RU Русский | EN English

Install AmneziaWG 2.0 / 3.0 VPN on Ubuntu and Debian VPS

One-command, self-hosted AmneziaWG 2.0 / 3.0 VPN for Ubuntu 24.04 / 26.04 and Debian 13. Kernel-native DKMS, no Docker, no web panel, runs on any cheap VPS.

In-kernel, no Docker or panels - zero overhead  |  VPN-only server, hardened by default  |  set it and forget it  |  QR or one-tap vpn:// import

Facts as of 2026-09-22. Installer 5.36.0. OS support dates verified against vendor data on 2026-08-29.

For a new server	Ubuntu 24.04, Debian 13
Also supported	Ubuntu 26.04
Not for new servers	Ubuntu 25.10, Debian 12 - no longer under standard vendor support
Architectures	x86_64, ARM64, ARMv7
Kernel module	DKMS from the Amnezia PPA; on kernels older than 6.7 (a stock Debian 12) a pinned 2.0 module built from source; prebuilt packages for some ARM targets
Config profile	AmneziaWG 2.0 (the kernel module may be 3.x - generated configs stay 2.0)

🚀 Quick Start

wget -O install_amneziawg_en.sh https://github.com/bivlked/amneziawg-installer/releases/latest/download/install_amneziawg_en.sh
chmod +x install_amneziawg_en.sh
sudo bash ./install_amneziawg_en.sh

What it does: installs AmneziaWG (kernel module via DKMS; which protocol line you end up with is covered in AmneziaWG 3.x), configures the firewall and forwarding, creates the first client, and prints a QR code plus a vpn:// link for one-tap import into the Amnezia client. Adding a friend or a device later is a single add command. 3 commands. 2 reboots along the way. About 20 minutes to a working VPN. For a clean Ubuntu/Debian VPS, not a home router or shared hosting. Details →

📘 Full deployment guide: Install AmneziaWG VPN server on Ubuntu/Debian VPS - covers VPS choice, ARM, troubleshooting, and uninstall.

🔐 Integrity: the script is fetched over HTTPS from raw.githubusercontent.com (pinned tag), and the helper scripts (awg_common, manage) are verified against pinned SHA256 hashes. Releases additionally carry a detached minisign signature - how to check it is in Verifying a release below; threat model in SECURITY.md.

What the installer changes on your server (transparency)

The script runs as root - here is a short list of what it does to the system:

• Packages: updates the system, installs dependencies (amneziawg-tools, qrencode, etc.); purges packages a VPN-only server does not need - including unattended-upgrades (so security updates stop installing automatically) and cloud-init when it does not manage the network (full list in ADVANCED.en.md).
• Kernel: adds the Amnezia PPA (GPG key verified by full fingerprint) and builds the AmneziaWG module via DKMS.
• Network: sysctl - forwarding, network buffers, BBR (as separate files in /etc/sysctl.d/); host IPv6 is disabled by default (keep it with --allow-ipv6); swap is sized to fit the RAM.
• Protection: UFW - incoming denied, SSH rate-limited, only the VPN UDP port open; Fail2Ban for SSH.
• Files and services: the main files live in /root/awg/ and /etc/amnezia/amneziawg/ with 600/700 permissions; the awg-quick@awg0 service; a cron job that removes expired clients.
• Rollback: --uninstall removes its own module, configs, sysctl files, cron jobs, the VPN-port UFW allow rule and the awg0 UFW route rule. It disables UFW and purges Fail2Ban only if it enabled/installed them itself; if UFW was already active before install, the SSH rate-limit rule it added stays. It does not restore swap settings or removed packages.

Step-by-step details in ADVANCED.en.md, threat model in SECURITY.md.

Non-interactive installation (for automation)

sudo bash ./install_amneziawg_en.sh --yes --route-all

All parameters are accepted automatically. Details: ADVANCED.en.md#cli-params-adv

🎯 Pick your case

Your situation	What to add
Plain cheap VPS, you just need a VPN	Nothing - the command above already does it
Mobile data, DPI cuts the link (TSPU, Iran, school or office)	During install, add --mobile - the obfuscation preset plus port 443/udp in one go (tested carriers)
ARM: Raspberry Pi, Oracle Ampere, Hetzner CAX	Same command - ready-made ARM kernel modules are selected automatically (details)
Time-limited access for a friend or guest	After install: manage_amneziawg.sh add guest --expires=7d

---

Why this project • AmneziaWG 3.x • AWG vs WG • CLI vs panels • Similar tools • Quick Start • Features • Carriers • Requirements • Hosting • Installation • Verifying a release • After installation • Management • More • FAQ • Troubleshooting • Ecosystem • License

💡 Why this project

AmneziaWG is a fork of WireGuard with traffic obfuscation. The obfuscation makes the traffic hard for DPI systems to tell apart from random noise, so where plain WireGuard gets detected and blocked, AmneziaWG usually keeps working.

