-tunnel flag adds IPv6 inside the tunnel next to IPv4 (off by default, details)

All features

• Native key and config generation via awg - no Python or external dependencies
• Hardware-aware optimization: swap and network buffers tuned to server specs
• DKMS - automatic kernel module rebuild on updates
• vpn:// URI for one-tap import into Amnezia Client (.vpnuri files)
• Per-client traffic statistics (stats, stats --json)
• Temporary clients with auto-removal (--expires=1h, 7d, 4w, etc.)
• Diagnostic report (--diagnostic) and full uninstall (--uninstall)
• All actions logged to /root/awg/
• Resume after reboot - the script picks up from where it left off
• Choice of port, subnet, IPv6 mode, routing mode, and client isolation (--isolation=on|off). --endpoint flag for servers behind NAT

---

📡 Tested mobile carriers (Russia)

The installer tunes AmneziaWG obfuscation for mobile networks with DPI: --mobile switches on the mobile preset and port 443/udp in a single flag. If your VPN is unstable on mobile data, use --mobile right away on a new server. On a running server this means reinstalling with --force --mobile: the obfuscation parameters and the port change, and every client needs its config reissued with regen. If the handshake never completes on mobile data, read the walkthrough first. The configurations below come from user reports in issues and discussions (no guarantee: blocking and carrier parameters change over time):

• Yota - Moscow, --preset=mobile
• Tele2 - Moscow (--preset=mobile); Krasnoyarsk (--preset=mobile; the May 2026 wave needed I1=<r 48>)
• Tattelecom / Letai - Tatarstan, --preset=mobile
• Megafon - regional networks, --preset=mobile + remove the I1 parameter
• Beeline - default preset, no flags needed
• Home / wired ISPs - default preset usually works out of the box

Your carrier is not on the list? Try --preset=mobile. If that doesn't work - open a thread in Discussions or Issues and I'll add the entry.

Full operator parameter table (Jc, Jmin, Jmax, I1) - in ADVANCED.en.md → FAQ "connects over cellular only on the third attempt". Per-flag overrides via --jc/--jmin/--jmax - in ADVANCED.en.md → Presets.

---

🖥️ Requirements

• OS: A clean installation of Ubuntu Server 24.04 LTS / Ubuntu 26.04 / Debian 13 Minimal. Debian 12 is supported too, but do not pick it for a NEW server - see the compatibility table
• Access: root privileges (via sudo)
• Internet: Stable connection
• Resources: 512 MB RAM minimum, 1 GB recommended (2+ GB comfortable); minimum ~2 GB disk (3+ GB recommended)
• SSH: SSH access to the server

OS Compatibility:

OS	Our pick	Vendor support	Notes
Ubuntu 24.04 LTS	✅ default pick	until 2029-05-31	The best-tested platform. The HWE kernel 7.0.0-38 is supported since v5.37.1: the installer fixes the PPA module source itself (details)
Debian 13 (trixie)	✅ default pick	until 2028-08-09	Tested. PPA via codename mapping to noble, DEB822
Ubuntu 26.04	⚠️ for now, with a caveat	until 2031-05-29	The PPA module does not build for kernel 7.0.0-38 on its own, since v5.37.1 the installer fixes its source itself (details). The installer checks whether the PPA answers for the release codename and switches to noble itself if it does not (since v5.13.0)
Debian 12 (bookworm)	⚠️ for migration	regular ended 2026-07-11, Debian LTS until 2028-06-30	Works and is tested, security updates continue through Debian LTS. PPA via codename mapping to focal. For a new server prefer Debian 13
Ubuntu 25.10 (questing)	❌ not supported since v6.0.0	ended 2026-07-01, no extension	Out of vendor support, no security updates are published for it. The installer warns about an untested release and asks for confirmation. Move to 26.04 LTS (do-release-upgrade, then run the latest installer again) or reinstall on 24.04 LTS

Architecture support (v5.10.0+):

Architecture	Status	Platforms
x86_64 (amd64)	✅ Fully supported	All cloud VPS
ARM64 (aarch64)	✅ Supported	Raspberry Pi 3/4/5, AWS Graviton, Oracle Ampere, Hetzner
ARMv7 (armhf)	✅ Supported	Raspberry Pi 3/4 (32-bit)

On ARM, the installer downloads prebuilt kernel modules when available and falls back to DKMS compilation automatically.

