/tcp
Then:
```bash
-wget -O install_amneziawg_en.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.0/install_amneziawg_en.sh
+wget -O install_amneziawg_en.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.1/install_amneziawg_en.sh
chmod +x install_amneziawg_en.sh
sudo bash ./install_amneziawg_en.sh
```
diff --git a/README.en.md b/README.en.md
index 389fd91..1d7e469 100644
--- a/README.en.md
+++ b/README.en.md
@@ -9,7 +9,7 @@
Install AmneziaWG 2.0 VPN on Ubuntu and Debian VPS
-One-command, self-hosted AmneziaWG 2.0 VPN for Ubuntu 24.04 / 25.10 and Debian 12 / 13. Kernel-native DKMS, no Docker, no web panel, runs on any cheap VPS.
+One-command, self-hosted AmneziaWG 2.0 VPN for Ubuntu 24.04 / 25.10 / 26.04 and Debian 12 / 13. Kernel-native DKMS, no Docker, no web panel, runs on any cheap VPS.
@@ -18,7 +18,7 @@
- 
+ 
@@ -32,7 +32,7 @@
## 🚀 Quick Start
```bash
-wget -O install_amneziawg_en.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.0/install_amneziawg_en.sh
+wget -O install_amneziawg_en.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.1/install_amneziawg_en.sh
chmod +x install_amneziawg_en.sh
sudo bash ./install_amneziawg_en.sh
```
@@ -311,8 +311,8 @@ This installation method handles interactive prompts and colored output correctl
2. **Download the script:**
```bash
- wget -O install_amneziawg_en.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.0/install_amneziawg_en.sh
- # or: curl -fLo install_amneziawg_en.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.0/install_amneziawg_en.sh
+ wget -O install_amneziawg_en.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.1/install_amneziawg_en.sh
+ # or: curl -fLo install_amneziawg_en.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.1/install_amneziawg_en.sh
```
> Minimal Debian may not ship curl (wget is usually present) - use `wget`. The installer itself adds curl in step 1.
3. **Make it executable:**
@@ -327,7 +327,7 @@ This installation method handles interactive prompts and colored output correctl
> **Russian version:** For Russian output, use `install_amneziawg.sh`:
> ```bash
- > wget -O install_amneziawg.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.0/install_amneziawg.sh
+ > wget -O install_amneziawg.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.1/install_amneziawg.sh
> sudo bash ./install_amneziawg.sh
> ```
> The Russian version is functionally identical; only user-facing messages and logs are in Russian.
@@ -447,11 +447,11 @@ Full list: `... help` or [ADVANCED.en.md#manage-commands-adv](ADVANCED.en.md#man
```bash
# Installation (English)
-wget -O install_amneziawg_en.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.0/install_amneziawg_en.sh
+wget -O install_amneziawg_en.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.1/install_amneziawg_en.sh
sudo bash ./install_amneziawg_en.sh # Run (+ 2 reboots)
# Installation (Russian)
-wget -O install_amneziawg.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.0/install_amneziawg.sh
+wget -O install_amneziawg.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.1/install_amneziawg.sh
sudo bash ./install_amneziawg.sh # Run (+ 2 reboots)
# Client management
@@ -535,13 +535,13 @@ For a two-server cascade with a split exit for Russian and foreign traffic (spli
A: Download the updated scripts and replace them on the server:
# English version:
- wget -O /root/awg/manage_amneziawg.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.0/manage_amneziawg_en.sh
- wget -O /root/awg/awg_common.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.0/awg_common_en.sh
+ wget -O /root/awg/manage_amneziawg.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.1/manage_amneziawg_en.sh
+ wget -O /root/awg/awg_common.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.1/awg_common_en.sh
chmod 700 /root/awg/manage_amneziawg.sh /root/awg/awg_common.sh
# Russian version:
- wget -O /root/awg/manage_amneziawg.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.0/manage_amneziawg.sh
- wget -O /root/awg/awg_common.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.0/awg_common.sh
+ wget -O /root/awg/manage_amneziawg.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.1/manage_amneziawg.sh
+ wget -O /root/awg/awg_common.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.1/awg_common.sh
chmod 700 /root/awg/manage_amneziawg.sh /root/awg/awg_common.sh
Server reinstallation is not required.
@@ -594,7 +594,7 @@ For a two-server cascade with a split exit for Russian and foreign traffic (spli
Q: Is it safe to re-run the installer?
- A: Yes. On re-run, the server config is recreated, but existing clients are automatically restored from backup. Default clients (my_phone, my_laptop) are recreated; all others are preserved.
+ A: Yes. Re-running over an already working service requires the --force flag (or AWG_FORCE_REINSTALL=1) - without it the script reports that AmneziaWG is already installed and changes nothing. With --force the server config is recreated, but existing clients are automatically restored from backup: default clients (my_phone, my_laptop) are recreated; all others are preserved.
> More answers and solutions in **[ADVANCED.en.md](ADVANCED.en.md)**.
diff --git a/README.md b/README.md
index c23a2a2..fecf377 100644
--- a/README.md
+++ b/README.md
@@ -10,7 +10,7 @@
Install AmneziaWG 2.0 VPN on Ubuntu and Debian VPS
VPN за одну команду - работает там, где WireGuard блокируют. Любой VPS за $3, без знания Linux.