This set of scripts turns a clean VPS into a ready-to-use VPN server. No Linux knowledge required - the script configures the firewall, optimizes the system, and generates client configs and QR codes automatically.

The server is tuned for a single job - VPN: extra packages are removed, the kernel, network stack and swap are tuned to the hardware, and the firewall and baseline hardening are enabled. AmneziaWG runs in the kernel, so overhead is minimal - fast and lean. Set it up once for your home or family and forget it: adding a friend or a new device a month later takes a minute, with the config and QR generated by a single command.

Recommended: Ubuntu 24.04 LTS, Ubuntu 26.04, Debian 13. Ubuntu 25.10 and Debian 12 install and run too, but both are past regular support - the dates are in the compatibility table below. Any cheap VPS with 1 GB RAM is enough.

---

🆕 The third AmneziaWG line ships already

AmneziaWG 3.0 was released in late July 2026 and the PPA now points at it; on 12 August 3.1 followed inside the same line, and that is what the PPA now carries. On x86 with kernel 6.7 or newer the installer already gives you a third-line module - there is nothing to switch on, and the configs you have already handed out keep working untouched. Which exact release you get depends on what sits in the PPA on the day you install, so the command below is the one that answers precisely.

To see what you actually have:

awg --version                        # tools version
cat /sys/module/amneziawg/version    # version of the loaded module

If the module is not loaded the second command prints nothing - then modinfo amneziawg | grep ^version reports the version of the file on disk. Why these are different questions is explained in ADVANCED.en.md.

Kernels older than 6.7 (Debian 12 on 6.1) and ARM hosts with a prebuilt package for their kernel still get the proven 2.0: that is where the 3.0 line has had the least mileage, and the threshold is deliberate.

The 3.0 features themselves - header encryption, extra padding, timing knobs - are not in generated configs yet. They need client apps, and those have not landed on every platform. The detailed write-up (what changes on the wire, which parameters were added, what has to match between server and client) lives in ADVANCED.en.md.

---

⚖️ AmneziaWG vs WireGuard

	WireGuard	AmneziaWG 2.0
DPI detection	Fingerprinted by fixed packet sizes and magic bytes	Hard to fingerprint - randomized headers, padding, protocol mimicry
Blocked in	China, Russia, Iran, UAE, Turkmenistan	Nothing to block by fixed signature - there is none. Address and UDP port blocking remain: another port or --mobile can help
Server setup	Manual: keys, iptables, sysctl, systemd	One command, 20 min, fully automatic
Hardening	DIY: UFW, Fail2Ban, sysctl	Automatic: firewall + brute-force protection + kernel tuning
Client management	Edit configs by hand, restart	add/remove/list/stats with hot-reload
Temporary access	Not built-in	--expires=7d with auto-cleanup
Server requirements	-	Same - any $3-5/mo VPS, 1 GB RAM
Speed overhead	Baseline	Kernel module: encryption and obfuscation run in kernel space, no userspace round-trip

On speed: on a server with a single shared vCPU the CPU becomes the bottleneck, because encryption and obfuscation run on that same core. Diagnostics: FAQ in ADVANCED.

If WireGuard works for you and isn't blocked - keep using it. If it's blocked or throttled - AmneziaWG 2.0 is the drop-in replacement.

---

⚙️ CLI Installer vs Web Panels

The goal: set up a VPN on a cheap VPS in 20 minutes. The script doesn't pull in Docker, a web server, or a database. After installation only AWG and the firewall are running - minimal footprint, maximum resources for VPN.

	This project (CLI)	Docker-based web panels
AWG module	Kernel module - runs at kernel level	Userspace inside a container
Server requirements	Any VPS with 512 MB RAM	Needs PHP/Python, database, web server, Docker
Attack surface	SSH + UDP VPN port	+ HTTP panel, database, Docker
Installation	Single command on the server, 20 minutes	docker-compose + giving SSH access to the panel
After reboot	Resumes installation from the same step	Depends on container and database state
Web interface	❌ None, SSH only (managed via the manage script)	✅ GUI, browser-based management
Multiple protocols	AmneziaWG only	WireGuard, OpenVPN, VLESS and others

Need a VPN without GUI on a dedicated server - this project. Need a web panel with multiple protocols - look for Docker-based solutions.