⚠️ Non-standard SSH port: The installer usually detects the SSH port automatically. If SSH runs on a non-standard port or autodetection is unavailable, run with --ssh-port=YOUR_PORT (comma-separated for several ports). As an extra conservative safeguard you can run sudo ufw allow YOUR_PORT/tcp before starting the installer.

Clients:

• All platforms: Amnezia VPN - full-featured VPN client: the 3.1 profile from version 5.0.1.5, the 2.0 profile from 4.8.12.7. Import via vpn:// URI
• Windows: AmneziaWG - lightweight tunnel manager: the 3.1 profile from version 3.1.0, the 2.0 profile from 2.0.0. Import via .conf files

Full client compatibility table →

---

🚀 Hosting Recommendation

For a stable, high-throughput VPN server, you need reliable hosting with a good network.

What to look for in a VPS for VPN:

• IPs not flagged as datacenter ranges - lower risk of range-based blocks.
• Generous or unlimited traffic and a 1 Gbps+ port.
• Your target OS (Ubuntu 24.04 LTS, 26.04 or Debian 13; Debian 12 works too) and root access.

I've tested and recommend FreakHosting. Their BUDGET VPS lineup offers excellent value for money. This is an affiliate link: I get a small commission if you order through it, the price for you is the same.

Their IPs are not flagged as datacenter - they are not blocked by services that restrict hosting/datacenter IP ranges (unlike Azure and some major clouds).

• Recommended plan: BVPS-2
• Specs: 2 vCPU, 2 GB RAM, 40 GB NVMe SSD.
• Key advantage: 10 Gbps port with unlimited traffic. Perfect for VPN!
• Price: Just €25 per year (at time of writing; may change).

This configuration is more than enough for comfortable AmneziaWG operation with many connections and heavy traffic.

---

🔧 Installation (Recommended Method)

Installing AmneziaWG on Ubuntu or Debian comes down to three commands: download the script, run it with sudo, and answer a few questions. This method handles interactive prompts and colored output correctly in your terminal.

1. Connect to a clean server (Ubuntu 24.04 / Ubuntu 26.04 / Debian 13) via SSH.

   Tip: After creating the server, wait 5-10 minutes for all background initialization processes to complete before starting the installation.

2. Download the script:

   wget -O install_amneziawg_en.sh https://github.com/bivlked/amneziawg-installer/releases/latest/download/install_amneziawg_en.sh
   # or: curl -fLo install_amneziawg_en.sh https://github.com/bivlked/amneziawg-installer/releases/latest/download/install_amneziawg_en.sh
   

   Minimal Debian may not ship curl (wget is usually present) - use wget. The installer itself adds curl in step 1.

3. Make it executable:

   chmod +x install_amneziawg_en.sh
   

4. Run with sudo:

   sudo bash ./install_amneziawg_en.sh
   

   (You can also pass command-line parameters, see sudo bash ./install_amneziawg_en.sh --help or ADVANCED.en.md#install-cli-adv)

   Russian version: For Russian output, use install_amneziawg.sh:

   wget -O install_amneziawg.sh https://github.com/bivlked/amneziawg-installer/releases/latest/download/install_amneziawg.sh
   sudo bash ./install_amneziawg.sh
   

   The Russian version is functionally identical; only user-facing messages and logs are in Russian. After reboots, resume with the same file: sudo bash ./install_amneziawg.sh

5. Initial setup: The script will interactively ask for:

   • UDP port: Port for client connections (1-65535). Default: 39743.

   • Tunnel subnet: Internal VPN network. Default: 10.9.9.1/24.

   • Disable IPv6: recommended (Y). This is IPv6 on the server itself; whether your device's IPv6 goes into the tunnel is decided by the routing mode, see Device IPv6, ::/0 and the local network.

   • Routing mode: Determines which traffic goes through the VPN. Default 1 (all traffic, 0.0.0.0/0) - the full-tunnel form clients expect. Mode 2 (Amnezia List + DNS) keeps the private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) out of the tunnel, but some clients treat such a list as split routing and behave differently.

   • Client isolation: Whether to block traffic between clients inside the VPN. Enabled (Y) by default - clients cannot see each other; non-interactive: --isolation=on|off.

   • Server name: The server shows up under this name in the Amnezia app on vpn:// import. Default AWG Server; non-interactive: --server-name=NAME.

   • Package cleanup: the script lists what it would remove (snapd, unattended-upgrades and others) and asks first. To keep them, answer n or pass --keep-packages.

   Obfuscation parameters (on 3.1 together with the header protection key) are generated automatically - no action required.