-One-command, self-hosted AmneziaWG 2.0 VPN for Ubuntu 24.04 / 25.10 and Debian 12 / 13. Kernel-native DKMS, no Docker, no web panel, runs on any cheap VPS.
+One-command, self-hosted AmneziaWG 2.0 VPN for Ubuntu 24.04 / 25.10 / 26.04 and Debian 12 / 13. Kernel-native DKMS, no Docker, no web panel, runs on any cheap VPS.
@@ -19,7 +19,7 @@
-
+
@@ -33,7 +33,7 @@
## 🚀 Быстрый старт
```bash
-wget -O install_amneziawg.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.0/install_amneziawg.sh
+wget -O install_amneziawg.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.1/install_amneziawg.sh
chmod +x install_amneziawg.sh
sudo bash ./install_amneziawg.sh
```
@@ -312,8 +312,8 @@ sudo bash ./install_amneziawg.sh --yes --route-all
2. **Скачайте скрипт:**
```bash
- wget -O install_amneziawg.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.0/install_amneziawg.sh
- # или: curl -fLo install_amneziawg.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.0/install_amneziawg.sh
+ wget -O install_amneziawg.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.1/install_amneziawg.sh
+ # или: curl -fLo install_amneziawg.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.1/install_amneziawg.sh
```
> На минимальном Debian curl может отсутствовать (wget обычно есть) - используйте `wget`. Сам curl установщик доставит на шаге 1.
3. **Сделайте его исполняемым:**
@@ -328,7 +328,7 @@ sudo bash ./install_amneziawg.sh --yes --route-all
> **English version:** Для вывода на английском используйте `install_amneziawg_en.sh`:
> ```bash
- > wget -O install_amneziawg_en.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.0/install_amneziawg_en.sh
+ > wget -O install_amneziawg_en.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.1/install_amneziawg_en.sh
> sudo bash ./install_amneziawg_en.sh
> ```
> Английская версия функционально идентична; только сообщения и логи на английском.
@@ -448,11 +448,11 @@ sudo bash /root/awg/manage_amneziawg.sh <команда> [аргументы]
```bash
# Установка (русский)
-wget -O install_amneziawg.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.0/install_amneziawg.sh
+wget -O install_amneziawg.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.1/install_amneziawg.sh
sudo bash ./install_amneziawg.sh # Запуск (+ 2 перезагрузки)
# Установка (English)
-wget -O install_amneziawg_en.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.0/install_amneziawg_en.sh
+wget -O install_amneziawg_en.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.1/install_amneziawg_en.sh
sudo bash ./install_amneziawg_en.sh # Запуск (+ 2 перезагрузки)
# Управление клиентами
@@ -536,13 +536,13 @@ sudo bash /root/awg/manage_amneziawg.sh restart # Перезапу
О: Скачайте новый скрипт установки и замените скрипты управления на сервере:
# Русская версия:
- wget -O /root/awg/manage_amneziawg.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.0/manage_amneziawg.sh
- wget -O /root/awg/awg_common.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.0/awg_common.sh
+ wget -O /root/awg/manage_amneziawg.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.1/manage_amneziawg.sh
+ wget -O /root/awg/awg_common.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.1/awg_common.sh
chmod 700 /root/awg/manage_amneziawg.sh /root/awg/awg_common.sh
# Английская версия:
- wget -O /root/awg/manage_amneziawg.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.0/manage_amneziawg_en.sh
- wget -O /root/awg/awg_common.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.0/awg_common_en.sh
+ wget -O /root/awg/manage_amneziawg.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.1/manage_amneziawg_en.sh
+ wget -O /root/awg/awg_common.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.1/awg_common_en.sh
chmod 700 /root/awg/manage_amneziawg.sh /root/awg/awg_common.sh
Переустановка сервера не требуется.
@@ -595,7 +595,7 @@ sudo bash /root/awg/manage_amneziawg.sh restart # Перезапу
В: Безопасно ли запускать скрипт повторно?
- О: Да. При повторном запуске серверный конфиг пересоздаётся, но существующие клиенты автоматически восстанавливаются из бэкапа. Дефолтные клиенты (my_phone, my_laptop) пересоздаются, остальные - сохраняются.
+ О: Да. Повторная установка поверх уже работающего сервиса требует флага --force (или AWG_FORCE_REINSTALL=1) - без него скрипт сообщит, что AmneziaWG уже установлен, и ничего не тронет. С --force серверный конфиг пересоздаётся, но существующие клиенты автоматически восстанавливаются из бэкапа: дефолтные клиенты (my_phone, my_laptop) пересоздаются, остальные - сохраняются.