---

🔧 Comparison with similar tools

There are a few other ways to get AmneziaWG running. Each picks a different trade-off:

Tool	Path	Best for
This installer	SSH + one bash command	Headless VPS, single-purpose box, no Docker or panel, ARM prebuilts
wiresock/amneziawg-install	SSH + bash, optional native web panel and obfuscation proxy (Rust)	Want a browser panel without Docker, or traffic masking via a separate service
wg-easy	Docker + web UI	Home-lab boxes that already run Docker; want a browser panel for peers
spcfox/amnezia-wg-easy	Docker fork of wg-easy	Existing wg-easy users who specifically want AmneziaWG instead of plain WireGuard
Amnezia VPN app	Desktop/mobile GUI, deploys the server side in Docker over SSH	Click-through setup with no terminal; want a graphical client

Quick pick:

• Frequently add and rotate peers and prefer a browser GUI - a web panel: wiresock (native, no Docker) or wg-easy (Docker). Note: a panel is an extra always-on service, an open port and ongoing resource use; for a set-and-forget box it is needless overhead.
• Cheap or low-spec VPS, ARM (Raspberry Pi, Oracle Ampere) - this installer, with ready-made prebuilts and no module-build wait.
• One-tap phone import (QR or vpn://), time-limited clients (--expires), mobile-carrier presets - this installer.
• Point-and-click setup with no terminal - the Amnezia VPN desktop client.

When this project is not your best fit:

• Frequently add and rotate peers and want a browser panel - pick wiresock or wg-easy. There is no panel here by design: if peers change rarely, an always-on panel only burns server resources, and management is done from the CLI (manage add/remove/list) over SSH.
• You want resistance to active probing - masking the traffic as another protocol (such as QUIC or DNS): wiresock has a separate obfuscation proxy for that (the server-side masking works with any standard client; the full bidirectional capability pairs with their commercial WireSock Secure Connect client). Here the obfuscation lives in the protocol itself - the AmneziaWG 2.0 I1-I5/CPS parameters - and is aimed at everyday mobile DPI, with no separate proxy daemon and no paid client.
• You want a graphical client or point-and-click setup with no terminal - the Amnezia VPN desktop client.

How it differs from the official Amnezia app

The official Amnezia app is the official graphical client: you install the app, point it at a server, and it deploys the server side in Docker over SSH. Handy when all you want is a GUI. This installer is built for a different goal - to get the most out of a single dedicated VPS as a VPN server. That is where the differences come from:

• No Docker, and none of its overhead. AmneziaWG runs as a kernel module rather than inside a container. There is no Docker daemon sitting in the background, so RAM and CPU use stay lower. On a cheap VPS that matters a lot, and it does no harm on a bigger one either.
• The whole server is tuned to the hardware. The script reads the server's RAM and network card, then sets sysctl buffers, swap size, and NIC offloads and turns on BBR - it wrings the most out of the plan you are paying for. The official app deploys its containers and does not optimize or tune the server itself.
• Smaller attack surface. Unneeded packages and services are stripped, so the box does one thing - VPN. On top of that: UFW deny-all, Fail2Ban, strict file permissions, and sysctl hardening.
• Fine control over the obfuscation. A mobile-network preset (--preset=mobile), direct access to the AmneziaWG 2.0 parameters, and field data on carriers and DPI - you can tune it for a specific network or carrier.
• Headless and scriptable. One SSH command, every parameter as a flag, CLI client management, time-limited guests (--expires), QR or vpn:// import, and prebuilt modules for ARM.

The protocol and the DPI resistance are the same - it is the same AmneziaWG 2.0 underneath. The code is open under the MIT license, it is readable bash you can review before running, and it has 1100+ automated tests. It installs the same upstream AmneziaWG - this is automation and server tuning, not a fork of the protocol.

Detailed comparison: amneziawg-installer vs the official Amnezia app.

---

✨ Features

• DPI bypass - AmneziaWG 2.0 with traffic obfuscation. DPI cannot detect the connection
• One command - working VPN - from a clean VPS to a running server with client configs and QR codes
• Secure by default - UFW, Fail2Ban, sysctl hardening, strict file permissions (600/700)
• Easy management - add/remove clients, temporary clients with auto-removal, traffic stats, backups
• Broad OS support - Ubuntu 24.04, 26.04 and Debian 13; Ubuntu 25.10 and Debian 12 for moving an existing server across
• x86_64 and ARM - cloud VPS, Raspberry Pi 3/4/5, ARM64 servers (AWS Graviton, Oracle Ampere, Hetzner)
• Mobile network optimization - --preset=mobile for Tele2, Yota, Megafon and other carriers with DPI blocking. Fine-tune with --jc, --jmin, --jmax (details)
• Optional dual-stack IPv6 - the --allow-ipv6-tunnel flag adds IPv6 inside the tunnel next to IPv4 (off by default, details)