6. Reboots: TWO reboots are required. The script will ask for confirmation [y/N]. Type y and press Enter.

7. Resume: After each reboot, run the script again with the same command:

   sudo bash ./install_amneziawg_en.sh
   

   The script resumes from where it left off, and earlier questions are not asked again. If UFW is not on yet, one new question comes in the third run: "Enable UFW? [y/N]". Answer y: pressing Enter leaves the firewall off, and the server stays without one. With --yes, UFW is enabled without asking.

8. Completion: After the second reboot and the third script run, you will see the message: AmneziaWG 3.1 installation and configuration COMPLETED SUCCESSFULLY! (or 2.0 if the server was installed on it) and a "Protocol generation" line with the reason when the installer picked 2.0 by itself.

---

🔏 Verifying a release (optional, best done before running)

The installer is signed with a minisign key that the maintainer keeps offline and that never reaches GitHub Actions. Releases carry signatures from v5.29.0 on.

sudo apt install minisign
BASE="https://github.com/bivlked/amneziawg-installer/releases/latest/download"
wget -O install_amneziawg_en.sh         "$BASE/install_amneziawg_en.sh"
wget -O install_amneziawg_en.sh.minisig "$BASE/install_amneziawg_en.sh.minisig"

minisign -V -P RWQXfpABHIpZPttqrwYrQNHRTk/iLIz4cVh9KkRwAElHP+CoW/NPEysN \
  -m install_amneziawg_en.sh -x install_amneziawg_en.sh.minisig

Expected: Signature and comment signature verified, and on the next line Trusted comment: amneziawg-installer vX.Y.Z install_amneziawg_en.sh. The tag must match the latest release on the releases page, and the name must match the file you downloaded. If the check fails, download both files again, since a new release may have come out between the two downloads. If it fails again, do not run the script.

Compare the whole key. The project public key is RWQXfpABHIpZPttqrwYrQNHRTk/iLIz4cVh9KkRwAElHP+CoW/NPEysN. The same key is in KEYS.txt at the repository root and in every signed release (v5.29.0 and later). 3E598A1C01907E17 is the key ID, not a fingerprint: another key can carry the same ID, so it proves nothing on its own. Keep your own copy of the key and use it next time.

What the signature covers. You verify the installer itself. The scripts it fetches later (awg_common_en.sh, manage_amneziawg_en.sh) are checked against SHA256 hashes built into it, so a signed installer covers them too, as long as AWG_BRANCH is left at its default. Not covered:

• prebuilt ARM module packages from the arm-packages release: their hash sits next to them and only catches a broken download;
• packages from the Amnezia PPA: apt checks them with the PPA key;
• scripts you replace by hand: repeat the command above with their names.

⚠️ What this does not give you. If you copy the key from this page in the same session, the check protects against tampering on the way to you, not against a compromised account: whoever can replace the script can replace this page. It starts to mean something once the key is one you saved earlier.

📦 After installation

Where to find client files:

File	Path	Purpose
.conf	/root/awg/name.conf	Configuration for client import
.png	/root/awg/name.png	QR code of the same .conf for AmneziaWG clients
.vpnuri	/root/awg/name.vpnuri	vpn:// URI for Amnezia Client
.vpnuri.png	/root/awg/name.vpnuri.png	QR code of the vpn:// link for the Amnezia VPN app

Download config to your computer:

scp root@SERVER_IP:/root/awg/my_phone.conf .

Import into Amnezia VPN (phone) via vpn:// URI

1. On the server, run: cat /root/awg/my_phone.vpnuri
2. Copy the text and send it to yourself (Telegram, email, etc.)
3. On your phone: Amnezia VPN → "Add VPN" → "Paste from clipboard"

Import via QR code

1. Download the QR code of the link: scp root@SERVER_IP:/root/awg/my_phone.vpnuri.png .
2. Open the file on your computer screen
3. On your phone: Amnezia VPN → "Add VPN" → "Scan QR code"

my_phone.png (without vpnuri in the name) is the QR code of the .conf itself, for an AmneziaWG client; do not scan it in Amnezia VPN.

Import into AmneziaWG for Windows

1. Download the .conf file to your computer via scp or sftp
2. AmneziaWG → Import tunnel(s) from file → select the .conf file

Other files on the server:

• Server configuration: /etc/amnezia/amneziawg/awg0.conf
• Script settings: /root/awg/awgsetup_cfg.init
• Management script: /root/awg/manage_amneziawg.sh
• Shared functions: /root/awg/awg_common.sh
• Client expiry data: /root/awg/expiry/
• Logs: /root/awg/*.log

---

👥 Client Management (manage_amneziawg.sh)

The manage_amneziawg.sh script is downloaded automatically during installation.