> Больше ответов и решений см. в **[ADVANCED.md](ADVANCED.md)**.
diff --git a/awg_common.sh b/awg_common.sh
index bbeb15c..1ae8283 100644
--- a/awg_common.sh
+++ b/awg_common.sh
@@ -3,8 +3,8 @@
# ==============================================================================
# Общая библиотека функций для AmneziaWG 2.0
# Автор: @bivlked
-# Версия: 5.18.0
-# Дата: 2026-06-26
+# Версия: 5.18.1
+# Дата: 2026-06-27
# Репозиторий: https://github.com/bivlked/amneziawg-installer
# ==============================================================================
#
@@ -950,6 +950,16 @@ render_server_config() {
local peers_source="${1:-}"
load_awg_params || return 1
+ # Порт для НОВОГО awg0.conf берём из init-файла (намерение пользователя:
+ # флаг --port или сохранённый прежний порт), а НЕ из перезаписываемого
+ # старого awg0.conf. load_awg_params перечитывает ListenPort из живого
+ # конфига, поэтому без этого --port при --force молча игнорировался бы.
+ # render_server_config вызывается только из install, regen клиентов
+ # (regenerate_client) идёт своим путём и не затрагивается.
+ local _init_port
+ _init_port=$(grep -oP '^\s*export AWG_PORT=\K[0-9]+' "$CONFIG_FILE" 2>/dev/null | head -n1)
+ [[ -n "$_init_port" ]] && AWG_PORT="$_init_port"
+
local server_privkey
if [[ -f "$AWG_DIR/server_private.key" ]]; then
server_privkey=$(cat "$AWG_DIR/server_private.key")
@@ -1158,6 +1168,15 @@ render_client_config() {
esac
else
allowed_ips="${ALLOWED_IPS:-0.0.0.0/0}"
+ # iOS AmneziaVPN в режиме "весь трафик" требует обе семьи адресов: при
+ # голом 0.0.0.0/0 он считает это незавершённой раздельной маршрутизацией
+ # и не поднимает туннель. Для full-tunnel добавляем ::/0 - IPv6 уходит в
+ # туннель (и отсекается, если у сервера нет нативного IPv6), наружу мимо
+ # VPN не утекает. Затрагивает только mode-1: split-режим = кастомный
+ # список, не равен 0.0.0.0/0 и под условие не попадает.
+ if [[ "$allowed_ips" == "0.0.0.0/0" ]]; then
+ allowed_ips="0.0.0.0/0, ::/0"
+ fi
fi
# MTU: приоритет server awg0.conf > AWG_MTU из awgsetup_cfg.init > 1280 fallback.
@@ -1190,7 +1209,7 @@ render_client_config() {
[Interface]
PrivateKey = ${client_privkey}
Address = ${address_line}
-DNS = 1.1.1.1
+DNS = 1.1.1.1, 1.0.0.1
MTU = ${mtu}
Jc = ${AWG_Jc}
Jmin = ${AWG_Jmin}
@@ -2123,7 +2142,7 @@ regenerate_client() {
fi
# Сохраняем пользовательские настройки из текущего .conf (modify)
- local current_dns="1.1.1.1" current_keepalive="33" current_allowed_ips="${ALLOWED_IPS:-0.0.0.0/0}"
+ local current_dns="1.1.1.1, 1.0.0.1" current_keepalive="33" current_allowed_ips="${ALLOWED_IPS:-0.0.0.0/0}"
if [[ -f "$AWG_DIR/${name}.conf" ]]; then
local _v
_v=$(sed -n 's/^DNS[ \t]*=[ \t]*//p' "$AWG_DIR/${name}.conf" | tr -d '[:space:]')
@@ -2172,6 +2191,13 @@ regenerate_client() {
return 1
}
+ # При regen подтягиваем новые дефолты для НЕ-кастомизированных клиентов:
+ # полнотуннельный 0.0.0.0/0 получает ::/0 (нужно iOS AmneziaVPN), одиночный
+ # DNS 1.1.1.1 становится парой с резервом. Значения, заданные пользователем
+ # через modify, не равны старым дефолтам и потому сохраняются как есть.
+ [[ "$current_allowed_ips" == "0.0.0.0/0" ]] && current_allowed_ips="0.0.0.0/0, ::/0"
+ [[ "$current_dns" == "1.1.1.1" ]] && current_dns="1.1.1.1, 1.0.0.1"
+
# Восстанавливаем пользовательские настройки (экранируем & и \ для sed replacement)
local _dns _ka _aip
_dns=$(printf '%s' "$current_dns" | sed 's/[&\\/]/\\&/g')
diff --git a/awg_common_en.sh b/awg_common_en.sh
index 71b5885..3116978 100644
--- a/awg_common_en.sh
+++ b/awg_common_en.sh
@@ -3,8 +3,8 @@
# ==============================================================================
# Shared function library for AmneziaWG 2.0
# Author: @bivlked
-# Version: 5.18.0
-# Date: 2026-06-26
+# Version: 5.18.1
+# Date: 2026-06-27
# Repository: https://github.com/bivlked/amneziawg-installer
# ==============================================================================
#
@@ -957,6 +957,16 @@ render_server_config() {
local peers_source="${1:-}"
load_awg_params || return 1
+ # Port for the NEW awg0.conf comes from the init file (the user's intent:
+ # the --port flag or the previously saved port), NOT from the old awg0.conf
+ # being overwritten. load_awg_params re-reads ListenPort from the live
+ # config, so without this --port on --force would be silently ignored.