All features

• Native key and config generation via awg - no Python or external dependencies
• Hardware-aware optimization: swap, NIC offloads, network buffers tuned to server specs
• DKMS - automatic kernel module rebuild on updates
• vpn:// URI for one-tap import into Amnezia Client (.vpnuri files)
• Per-client traffic statistics (stats, stats --json)
• Temporary clients with auto-removal (--expires=1h, 7d, 4w, etc.)
• Diagnostic report (--diagnostic) and full uninstall (--uninstall)
• All actions logged to /root/awg/
• Resume after reboot - the script picks up from where it left off
• Choice of port, subnet, IPv6 mode, routing mode, and client isolation (--isolation=on|off). --endpoint flag for servers behind NAT

---

📡 Tested mobile carriers (Russia)

The installer tunes AmneziaWG 2.0 obfuscation for mobile networks with DPI: --mobile switches on the mobile preset and port 443/udp in a single flag. If your VPN is unstable on mobile data, reinstall with --mobile. The configurations below come from user reports in issues and discussions (no guarantee: blocking and carrier parameters change over time):

• Yota - Moscow, --preset=mobile
• Tele2 - Moscow (--preset=mobile); Krasnoyarsk (--preset=mobile; the May 2026 wave needed I1=<r 48>)
• Tattelecom / Letai - Tatarstan, --preset=mobile
• Megafon - regional networks, --preset=mobile + remove the I1 parameter
• Beeline - default preset, no flags needed
• Home / wired ISPs - default preset usually works out of the box

Your carrier is not on the list? Try --preset=mobile. If that doesn't work - open a thread in Discussions or Issues and I'll add the entry.

Full operator parameter table (Jc, Jmin, Jmax, I1) - in ADVANCED.en.md → FAQ "connects over cellular only on the third attempt". Per-flag overrides via --jc/--jmin/--jmax - in ADVANCED.en.md → Presets.

---

🖥️ Requirements

• OS: A clean installation of Ubuntu Server 24.04 LTS / Ubuntu 26.04 / Debian 13 Minimal. Ubuntu 25.10 and Debian 12 are supported too, but do not pick either for a NEW server - see the compatibility table
• Access: root privileges (via sudo)
• Internet: Stable connection
• Resources: 512 MB RAM minimum, 1 GB recommended (2+ GB comfortable); minimum ~2 GB disk (3+ GB recommended)
• SSH: SSH access to the server

OS Compatibility:

OS	Our pick	Vendor support	Notes
Ubuntu 24.04 LTS	✅ default pick	until 2029-05-31	The best-tested platform
Debian 13 (trixie)	✅ default pick	until 2028-08-09	Tested. PPA via codename mapping to noble, DEB822
Ubuntu 26.04	✅ fine to use	until 2031-05-29	PPA noble fallback applied automatically since v5.13.0
Debian 12 (bookworm)	⚠️ for migration	regular ended 2026-07-11, Debian LTS until 2028-06-30	Works and is tested, security updates continue through Debian LTS. PPA via codename mapping to focal. For a new server prefer Debian 13
Ubuntu 25.10 (questing)	⚠️ for migration	ended 2026-07-01, no extension	Works, PPA noble fallback since v5.13.0. Receives no security updates of any kind, so do not pick it for a new server

Architecture support (v5.10.0+):

Architecture	Status	Platforms
x86_64 (amd64)	✅ Fully supported	All cloud VPS
ARM64 (aarch64)	✅ Supported	Raspberry Pi 3/4/5, AWS Graviton, Oracle Ampere, Hetzner
ARMv7 (armhf)	✅ Supported	Raspberry Pi 3/4 (32-bit)

On ARM, the installer downloads prebuilt kernel modules when available and falls back to DKMS compilation automatically.

⚠️ Non-standard SSH port: The installer usually detects the SSH port automatically. If SSH runs on a non-standard port or autodetection is unavailable, run with --ssh-port=YOUR_PORT (comma-separated for several ports). As an extra conservative safeguard you can run sudo ufw allow YOUR_PORT/tcp before starting the installer.

Clients:

• All platforms: Amnezia VPN >= 4.8.12.7 - full-featured VPN client with AWG 2.0. Import via vpn:// URI
• Windows: AmneziaWG >= 2.0.0 - lightweight tunnel manager with AWG 2.0. Import via .conf files

Full client compatibility table →

---

🚀 Hosting Recommendation

For a stable, high-throughput VPN server, you need reliable hosting with a good network.

What to look for in a VPS for VPN:

• IPs not flagged as datacenter ranges - lower risk of range-based blocks.
• Generous or unlimited traffic and a 1 Gbps+ port.
• Your target OS (Ubuntu 24.04 LTS, 26.04 or Debian 13; 25.10 and Debian 12 work too) and root access.

I've tested and recommend FreakHosting. Their BUDGET VPS lineup offers excellent value for money.

Their IPs are not flagged as datacenter - they are not blocked by services that restrict hosting/datacenter IP ranges (unlike Azure and some major clouds).