Usage:

sudo bash /root/awg/manage_amneziawg.sh <command> [arguments]

Full list: ... help or ADVANCED.en.md#manage-commands-adv.

Everyday commands:

Command	Arguments	Description	Restart?
add	<name> [name2 ...] [--expires=DUR] [--allowed-ips=LIST]	Add client(s) (opt. with expiry and per-client routes)	No (auto)
remove	<name> [name2 ...]	Remove client(s)	No (auto)
list	[-v] [--json]	List clients (-v for details, --json machine-readable with client_ipv6 and expires_at)	No
show		Run awg show	No
stats	[--json]	Per-client traffic statistics	No

Maintenance and recovery:

Command	Arguments	Description	Restart?
regen	[name ...] [--reset-routes]	Regenerate files (all/listed)	No
modify	<name> <param> <val>	Modify a client parameter	No
backup		Create a backup	No
restore	[file]	Restore from backup	No
check		Check server status	No
diagnose	[--carrier=NAME]	Diagnostics (opt. per carrier)	No
repair-module		Rebuild kernel module (DKMS)	Yes
restart		Restart AmneziaWG service	-

💡 Note: add and remove commands auto-apply changes via awg syncconf - no service restart needed.

🤖 For scripts and bots: since v5.21.0 nearly every management command (from add to repair-module) understands --json and replies with a single JSON object, even when something goes wrong - so your script or bot can parse the output without guesswork. list --json and stats --json still return plain arrays, as before. The format and the strict confirmation mode AWG_STRICT_CONFIRM=1 are covered in ADVANCED.en.md → JSON interface, and there is already a Telegram bot built on this interface - awgram.

📌 Quick Reference

# Installation (English)
wget -O install_amneziawg_en.sh https://github.com/bivlked/amneziawg-installer/releases/latest/download/install_amneziawg_en.sh
sudo bash ./install_amneziawg_en.sh       # Run (+ 2 reboots)

# Installation (Russian)
wget -O install_amneziawg.sh https://github.com/bivlked/amneziawg-installer/releases/latest/download/install_amneziawg.sh
sudo bash ./install_amneziawg.sh          # Run (+ 2 reboots)

# Client management
sudo bash /root/awg/manage_amneziawg.sh add my_phone       # Add
sudo bash /root/awg/manage_amneziawg.sh add my_iphone --psk  # +PresharedKey (Shadowrocket iOS/macOS)
sudo bash /root/awg/manage_amneziawg.sh remove my_phone    # Remove
sudo bash /root/awg/manage_amneziawg.sh list                # List
sudo bash /root/awg/manage_amneziawg.sh list --json         # List as JSON (for scripts)
sudo bash /root/awg/manage_amneziawg.sh regen               # Regenerate

# Temporary client (7 days)
sudo bash /root/awg/manage_amneziawg.sh add guest --expires=7d

# Traffic statistics
sudo bash /root/awg/manage_amneziawg.sh stats
sudo bash /root/awg/manage_amneziawg.sh stats --json

# Maintenance
sudo bash /root/awg/manage_amneziawg.sh check               # Diagnostics
sudo bash /root/awg/manage_amneziawg.sh backup               # Backup
sudo bash /root/awg/manage_amneziawg.sh restart              # Restart

---

ℹ️ Additional Information

For detailed information on configuration, security settings, AmneziaWG 2.0 and 3.1 parameters, management commands, technical details, and more, see ADVANCED.en.md.

For the changelog, see CHANGELOG.en.md.

For the roadmap and priorities, see docs/ROADMAP.md.

For a two-server cascade with a split exit for Russian and foreign traffic (split-tunnel), see CASCADE.en.md.

For selectively routing the Russian segment through Cloudflare WARP via a BGP feed on a single server, see WARP-RU.en.md.

---

❓ FAQ

In this section: install and updates, connecting clients, mobile networks, choosing a host and migrating, security and parameters. Expand the relevant question below.

Q: Will it survive a kernel update?

A: On a regular DKMS install, yes: the module is rebuilt at the next boot; check with dkms status. On ARM with a prebuilt module, no: after a kernel change the tunnel will not come up by itself. The standard fix is to run the installer again (sudo bash ./install_amneziawg_en.sh --force), which installs the module for the new kernel; it is a full run with two reboots.

Q: How do I completely uninstall AmneziaWG?

A: Download the installer script (if you don't have it) and run: sudo bash ./install_amneziawg_en.sh --uninstall.