+ # render_server_config is only called from install; client regen
+ # (regenerate_client) takes its own path and is unaffected.
+ local _init_port
+ _init_port=$(grep -oP '^\s*export AWG_PORT=\K[0-9]+' "$CONFIG_FILE" 2>/dev/null | head -n1)
+ [[ -n "$_init_port" ]] && AWG_PORT="$_init_port"
+
local server_privkey
if [[ -f "$AWG_DIR/server_private.key" ]]; then
server_privkey=$(cat "$AWG_DIR/server_private.key")
@@ -1167,6 +1177,15 @@ render_client_config() {
esac
else
allowed_ips="${ALLOWED_IPS:-0.0.0.0/0}"
+ # iOS AmneziaVPN in "all traffic" mode requires both address families:
+ # with a bare 0.0.0.0/0 it treats the config as incomplete split routing
+ # and refuses to bring the tunnel up. For full tunnel we add ::/0 - IPv6
+ # goes into the tunnel (and is dropped if the server has no native IPv6),
+ # so it never leaks past the VPN. Affects mode-1 only: split mode uses a
+ # custom list that is not equal to 0.0.0.0/0 and skips this branch.
+ if [[ "$allowed_ips" == "0.0.0.0/0" ]]; then
+ allowed_ips="0.0.0.0/0, ::/0"
+ fi
fi
# MTU resolution order: server awg0.conf > AWG_MTU from awgsetup_cfg.init >
@@ -1199,7 +1218,7 @@ render_client_config() {
[Interface]
PrivateKey = ${client_privkey}
Address = ${address_line}
-DNS = 1.1.1.1
+DNS = 1.1.1.1, 1.0.0.1
MTU = ${mtu}
Jc = ${AWG_Jc}
Jmin = ${AWG_Jmin}
@@ -2136,7 +2155,7 @@ regenerate_client() {
fi
# Preserve user settings from current .conf (modified via modify command)
- local current_dns="1.1.1.1" current_keepalive="33" current_allowed_ips="${ALLOWED_IPS:-0.0.0.0/0}"
+ local current_dns="1.1.1.1, 1.0.0.1" current_keepalive="33" current_allowed_ips="${ALLOWED_IPS:-0.0.0.0/0}"
if [[ -f "$AWG_DIR/${name}.conf" ]]; then
local _v
_v=$(sed -n 's/^DNS[ \t]*=[ \t]*//p' "$AWG_DIR/${name}.conf" | tr -d '[:space:]')
@@ -2187,6 +2206,13 @@ regenerate_client() {
return 1
}
+ # On regen, pull in the new defaults for non-customized clients: a
+ # full-tunnel 0.0.0.0/0 gets ::/0 (needed by iOS AmneziaVPN), a single DNS
+ # 1.1.1.1 becomes a pair with a fallback. Values set by the user via modify
+ # differ from the old defaults and are therefore kept as-is.
+ [[ "$current_allowed_ips" == "0.0.0.0/0" ]] && current_allowed_ips="0.0.0.0/0, ::/0"
+ [[ "$current_dns" == "1.1.1.1" ]] && current_dns="1.1.1.1, 1.0.0.1"
+
# Restore user settings (escape & and \ for sed replacement)
local _dns _ka _aip
_dns=$(printf '%s' "$current_dns" | sed 's/[&\\/]/\\&/g')
diff --git a/docs/ROADMAP.md b/docs/ROADMAP.md
index 0c39cc5..e066913 100644
--- a/docs/ROADMAP.md
+++ b/docs/ROADMAP.md
@@ -28,6 +28,7 @@ tracked in issues and discussions, not here:
- Reliability on mobile, double-NAT and cascade paths: the TCP MSS is clamped to the tunnel size, which fixes the common PMTU-blackhole stall where large TCP pages and downloads hang when path-MTU discovery is blocked along the way.
- Full special-junk pass-through: all CPS concealment params `I1`-`I5` set in the server `awg0.conf` now reach clients (`.conf`, QR, `vpn://`), not just `I1`. Multi-packet concealment profiles can be configured server-side and distributed with `manage regen`.
- Companion guides: how the project compares to the official Amnezia app, and a two-server cascade with split-tunnel routing.
+- Bug fixes: `install --force --port=N` now actually changes the server port; full-tunnel clients get `0.0.0.0/0, ::/0` so iOS AmneziaVPN accepts the all-traffic mode; the default client DNS is a `1.1.1.1, 1.0.0.1` pair.
## Under consideration
@@ -80,6 +81,7 @@ Carrier reports (operator, region, working parameters) are especially useful.
- Надёжность на мобильных, double-NAT и каскадных путях: TCP MSS ограничивается под размер туннеля, что устраняет типичный PMTU-блэкхол, когда крупные TCP-страницы и закачки зависают при заблокированном по пути обнаружении path-MTU.