• Recommended plan: BVPS-2
• Specs: 2 vCPU, 2 GB RAM, 40 GB NVMe SSD.
• Key advantage: 10 Gbps port with unlimited traffic. Perfect for VPN!
• Price: Just €25 per year (at time of writing; may change).

This configuration is more than enough for comfortable AmneziaWG operation with many connections and heavy traffic.

---

🔧 Installation (Recommended Method)

Installing AmneziaWG on Ubuntu or Debian comes down to three commands: download the script, run it with sudo, and answer a few questions. This method handles interactive prompts and colored output correctly in your terminal.

1. Connect to a clean server (Ubuntu 24.04 / Ubuntu 26.04 / Debian 13) via SSH.

   Tip: After creating the server, wait 5-10 minutes for all background initialization processes to complete before starting the installation.

2. Download the script:

   wget -O install_amneziawg_en.sh https://github.com/bivlked/amneziawg-installer/releases/latest/download/install_amneziawg_en.sh
   # or: curl -fLo install_amneziawg_en.sh https://github.com/bivlked/amneziawg-installer/releases/latest/download/install_amneziawg_en.sh
   

   Minimal Debian may not ship curl (wget is usually present) - use wget. The installer itself adds curl in step 1.

3. Make it executable:

   chmod +x install_amneziawg_en.sh
   

4. Run with sudo:

   sudo bash ./install_amneziawg_en.sh
   

   (You can also pass command-line parameters, see sudo bash ./install_amneziawg_en.sh --help or ADVANCED.en.md#install-cli-adv)

   Russian version: For Russian output, use install_amneziawg.sh:

   wget -O install_amneziawg.sh https://github.com/bivlked/amneziawg-installer/releases/latest/download/install_amneziawg.sh
   sudo bash ./install_amneziawg.sh
   

   The Russian version is functionally identical; only user-facing messages and logs are in Russian. After reboots, resume with the same file: sudo bash ./install_amneziawg.sh

5. Initial setup: The script will interactively ask for:

   • UDP port: Port for client connections (1-65535). Default: 39743.

   • Tunnel subnet: Internal VPN network. Default: 10.9.9.1/24.

   • Disable IPv6: recommended (Y). This is IPv6 on the server itself; whether your device's IPv6 goes into the tunnel is decided by the routing mode, see Device IPv6, ::/0 and the local network.

   • Routing mode: Determines which traffic goes through the VPN. Default 1 (all traffic, 0.0.0.0/0) - the full-tunnel form clients expect. Mode 2 (Amnezia List + DNS) keeps the private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) out of the tunnel, but some clients treat such a list as split routing and behave differently.

   • Client isolation: Whether to block traffic between clients inside the VPN. Enabled (Y) by default - clients cannot see each other; non-interactive: --isolation=on|off.

   • Server name: The server shows up under this name in the Amnezia app on vpn:// import. Default AWG Server; non-interactive: --server-name=NAME.

   AWG 2.0 parameters (Jc, S1-S4, H1-H4, I1) are generated automatically - no action required.

6. Reboots: TWO reboots are required. The script will ask for confirmation [y/N]. Type y and press Enter.

7. Resume: After each reboot, run the script again with the same command:

   sudo bash ./install_amneziawg_en.sh
   

   The script will automatically resume from where it left off without repeating any prompts.

8. Completion: After the second reboot and the third script run, you will see the message: AmneziaWG 2.0 installation and configuration completed SUCCESSFULLY!

---

🔏 Verifying a release (optional)

Releases are signed with a key that lives offline on the maintainer's machine and never reaches GitHub Actions. On a signed release the scripts, the signatures and the public key are all attached, so verification needs nothing from a second place.

Signing did not exist from the start: releases published before it was switched on carry no .minisig assets, and there is nothing to verify there.

sudo apt install minisign          # Ubuntu/Debian

TAG=vX.Y.Z                         # the release you downloaded
BASE="https://github.com/bivlked/amneziawg-installer/releases/download/$TAG"
curl -LO "$BASE/install_amneziawg_en.sh"
curl -LO "$BASE/install_amneziawg_en.sh.minisig"
curl -LO "$BASE/KEYS.txt"

minisign -V -p KEYS.txt -m install_amneziawg_en.sh -x install_amneziawg_en.sh.minisig

Expected: Signature and comment signature verified, and on the next line Trusted comment: amneziawg-installer <your tag> install_amneziawg_en.sh.

Read that second line, not just the first. It names the tag and the filename, so a signature from another release or another file does not pass here. Without that binding a signature would only prove that somebody signed some bytes at some point.

⚠️ What this does NOT give you. If you fetch the script and the key from this repository in the same session, it protects against tampering on the way to you, but not against a compromise of the account itself: whoever can replace the script can replace the key. It starts to mean something once the key is one you saved earlier or took from an independent source. Key fingerprint: 3E598A1C01907E17.