Q: Clients can't connect - what should I do?

A: 1. Check status: sudo bash /root/awg/manage_amneziawg.sh check. 2. Check firewall: sudo ufw status verbose. 3. Verify client config. 4. Check logs: sudo journalctl -u awg-quick@awg0 -n 50. 5. Make sure the client understands the server generation (the "Protocol generation" line in the installer final report): 3.1 needs Amnezia VPN >= 5.0.1.5 or AmneziaWG >= 3.1.0 on Windows, >= 3.1.4 on Android and iOS, 2.0 needs Amnezia VPN >= 4.8.12.7 or AmneziaWG >= 2.0.0.

Q: Handshake completes but no traffic flows - what's wrong?

A: A common cause is the split-tunneling AllowedIPs gotcha during manual customization. If you want to ping or SSH to the server by its inner tunnel IP (10.9.9.1 in the default subnet), add the tunnel subnet (default 10.9.9.0/24, or your custom one if you changed --subnet) to the client's AllowedIPs. Otherwise the client does not route traffic to the server even from inside the tunnel. The --route-all mode (full tunnel 0.0.0.0/0, the default) covers the subnet automatically; --route-amnezia (Amnezia List) and --route-custom= do not, add it explicitly. See ADVANCED.en.md → AllowedIPs.

Separate from the routing mode: by default clients are isolated from each other on the server (a FORWARD awg0→awg0 DROP rule), even if both are in the same mode. To let devices see each other inside the VPN, set --isolation=off at install time - the server drops the block, and the tunnel subnet is added to clients' AllowedIPs automatically. See ADVANCED.en.md → Client Isolation.

Q: Can I make Russian traffic go directly while the rest exits abroad?

A: Yes, via a two-server cascade: the client connects to an entry server (ideally in Russia), Russian traffic exits directly from it, and everything else goes through a second server abroad. The split is on the server side, nothing special is needed on the client. Step-by-step guide in CASCADE.en.md.

Q: Can I use this with AWG 1.x clients?

A: No. AWG 1.x clients understand neither the 3.1 profile nor the 2.0 one: a client has to support the server generation - 3.1 by default, or 2.0 if the server was installed on it. For AWG 1.x, use the legacy/v4 branch.

Q: Config import error "Invalid key: s3" - what's wrong?

A: You're using an outdated version of amneziawg-windows-client (< 2.0.0). Update to version 2.0.0+ which supports AWG 2.0; a 3.1 server needs version 3.1.0 or newer. Alternatively, use Amnezia VPN >= 4.8.12.7, or >= 5.0.1.5 for 3.1.

Q: How do I update the scripts to a newer version?

A: No server reinstall is needed: replacing the two scripts in /root/awg/ is enough. Download them into a temporary directory, verify the signatures, and only then replace the files (this needs minisign: sudo apt install minisign). A plain wget -O over the working file would leave an empty file if the download failed.

  cd "$(mktemp -d)"
  KEY=RWQXfpABHIpZPttqrwYrQNHRTk/iLIz4cVh9KkRwAElHP+CoW/NPEysN
  M=manage_amneziawg_en.sh C=awg_common_en.sh   # Russian version: M=manage_amneziawg.sh C=awg_common.sh
  ok=1 tag=
  for f in "$M" "$C"; do
    wget -q -O "$f"         "https://github.com/bivlked/amneziawg-installer/releases/latest/download/$f" \
      && wget -q -O "$f.minisig" "https://github.com/bivlked/amneziawg-installer/releases/latest/download/$f.minisig" \
      && out=$(minisign -V -P "$KEY" -m "$f" -x "$f.minisig") \
      && t=$(printf '%s\n' "$out" | sed -n "s/^Trusted comment: amneziawg-installer \(v[0-9.]*\) $f\$/\1/p") \
      && [ -n "$t" ] && [ "${tag:-$t}" = "$t" ] || { echo "NOT VERIFIED: $f"; ok=0; break; }
    tag=$t
  done
  [ "$ok" = 1 ] && { old=$(sudo sed -n 's/^SCRIPT_VERSION="\(.*\)"/v\1/p' /root/awg/manage_amneziawg.sh) && [ -n "$old" ] \
    || { echo "NOT VERIFIED: cannot read the installed version from /root/awg/manage_amneziawg.sh"; ok=0; }; }
  [ "$ok" = 1 ] && [ "$(printf '%s\n' "$old" "$tag" | sort -V | tail -1)" != "$tag" ] \
    && { echo "NOT VERIFIED: release $tag is older than the installed $old"; ok=0; }
  [ "$ok" = 1 ] && { sudo install -m 700 "$M" /root/awg/manage_amneziawg.sh \
    && sudo install -m 700 "$C" /root/awg/awg_common.sh && echo "Installed verified release $tag" || echo "NOT FULLY INSTALLED: run the block again"; }
  