- Полный проброс special-junk: все CPS-параметры маскировки `I1`-`I5`, заданные в серверном `awg0.conf`, теперь доходят до клиентов (`.conf`, QR, `vpn://`), а не только `I1`. Многопакетные профили маскировки можно задать на сервере и раздать через `manage regen`.
- Сопутствующие гайды: сравнение проекта с официальным приложением Amnezia и каскад из двух серверов со split-tunnel-маршрутизацией.
+- Багфиксы: `install --force --port=N` теперь действительно меняет порт сервера; полнотуннельные клиенты получают `0.0.0.0/0, ::/0`, чтобы iOS AmneziaVPN принимал режим всего трафика; DNS клиента по умолчанию - пара `1.1.1.1, 1.0.0.1`.
## На рассмотрении
diff --git a/install_amneziawg.sh b/install_amneziawg.sh
index 33af5e0..fbd315c 100644
--- a/install_amneziawg.sh
+++ b/install_amneziawg.sh
@@ -8,15 +8,15 @@ fi
# ==============================================================================
# Скрипт для установки и настройки AmneziaWG 2.0 на Ubuntu/Debian серверах
# Автор: @bivlked
-# Версия: 5.18.0
-# Дата: 2026-06-26
+# Версия: 5.18.1
+# Дата: 2026-06-27
# Репозиторий: https://github.com/bivlked/amneziawg-installer
# ==============================================================================
# --- Безопасный режим и Константы ---
set -o pipefail
-SCRIPT_VERSION="5.18.0"
+SCRIPT_VERSION="5.18.1"
AWG_DIR="/root/awg"
CONFIG_FILE="$AWG_DIR/awgsetup_cfg.init"
STATE_FILE="$AWG_DIR/setup_state"
@@ -33,8 +33,8 @@ MANAGE_SCRIPT_PATH="$AWG_DIR/manage_amneziawg.sh"
# Проверяются в step5_download_scripts() после curl.
# Если AWG_BRANCH переопределён (не v$SCRIPT_VERSION), проверка пропускается.
# Формат: sha256sum output (hex, 64 chars).
-COMMON_SCRIPT_SHA256="e45faa7de3db15dc105292072c6cbfe562fe0161783fa862fe866666a1205cd8"
-MANAGE_SCRIPT_SHA256="06e91e69a612b1fc57643d1c0d21459dc7816c7084e38fee55c7319ca9c2d927"
+COMMON_SCRIPT_SHA256="140bbb323ec490ba5b7f49b81ed3d9a27195d123ac3a9ad761994b2b050419f2"
+MANAGE_SCRIPT_SHA256="4c8cdec3b7a5a32fb9873f2d1ae64d8b56edd1c53165c85921ec861ba01de632"
# Флаги CLI
UNINSTALL=0; HELP=0; HELP_EXIT_RC=0; DIAGNOSTIC=0; VERBOSE=0; NO_COLOR=0; AUTO_YES=0; NO_TWEAKS=0
@@ -275,7 +275,7 @@ show_help() {
--diagnostic Создать диагностический отчет и выйти
-v, --verbose Расширенный вывод для отладки (включая DEBUG)
--no-color Отключить цветной вывод в терминале
- --port=НОМЕР Установить UDP порт (1024-65535) неинтерактивно
+ --port=НОМЕР Установить UDP порт (1-65535) неинтерактивно
--ssh-port=ПОРТ SSH-порт для правила UFW (по умолчанию определяется
автоматически; список через запятую). Используйте, если
SSH на нестандартном порту и автодетект недоступен
@@ -668,8 +668,8 @@ validate_port() {
# в арифметике и проскакивает проверку диапазона) и ограничивает длину: без
# лимита 64-битная арифметика (( )) переполняется и 2^64+51820 проходил бы
# range-check. Сравнение - на чистом decimal.
- if ! [[ "$port" =~ ^[1-9][0-9]{0,4}$ ]] || (( port < 1024 )) || (( port > 65535 )); then
- die "Некорректный порт: '$port'. Допустимый диапазон: 1024-65535."
+ if ! [[ "$port" =~ ^[1-9][0-9]{0,4}$ ]] || (( port > 65535 )); then
+ die "Некорректный порт: '$port'. Допустимый диапазон: 1-65535."
fi
}
@@ -2001,7 +2001,7 @@ initialize_setup() {
# авторитетными для CLI/конфиг-значений (там die уместен).
if [[ "$AUTO_YES" -eq 0 ]]; then
while true; do
- read -rp "Введите UDP порт AmneziaWG (1024-65535) [${AWG_PORT}]: " input_port < /dev/tty
+ read -rp "Введите UDP порт AmneziaWG (1-65535) [${AWG_PORT}]: " input_port < /dev/tty
[[ -z "$input_port" ]] && break
if ( validate_port "$input_port" ); then AWG_PORT=$input_port; break; fi
log_warn "Повторите ввод порта."