📦 After installation

Where to find client files:

File	Path	Purpose
.conf	/root/awg/name.conf	Configuration for client import
.png	/root/awg/name.png	QR code for mobile devices
.vpnuri	/root/awg/name.vpnuri	vpn:// URI for Amnezia Client

Download config to your computer:

scp root@SERVER_IP:/root/awg/my_phone.conf .

Import into Amnezia VPN (phone) via vpn:// URI

1. On the server, run: cat /root/awg/my_phone.vpnuri
2. Copy the text and send it to yourself (Telegram, email, etc.)
3. On your phone: Amnezia VPN → "Add VPN" → "Paste from clipboard"

Import via QR code

1. Download the QR code: scp root@SERVER_IP:/root/awg/my_phone.png .
2. Open the file on your computer screen
3. On your phone: Amnezia VPN → "Add VPN" → "Scan QR code"

Import into AmneziaWG for Windows

1. Download the .conf file to your computer via scp or sftp
2. AmneziaWG → Import tunnel(s) from file → select the .conf file

Other files on the server:

• Server configuration: /etc/amnezia/amneziawg/awg0.conf
• Script settings: /root/awg/awgsetup_cfg.init
• Management script: /root/awg/manage_amneziawg.sh
• Shared functions: /root/awg/awg_common.sh
• Client expiry data: /root/awg/expiry/
• Logs: /root/awg/*.log

---

👥 Client Management (manage_amneziawg.sh)

The manage_amneziawg.sh script is downloaded automatically during installation.

Usage:

sudo bash /root/awg/manage_amneziawg.sh <command> [arguments]

Full list: ... help or ADVANCED.en.md#manage-commands-adv.

Everyday commands:

Command	Arguments	Description	Restart?
add	<name> [name2 ...] [--expires=DUR] [--allowed-ips=LIST]	Add client(s) (opt. with expiry and per-client routes)	No (auto)
remove	<name> [name2 ...]	Remove client(s)	No (auto)
list	[-v] [--json]	List clients (-v for details, --json machine-readable with client_ipv6 and expires_at)	No
show		Run awg show	No
stats	[--json]	Per-client traffic statistics	No

Maintenance and recovery:

Command	Arguments	Description	Restart?
regen	[name ...] [--reset-routes]	Regenerate files (all/listed)	No
modify	<name> <param> <val>	Modify a client parameter	No
backup		Create a backup	No
restore	[file]	Restore from backup	No
check		Check server status	No
diagnose	[--carrier=NAME]	Diagnostics (opt. per carrier)	No
repair-module		Rebuild kernel module (DKMS)	Yes
restart		Restart AmneziaWG service	-

💡 Note: add and remove commands auto-apply changes via awg syncconf - no service restart needed.

🤖 For scripts and bots: since v5.21.0 nearly every management command (from add to repair-module) understands --json and replies with a single JSON object, even when something goes wrong - so your script or bot can parse the output without guesswork. list --json and stats --json still return plain arrays, as before. The format and the strict confirmation mode AWG_STRICT_CONFIRM=1 are covered in ADVANCED.en.md → JSON interface, and there is already a Telegram bot built on this interface - awgram.

📌 Quick Reference

# Installation (English)
wget -O install_amneziawg_en.sh https://github.com/bivlked/amneziawg-installer/releases/latest/download/install_amneziawg_en.sh
sudo bash ./install_amneziawg_en.sh       # Run (+ 2 reboots)

# Installation (Russian)
wget -O install_amneziawg.sh https://github.com/bivlked/amneziawg-installer/releases/latest/download/install_amneziawg.sh
sudo bash ./install_amneziawg.sh          # Run (+ 2 reboots)

# Client management
sudo bash /root/awg/manage_amneziawg.sh add my_phone       # Add
sudo bash /root/awg/manage_amneziawg.sh add my_iphone --psk  # +PresharedKey (Shadowrocket iOS/macOS)
sudo bash /root/awg/manage_amneziawg.sh remove my_phone    # Remove
sudo bash /root/awg/manage_amneziawg.sh list                # List
sudo bash /root/awg/manage_amneziawg.sh list --json         # List as JSON (for scripts)
sudo bash /root/awg/manage_amneziawg.sh regen               # Regenerate

# Temporary client (7 days)
sudo bash /root/awg/manage_amneziawg.sh add guest --expires=7d

# Traffic statistics
sudo bash /root/awg/manage_amneziawg.sh stats
sudo bash /root/awg/manage_amneziawg.sh stats --json

# Maintenance
sudo bash /root/awg/manage_amneziawg.sh check               # Diagnostics
sudo bash /root/awg/manage_amneziawg.sh backup               # Backup
sudo bash /root/awg/manage_amneziawg.sh restart              # Restart

---

ℹ️ Additional Information

For detailed information on configuration, security settings, AWG 2.0 parameters, management commands, technical details, and more, see ADVANCED.en.md.