If the script printed "NOT VERIFIED", the working files are untouched; "NOT FULLY INSTALLED" means the files were not both replaced, so run the block again. If the installed `manage` predates v5.7.0, it has no version line and the block will refuse: update such a server with the new installer and `--force`. The block only accepts a pair of files from one release that is not older than the installed one, so a tampered "latest release" pointer cannot roll the scripts back to older signed versions. It prints the verified release number: compare it with the releases page.

Since v5.21.0 the script pair is protected against drift: if you update manage but forget awg_common (or the other way around) and the versions diverge, the script stops and shows the exact commands to fetch the other half, instead of throwing strange errors halfway through.

Q: What is the maximum number of clients?

A: The default /24 subnet supports up to 253 clients (.2 - .254), which is sufficient for most use cases. Need more? Pass a wider CIDR via --subnet (e.g. /16) to raise the limit.

Q: Which hosting providers work well?

A: Any VPS with Ubuntu 24.04 LTS / Ubuntu 26.04 / Debian 13 (Debian 12 is supported too, but it is past regular support - see the compatibility table), root access, and at least 512 MB RAM (1 GB recommended). Pick providers with clean (non-blacklisted) IPs and unlimited traffic. See the recommendation below.

Q: How do I migrate the VPN to another server?

A: 1. Create a backup: sudo bash /root/awg/manage_amneziawg.sh backup. 2. Copy the archive from /root/awg/backups/ to the new server. 3. Install AmneziaWG on the new server. 4. Restore: sudo bash /root/awg/manage_amneziawg.sh restore (interactive selection, or specify the full archive path). 5. Regenerate configs with new IP: sudo bash /root/awg/manage_amneziawg.sh regen.

Q: How do I create a temporary client?

A: sudo bash /root/awg/manage_amneziawg.sh add guest --expires=7d. Formats: 1h, 12h, 1d, 7d, 30d, 4w. A cron job checks every 5 minutes and automatically removes expired clients.

Q: What are .vpnuri files?

A: .vpnuri files contain vpn:// URIs for one-tap config import into Amnezia Client. Copy the file contents → open Amnezia Client → "Add VPN" → "Paste from clipboard".

Q: Shadowrocket on iOS/macOS does not connect - needs PresharedKey

A: Since v5.11.1 the add command supports a --psk flag: sudo bash /root/awg/manage_amneziawg.sh add my_iphone --psk. The client config will include a PresharedKey = ... line matching the server [Peer]. For existing clients: recreate with the flag (remove + add --psk) or manually - generate the key once (PSK=$(awg genpsk)) and paste the same value into both sides (the server [Peer] for that client and the client's [Peer] for the server); the handshake fails if the values differ. regen preserves an existing PSK across rotation. Details - in ADVANCED.en.md.

Q: iPhone connects but traffic stops after ~10 seconds

A: Fixed in v5.16.1 (Issue #42, thanks to @LiaNdrY). The routing mode that was default back then (mode 2, Amnezia List) started with 0.0.0.0/5, and on iOS that block broke the whole route list, so the tunnel stalled after about 10 seconds. On an existing server the simplest fix is to set AllowedIPs = 0.0.0.0/0 in the iOS client config (a plain --force reinstall keeps the stored list). A precise split-tunnel-preserving edit is in ADVANCED.en.md.

Q: Why port 39743?

A: It's a random port from the upper range, chosen as the default. You can change it during installation: --port=N (any port 1-65535). On mobile networks where the carrier drops unfamiliar ports, 443/udp often helps - the --mobile flag sets it together with the obfuscation preset.

Q: Is Perl required on the server?

A: Perl is used optionally for generating vpn:// URIs (.vpnuri files). If Perl is absent, .conf files are still created normally - you can use them via file import or QR code. Perl is installed by default on Ubuntu and Debian.

Q: Can I manage the server from my own scripts or a Telegram bot?