diff --git a/install_amneziawg_en.sh b/install_amneziawg_en.sh
index 377ac75..8af411a 100644
--- a/install_amneziawg_en.sh
+++ b/install_amneziawg_en.sh
@@ -8,14 +8,14 @@ fi
# ==============================================================================
# AmneziaWG 2.0 installation and configuration script for Ubuntu/Debian servers
# Author: @bivlked
-# Version: 5.18.0
-# Date: 2026-06-26
+# Version: 5.18.1
+# Date: 2026-06-27
# Repository: https://github.com/bivlked/amneziawg-installer
# ==============================================================================
# --- Safe mode and Constants ---
set -o pipefail
-SCRIPT_VERSION="5.18.0"
+SCRIPT_VERSION="5.18.1"
AWG_DIR="/root/awg"
CONFIG_FILE="$AWG_DIR/awgsetup_cfg.init"
@@ -33,8 +33,8 @@ MANAGE_SCRIPT_PATH="$AWG_DIR/manage_amneziawg.sh"
# Verified in step5_download_scripts() after curl.
# Verification is skipped when AWG_BRANCH is overridden (test branch).
# Format: sha256sum output (hex, 64 chars).
-COMMON_SCRIPT_SHA256="63ddb57418cab5fad6569ea5c253b6032a4c3bd9c3e42a9c9abc811b22032aea"
-MANAGE_SCRIPT_SHA256="2cb5f4b1928b659a106a9d9efd7e7099825e73eeadae1a34faf2b7b395a678ec"
+COMMON_SCRIPT_SHA256="fa5aec026334b48067e95ffcb8546e711bc6d0006bc77e3030862ec0650cfb82"
+MANAGE_SCRIPT_SHA256="a235a6de5fac1c5c61a3275b3b32e7cf15927450495bd095ee3ea34fbfc1d27d"
# CLI flags
UNINSTALL=0; HELP=0; HELP_EXIT_RC=0; DIAGNOSTIC=0; VERBOSE=0; NO_COLOR=0; AUTO_YES=0; NO_TWEAKS=0
@@ -278,7 +278,7 @@ Options:
--diagnostic Generate diagnostic report and exit
-v, --verbose Verbose output for debugging (including DEBUG)
--no-color Disable colored terminal output
- --port=NUMBER Set UDP port (1024-65535) non-interactively
+ --port=NUMBER Set UDP port (1-65535) non-interactively
--ssh-port=PORT SSH port for the UFW rule (auto-detected by default;
comma-separated list). Use if SSH runs on a non-standard
port and auto-detection is unavailable
@@ -674,8 +674,8 @@ validate_port() {
# octal in arithmetic and slip past the range check) and bounds the length:
# without a limit 64-bit (( )) arithmetic wraps, so 2^64+51820 would pass the
# range check. Comparison uses plain decimal.
- if ! [[ "$port" =~ ^[1-9][0-9]{0,4}$ ]] || (( port < 1024 )) || (( port > 65535 )); then
- die "Invalid port: '$port'. Allowed range: 1024-65535."
+ if ! [[ "$port" =~ ^[1-9][0-9]{0,4}$ ]] || (( port > 65535 )); then
+ die "Invalid port: '$port'. Allowed range: 1-65535."
fi
}
@@ -2009,7 +2009,7 @@ initialize_setup() {
# appropriate there).
if [[ "$AUTO_YES" -eq 0 ]]; then
while true; do
- read -rp "Enter AmneziaWG UDP port (1024-65535) [${AWG_PORT}]: " input_port < /dev/tty
+ read -rp "Enter AmneziaWG UDP port (1-65535) [${AWG_PORT}]: " input_port < /dev/tty
[[ -z "$input_port" ]] && break
if ( validate_port "$input_port" ); then AWG_PORT=$input_port; break; fi
log_warn "Please re-enter the port."
diff --git a/manage_amneziawg.sh b/manage_amneziawg.sh
index 9aa3a8d..edda39b 100644
--- a/manage_amneziawg.sh
+++ b/manage_amneziawg.sh
@@ -8,14 +8,14 @@ fi
# ==============================================================================
# Скрипт для управления пользователями (пирами) AmneziaWG 2.0
# Автор: @bivlked
-# Версия: 5.18.0
-# Дата: 2026-06-26
+# Версия: 5.18.1
+# Дата: 2026-06-27
# Репозиторий: https://github.com/bivlked/amneziawg-installer
# ==============================================================================
# --- Безопасный режим и Константы ---
# shellcheck disable=SC2034
-SCRIPT_VERSION="5.18.0"
+SCRIPT_VERSION="5.18.1"
set -o pipefail
AWG_DIR="/root/awg"
SERVER_CONF_FILE="/etc/amnezia/amneziawg/awg0.conf"
diff --git a/manage_amneziawg_en.sh b/manage_amneziawg_en.sh
index c4a3cbb..e1d6b7c 100644
--- a/manage_amneziawg_en.sh
+++ b/manage_amneziawg_en.sh
@@ -8,14 +8,14 @@ fi
# ==============================================================================
# AmneziaWG 2.0 peer management script
# Author: @bivlked
-# Version: 5.18.0
-# Date: 2026-06-26
+# Version: 5.18.1
+# Date: 2026-06-27
# Repository: https://github.com/bivlked/amneziawg-installer
# ==============================================================================
# --- Safe mode and Constants ---
# shellcheck disable=SC2034
-SCRIPT_VERSION="5.18.0"
+SCRIPT_VERSION="5.18.1"
set -o pipefail
AWG_DIR="/root/awg"
SERVER_CONF_FILE="/etc/amnezia/amneziawg/awg0.conf"
diff --git a/tests/test_v5153_audit_round3.bats b/tests/test_v5153_audit_round3.bats