For the changelog, see CHANGELOG.en.md.

For the roadmap and priorities, see docs/ROADMAP.md.

For a two-server cascade with a split exit for Russian and foreign traffic (split-tunnel), see CASCADE.en.md.

For selectively routing the Russian segment through Cloudflare WARP via a BGP feed on a single server, see WARP-RU.en.md.

---

❓ FAQ

In this section: install and updates, connecting clients, mobile networks, choosing a host and migrating, security and parameters. Expand the relevant question below.

Q: Will it survive a kernel update?

A: Yes, DKMS should automatically rebuild the module. Verify with dkms status.

Q: How do I completely uninstall AmneziaWG?

A: Download the installer script (if you don't have it) and run: sudo bash ./install_amneziawg_en.sh --uninstall.

Q: Clients can't connect - what should I do?

A: 1. Check status: sudo bash /root/awg/manage_amneziawg.sh check. 2. Check firewall: sudo ufw status verbose. 3. Verify client config. 4. Check logs: sudo journalctl -u awg-quick@awg0 -n 50. 5. Make sure the client supports AWG 2.0: Amnezia VPN >= 4.8.12.7 or AmneziaWG >= 2.0.0.

Q: Handshake completes but no traffic flows - what's wrong?

A: A common cause is the split-tunneling AllowedIPs gotcha during manual customization. If you want to ping or SSH to the server by its inner tunnel IP (10.9.9.1 in the default subnet), add the tunnel subnet (default 10.9.9.0/24, or your custom one if you changed --subnet) to the client's AllowedIPs. Otherwise the client does not route traffic to the server even from inside the tunnel. The --route-all mode (full tunnel 0.0.0.0/0, the default) covers the subnet automatically; --route-amnezia (Amnezia List) and --route-custom= do not, add it explicitly. See ADVANCED.en.md → AllowedIPs.

Separate from the routing mode: by default clients are isolated from each other on the server (a FORWARD awg0→awg0 DROP rule), even if both are in the same mode. To let devices see each other inside the VPN, set --isolation=off at install time - the server drops the block, and the tunnel subnet is added to clients' AllowedIPs automatically. See ADVANCED.en.md → Client Isolation.

Q: Can I make Russian traffic go directly while the rest exits abroad?

A: Yes, via a two-server cascade: the client connects to an entry server (ideally in Russia), Russian traffic exits directly from it, and everything else goes through a second server abroad. The split is on the server side, nothing special is needed on the client. Step-by-step guide in CASCADE.en.md.

Q: Can I use this with AWG 1.x clients?

A: No. AWG 2.0 is not compatible with AWG 1.x. All clients must support the 2.0 protocol. For AWG 1.x, use the legacy/v4 branch.

Q: Config import error "Invalid key: s3" - what's wrong?

A: You're using an outdated version of amneziawg-windows-client (< 2.0.0). Update to version 2.0.0+ which supports AWG 2.0. Alternatively, use Amnezia VPN >= 4.8.12.7.

Q: How do I update the scripts to a newer version?

A: Download the updated scripts and replace them on the server:

  # English version:
  wget -O /root/awg/manage_amneziawg.sh https://github.com/bivlked/amneziawg-installer/releases/latest/download/manage_amneziawg_en.sh
  wget -O /root/awg/awg_common.sh https://github.com/bivlked/amneziawg-installer/releases/latest/download/awg_common_en.sh
  chmod 700 /root/awg/manage_amneziawg.sh /root/awg/awg_common.sh
Russian version:
wget -O /root/awg/manage_amneziawg.sh https://github.com/bivlked/amneziawg-installer/releases/latest/download/manage_amneziawg.sh
wget -O /root/awg/awg_common.sh https://github.com/bivlked/amneziawg-installer/releases/latest/download/awg_common.sh
chmod 700 /root/awg/manage_amneziawg.sh /root/awg/awg_common.sh

Server reinstallation is not required.

Since v5.21.0 the script pair is protected against drift: if you update manage but forget awg_common (or the other way around) and the versions diverge, the script stops and shows the exact commands to fetch the other half, instead of throwing strange errors halfway through.

Q: What is the maximum number of clients?

A: The default /24 subnet supports up to 253 clients (.2 - .254), which is sufficient for most use cases. Need more? Pass a wider CIDR via --subnet (e.g. /16) to raise the limit.

Q: Which hosting providers work well?

A: Any VPS with Ubuntu 24.04 LTS / Ubuntu 26.04 / Debian 13 (25.10 and Debian 12 are supported too, but both are past regular support - see the compatibility table), root access, and at least 512 MB RAM (1 GB recommended). Pick providers with clean (non-blacklisted) IPs and unlimited traffic. See the recommendation below.