A: Yes. Since v5.21.0 the management commands take the --json flag and reply with a single JSON object even on failure, so the output is safe to parse from any script (list/stats have returned JSON arrays for a long time). I promise not to break the format: new fields may appear, existing ones keep their names and types. For unattended runs there is --yes, and the strict mode AWG_STRICT_CONFIRM=1 makes commands like remove refuse when --yes is missing, instead of quietly going ahead. The format breakdown lives in ADVANCED.en.md → JSON interface. For a real-world example, the awgram Telegram bot runs on exactly this interface.

Q: Is it safe to re-run the installer? Will clients need new configs?

A: Yes, it is safe, and no re-issuing is needed. Re-running over an already working service requires the --force flag (or AWG_FORCE_REINSTALL=1) - without it the script reports that AmneziaWG is already installed and changes nothing. With --force the server config is written anew, but the server keys and the obfuscation parameters are taken from the existing setup, and the [Peer] blocks are carried over from the previous config. Every client is preserved, including the default my_phone and my_laptop: the creation loop skips the ones already present in the config. Config files and QR codes handed out earlier stay valid.

There is one exception: passing --mobile, --preset, --jc, --jmin or --jmax regenerates the whole Jc/S/H/I1 set, while --port (and --mobile, which sets 443) changes the port. Either way the old configs stop connecting and have to be re-issued with regen and handed out again. --endpoint changes the address only in configs issued afterwards: the old ones keep the previous address and work as long as it still reaches the server, and they get the new one after regen. Leave those flags off for a plain update.

Most of the time --force is not needed at all: to get the newer management commands it is enough to update the two scripts on the server (see the question above). Re-running the installer itself is only worth it when the installer changed.

Q: AmneziaWG does not connect over mobile data but works on Wi-Fi - what should I do?

A: Usually it is either a port the carrier blocks or the shape of the I1 concealment packet. The server tells them apart: while the phone tries to connect, look at sudo tcpdump -ni any udp and sudo awg show.

• No packets from the phone at all: check the address and port in Endpoint, the firewall and whether the hosting address is blocked. If it is the port, try --mobile (the mobile preset plus port 443/udp); on a running server that is a --force reinstall and reissuing every client config.
• Packets arrive, but the peer endpoint does not change: S1-S4 or H1-H4 differ between server and client.
• The endpoint changes and the receive counter grows, but latest handshake stays empty: that is I1. Since v5.33.0 new installs get it in DNS-response shape automatically; on older profiles you edit I1 in the client .conf, the server stays as it is.

The walkthrough with a ready-made line is in ADVANCED.en.md → The handshake never completes on cellular, and common cases are collected in discussion #38.

Q: Why is my AmneziaWG config marked yellow in the Amnezia app?

A: It is not an error: the Amnezia app marks second-line AmneziaWG configs in yellow. Those come from 2.0 servers: installed before version 6.0.0, with --protocol=2.0, or where the installer picked 2.0 by itself. The mark on its own does not mean anything is wrong with the connection, and nothing needs redoing because of it. More in the ADVANCED.en.md FAQ.

Q: With AmneziaWG on, my local network disappears or IPv6-only sites do not open - is that expected?

A: Yes, that is how the full tunnel works, and it is the default mode: all device traffic, IPv6 included, goes into the VPN. By default IPv6 goes no further than the tunnel, so the device falls back to IPv4. Whether the local network stays reachable is up to the client: AmneziaWG for Windows cuts it off. If you need home devices while the VPN is on, switch the server to the Amnezia mode: reinstall with --force --route-amnezia, then run sudo bash /root/awg/manage_amneziawg.sh regen --reset-routes so the new mode reaches profiles you already handed out. The mode has its own trade-offs, see ADVANCED.en.md → Device IPv6 and the local network.

Q: Can I install AmneziaWG on a Synology NAS?

A: Not with this installer: on the DS918+ we checked, DSM 7.4.1 runs kernel 4.4, the module needs 5.15 or newer, and the box has nothing to build it with. AmneziaWG itself can run on Synology manually through the userspace implementation, step by step in ADVANCED.en.md → AmneziaWG on a Synology NAS.

Q: AmneziaWG stopped connecting after an update - what should I check?

A: Find out what exactly was updated. If the installer was run again with flags that change the obfuscation parameters or the port, the configs you handed out need reissuing; which flags those are is in the question "Is it safe to re-run the installer?" above. On ARM with a prebuilt module, run the installer again after a kernel upgrade. If the config turned yellow after an Amnezia app update, that is not an error (see the question above). Otherwise start with sudo bash /root/awg/manage_amneziawg.sh check.

More answers and solutions in ADVANCED.en.md.