index fd00223..e6f340a 100644
--- a/tests/test_v5153_audit_round3.bats
+++ b/tests/test_v5153_audit_round3.bats
@@ -6,7 +6,8 @@
# canonical _valid_* in awg_common.sh. This file pins the hardening.
#
# .1 validators:
-# - validate_port: reject leading-zero/octal ('0080'), enforce 1024-65535
+# - validate_port: reject leading-zero/octal ('0080'), enforce 1-65535
+# (low ports like 443/80/53 allowed since v5.18.1 for DPI evasion)
# - validate_subnet / validate_cidr_list: decimal octets, reject leading zeros
# - validate_endpoint: structural [IPv6] check instead of charset-only
# - validate_cidr_list: reject leading/trailing/double comma before split
@@ -30,14 +31,16 @@ setup() {
# ---------- .1 validate_port ----------
@test ".1 validate_port: rejects leading-zero/octal and out-of-range" {
- for bad in 0080 080 80 0 23 65536 99999 abc ""; do
+ # v5.18.1: low ports (1-1023) are now allowed; only zero, leading-zero/octal,
+ # over-max and non-numeric stay rejected.
+ for bad in 0080 080 0 65536 99999 abc ""; do
run validate_port "$bad"
[ "$status" -ne 0 ] || { echo "accepted invalid port: $bad"; false; }
done
}
-@test ".1 validate_port: accepts valid high ports" {
- for ok in 1024 51820 65535; do
+@test ".1 validate_port: accepts valid ports incl. low DPI-evasion ports (v5.18.1)" {
+ for ok in 1 53 80 443 1024 51820 65535; do
run validate_port "$ok"
[ "$status" -eq 0 ] || { echo "rejected valid port: $ok"; false; }
done
diff --git a/tests/test_v5181_bugfix.bats b/tests/test_v5181_bugfix.bats
new file mode 100644
index 0000000..4b320a8
--- /dev/null
+++ b/tests/test_v5181_bugfix.bats
@@ -0,0 +1,149 @@
+#!/usr/bin/env bats
+# v5.18.1 bug-fix release. Three independent fixes:
+#
+# jue6 - install --force --port=N was silently ignored: render_server_config
+# calls load_awg_params, which re-reads ListenPort from the live
+# awg0.conf and overwrote the CLI/init port. The new server config now
+# takes the port from the init file (the user's intent, survives the
+# reboot-resume of --force). render_server_config is install-only, so
+# client regen (regenerate_client) is unaffected.
+# rl9c - client DNS default is now a Cloudflare pair "1.1.1.1, 1.0.0.1"
+# instead of a single resolver.
+# r11y - full-tunnel clients (AllowedIPs = 0.0.0.0/0) now get "0.0.0.0/0, ::/0"
+# so iOS AmneziaVPN accepts the "all traffic" mode. Split-tunnel
+# (custom list != 0.0.0.0/0) is untouched.
+# shellcheck disable=SC2154 # Variables set by sourced scripts at runtime
+
+load test_helper
+
+stub_nic() {
+ get_main_nic() { echo "eth0"; }
+ export -f get_main_nic
+}
+
+# --- jue6: port from init wins over live awg0.conf in server render ---
+
+@test "v5.18.1 jue6: render_server_config takes ListenPort from init, not old awg0.conf" {
+ stub_nic
+ create_init_config
+ # Simulate --force --port=443: Step 0 saved the new port into init, while the
+ # live awg0.conf still carries the old 39743.
+ sed -i 's/^export AWG_PORT=.*/export AWG_PORT=443/' "$CONFIG_FILE"
+ create_server_config
+ echo "SERVER_PRIV" > "$AWG_DIR/server_private.key"
+
+ run render_server_config
+ [ "$status" -eq 0 ]
+ grep -qxF "ListenPort = 443" "$SERVER_CONF_FILE"
+ # The stale 39743 from the old awg0.conf must not survive.
+ run grep -qxF "ListenPort = 39743" "$SERVER_CONF_FILE"
+ [ "$status" -ne 0 ]
+}
+
+@test "v5.18.1 jue6: port unchanged when init matches old config (no --port)" {
+ stub_nic
+ create_init_config
+ create_server_config
+ echo "SERVER_PRIV" > "$AWG_DIR/server_private.key"
+
+ run render_server_config
+ [ "$status" -eq 0 ]
+ grep -qxF "ListenPort = 39743" "$SERVER_CONF_FILE"
+}
+
+# --- rl9c: dual DNS default ---
+
+@test "v5.18.1 rl9c: client config DNS defaults to 1.1.1.1, 1.0.0.1" {
+ create_init_config
+ render_client_config "c1" "10.9.9.2" "CLIENTPRIV" "SERVERPUB" "1.2.3.4" "443"
+ grep -qxF "DNS = 1.1.1.1, 1.0.0.1" "$AWG_DIR/c1.conf"
+}
+
+# --- r11y: full-tunnel ::/0 for iOS; split-tunnel untouched ---
+
+@test "v5.18.1 r11y: full-tunnel client gets 0.0.0.0/0, ::/0" {
+ create_init_config
+ sed -i "s|^export ALLOWED_IPS=.*|export ALLOWED_IPS='0.0.0.0/0'|" "$CONFIG_FILE"
+ render_client_config "c2" "10.9.9.3" "CLIENTPRIV" "SERVERPUB" "1.2.3.4" "443"
+ grep -qxF "AllowedIPs = 0.0.0.0/0, ::/0" "$AWG_DIR/c2.conf"
+}
+
+@test "v5.18.1 r11y: split-tunnel (custom list) does NOT get ::/0" {
+ create_init_config
+ sed -i "s|^export ALLOWED_IPS=.*|export ALLOWED_IPS='1.0.0.0/8, 2.0.0.0/7'|" "$CONFIG_FILE"
+ render_client_config "c3" "10.9.9.4" "CLIENTPRIV" "SERVERPUB" "1.2.3.4" "443"
+ grep -qxF "AllowedIPs = 1.0.0.0/8, 2.0.0.0/7" "$AWG_DIR/c3.conf"
+ run grep -qF "::/0" "$AWG_DIR/c3.conf"
+ [ "$status" -ne 0 ]
+}
+
+# --- r11y/rl9c via regen: upgrade non-customized clients, preserve custom ones ---
+
+# Build a full regen scenario: server peer block, an existing client .conf with
+# the OLD AllowedIPs/DNS, keys, and stubbed externals. regenerate_client runs the
+# real render + the restore-with-upgrade path under test.
+setup_regen_scenario() {
+ # $1 name, $2 client_ip, $3 old_allowedips, $4 old_dns
+ create_server_config
+ create_init_config
+ add_test_peer "$1" "$2"
+ mkdir -p "$KEYS_DIR"
+ printf 'FAKEPRIV' > "$KEYS_DIR/$1.private"
+ printf 'FAKESERVERPUB' > "$AWG_DIR/server_public.key"
+ cat > "$AWG_DIR/$1.conf" << EOF
+[Interface]
+PrivateKey = FAKEPRIV
+Address = $2/32
+DNS = $4
+MTU = 1280
+
+[Peer]
+PublicKey = FAKESERVERPUB
+Endpoint = 1.2.3.4:39743
+AllowedIPs = $3
+PersistentKeepalive = 33
+EOF
+ get_server_public_ip() { echo "1.2.3.4"; }
+ _ensure_server_public_key() { return 0; }
+ generate_qr() { return 0; }
+ generate_vpn_uri() { return 0; }
+ generate_qr_vpnuri() { return 0; }
+ export -f get_server_public_ip _ensure_server_public_key generate_qr generate_vpn_uri generate_qr_vpnuri
+}
+
+@test "v5.18.1 regen: full-tunnel client upgraded to ::/0 and DNS pair" {
+ require_flock
+ setup_regen_scenario "alice" "10.9.9.2" "0.0.0.0/0" "1.1.1.1"
+ run regenerate_client "alice"
+ [ "$status" -eq 0 ]
+ grep -qxF "AllowedIPs = 0.0.0.0/0, ::/0" "$AWG_DIR/alice.conf"
+ grep -qxF "DNS = 1.1.1.1, 1.0.0.1" "$AWG_DIR/alice.conf"
+}
+
+@test "v5.18.1 regen: customized client (modify) preserved, no upgrade" {
+ require_flock
+ setup_regen_scenario "bob" "10.9.9.3" "10.0.0.0/8" "8.8.8.8"
+ run regenerate_client "bob"
+ [ "$status" -eq 0 ]
+ grep -qxF "AllowedIPs = 10.0.0.0/8" "$AWG_DIR/bob.conf"
+ grep -qxF "DNS = 8.8.8.8" "$AWG_DIR/bob.conf"
+ run grep -qF "::/0" "$AWG_DIR/bob.conf"
+ [ "$status" -ne 0 ]
+}
+
+# --- RU/EN parity of the three fixes ---
+
+@test "v5.18.1 parity: jue6 init-port override present in RU+EN" {
+ local p
+ for p in awg_common.sh awg_common_en.sh; do
+ grep -qF '_init_port=$(grep -oP' "${BATS_TEST_DIRNAME}/../$p"
+ done
+}
+
+@test "v5.18.1 parity: rl9c dual DNS + r11y ::/0 present in RU+EN" {
+ local p
+ for p in awg_common.sh awg_common_en.sh; do
+ grep -qF 'DNS = 1.1.1.1, 1.0.0.1' "${BATS_TEST_DIRNAME}/../$p"
+ grep -qF 'allowed_ips="0.0.0.0/0, ::/0"' "${BATS_TEST_DIRNAME}/../$p"
+ done
+}