---

🛠️ Troubleshooting

1. Logs: /root/awg/install_amneziawg.log, /root/awg/manage_amneziawg.log
2. Service status: sudo systemctl status awg-quick@awg0
3. AmneziaWG status: sudo awg show
4. UFW status: sudo ufw status verbose
5. Diagnostic report: sudo bash ./install_amneziawg_en.sh --diagnostic For a detailed breakdown of the report, see ADVANCED.en.md.

---

🌐 Ecosystem

Clients

Which client should I use? Install Amnezia VPN (>= 5.0.1.5 for a 3.1 server, >= 4.8.12.7 for 2.0) - works on all platforms, supports vpn:// URI import. It is not in the Russian App Store: on an iPhone there, use the lightweight AmneziaWG. For a lightweight connection (.conf import only), use AmneziaWG for your platform.

Client	Platform	AWG 3.1	AWG 2.0	Type	Notes
Amnezia VPN	Windows, macOS, Linux, Android, iOS	✅ >= 5.0.1.5	✅ >= 4.8.12.7	Official	Recommended. Full-featured, vpn:// URI; not in the Russian App Store
AmneziaWG	Windows	✅ >= 3.1.0	✅ >= 2.0.0	Official	Lightweight tunnel manager, .conf import
AmneziaWG	Android	✅ >= 3.1.4 on Google Play	✅ >= 2.0.0	Official	Lightweight tunnel manager, .conf import
AmneziaWG	iOS, macOS	✅ >= 3.1.4	✅	Official	Lightweight tunnel manager, .conf import; available in the Russian App Store
WG Tunnel	Android	✅ >= 5.6.0	✅	Third-party, FOSS	Auto-tunneling, split tunnel; Google Play, IzzyOnDroid
WG Tunnel Desktop	Windows, Linux, macOS	✅ v2	✅	Third-party, FOSS	Same engine as the Android version
VeilBox	Windows, macOS	not verified	✅	Third-party, FOSS	Also supports VLESS

Versions with 3.1 support are taken from release notes as of 12 October 2026. Full client compatibility table →

Configuration Tools

Project	Description
Junker	AmneziaWG signature generator by @spatiumstas - for manual setup without an installer
Any-Tech-ARCHITECT	Obfuscation parameter generator by @Vadim-Khristenko - value selection and validation with a client compatibility matrix (GitHub)

Router Firmware

Project	Platform	Description
AWG Manager	Keenetic (Entware)	Web UI for managing AWG tunnels on Keenetic routers
AmneziaWG for Merlin	ASUS (Asuswrt-Merlin)	AWG 2.0 addon with web UI, GeoIP/GeoSite routing

Server Management

Project	Platform	Description
amneziawg-manager	macOS	Native GUI that drives the server over SSH via the bundled manage script - no web panel or daemons
awgram	Telegram	Rust bot: add/remove clients, stats, backup - via the bundled manage script
amneziawg-installer-tg-bot	Telegram	Python bot that runs on the server itself: clients by button, guest access with an expiry, stats, backup - via the bundled manage script
amneziawg_dns_adblock	Server	DNS ad and tracker blocking for VPN clients by @Cueuler: Blocky on the tunnel address, installed on top of an existing setup, needs the full tunnel (--route-all). There is no license file; the author allowed free use in discussion #237

📰 Featured in

📖 Tutorials & Guides

• Hetzner Community - Making a website accessible from restricted regions (cross-link in Resources)
• Debian Forums - HowTo: Install AmneziaWG 2.0 on Debian 12/13
• LowEndTalk - [Tutorial] One-command AmneziaWG VPN server install on Ubuntu / Debian / ARM
• AVA Hosting - Self-Hosted VPN: Setup AmneziaWG Easily (step-by-step guide built on the installer)

📰 Articles & Reviews

• XDA Developers - "I found a self-hosted VPN that works where WireGuard gets blocked"
• Pinggy - Top 5 Best Self-Hosted VPNs in 2026
• gHacks Tech News - AmneziaWG 2.0

📋 Listings & Directories

• VPN Status (RU) - AmneziaWG services and server-side options catalog
• AlternativeTo - amneziawg-installer (42 alternatives)
• LibHunt - #1 in Shell VPN category

💬 Forums & Communities

• Qubes OS Forum - AmneziaWG for censored regions
• Lemmy.world /c/selfhosted - amneziawg-installer announce (143 upvotes / 39 comments)

---

📝 License & Author

• Author: @bivlked - GitHub
• License: MIT - free and open-source (see LICENSE)

---

If this project helped you, a ⭐ helps others find it.

↑ Back to top