Q: How do I migrate the VPN to another server?

A: 1. Create a backup: sudo bash /root/awg/manage_amneziawg.sh backup. 2. Copy the archive from /root/awg/backups/ to the new server. 3. Install AmneziaWG on the new server. 4. Restore: sudo bash /root/awg/manage_amneziawg.sh restore (interactive selection, or specify the full archive path). 5. Regenerate configs with new IP: sudo bash /root/awg/manage_amneziawg.sh regen.

Q: How do I create a temporary client?

A: sudo bash /root/awg/manage_amneziawg.sh add guest --expires=7d. Formats: 1h, 12h, 1d, 7d, 30d, 4w. A cron job checks every 5 minutes and automatically removes expired clients.

Q: What are .vpnuri files?

A: .vpnuri files contain vpn:// URIs for one-tap config import into Amnezia Client. Copy the file contents → open Amnezia Client → "Add VPN" → "Paste from clipboard".

Q: Shadowrocket on iOS/macOS does not connect - needs PresharedKey

A: Since v5.11.1 the add command supports a --psk flag: sudo bash /root/awg/manage_amneziawg.sh add my_iphone --psk. The client config will include a PresharedKey = ... line matching the server [Peer]. For existing clients: recreate with the flag (remove + add --psk) or manually - generate the key once (PSK=$(awg genpsk)) and paste the same value into both sides (the server [Peer] for that client and the client's [Peer] for the server); the handshake fails if the values differ. regen preserves an existing PSK across rotation. Details - in ADVANCED.en.md.

Q: iPhone connects but traffic stops after ~10 seconds

A: Fixed in v5.16.1 (Issue #42, thanks to @LiaNdrY). The routing mode that was default back then (mode 2, Amnezia List) started with 0.0.0.0/5, and on iOS that block broke the whole route list, so the tunnel stalled after about 10 seconds. On an existing server the simplest fix is to set AllowedIPs = 0.0.0.0/0 in the iOS client config (a plain --force reinstall keeps the stored list). A precise split-tunnel-preserving edit is in ADVANCED.en.md.

Q: Why port 39743?

A: It's a random port from the upper range, chosen as the default. You can change it during installation: --port=N (any port 1-65535). On mobile networks where the carrier drops unfamiliar ports, 443/udp often helps - the --mobile flag sets it together with the obfuscation preset.

Q: Is Perl required on the server?

A: Perl is used optionally for generating vpn:// URIs (.vpnuri files). If Perl is absent, .conf files are still created normally - you can use them via file import or QR code. Perl is installed by default on Ubuntu and Debian.

Q: Can I manage the server from my own scripts or a Telegram bot?

A: Yes. Since v5.21.0 the management commands take the --json flag and reply with a single JSON object even on failure, so the output is safe to parse from any script (list/stats have returned JSON arrays for a long time). I promise not to break the format: new fields may appear, existing ones keep their names and types. For unattended runs there is --yes, and the strict mode AWG_STRICT_CONFIRM=1 makes commands like remove refuse when --yes is missing, instead of quietly going ahead. The format breakdown lives in ADVANCED.en.md → JSON interface. For a real-world example, the awgram Telegram bot runs on exactly this interface.

Q: Is it safe to re-run the installer? Will clients need new configs?

A: Yes, it is safe, and no re-issuing is needed. Re-running over an already working service requires the --force flag (or AWG_FORCE_REINSTALL=1) - without it the script reports that AmneziaWG is already installed and changes nothing. With --force the server config is written anew, but the server keys and the obfuscation parameters are taken from the existing setup, and the [Peer] blocks are carried over from the previous config. Every client is preserved, including the default my_phone and my_laptop: the creation loop skips the ones already present in the config. Config files and QR codes handed out earlier stay valid.

There is exactly one exception: passing --preset, --jc, --jmin or --jmax regenerates the whole Jc/S/H/I1 set, and then the old configs do stop connecting - they have to be re-issued with regen and handed out again. Leave those flags off for a plain update.

Most of the time --force is not needed at all: to get the newer management commands it is enough to update the two scripts on the server (see the question above). Re-running the installer itself is only worth it when the installer changed.

More answers and solutions in ADVANCED.en.md.

---

🛠️ Troubleshooting

1. Logs: /root/awg/install_amneziawg.log, /root/awg/manage_amneziawg.log
2. Service status: sudo systemctl status awg-quick@awg0
3. AmneziaWG status: sudo awg show
4. UFW status: sudo ufw status verbose
5. Diagnostic report: sudo bash ./install_amneziawg_en.sh --diagnostic For a detailed breakdown of the report, see ADVANCED.en.md.

---

🌐 Ecosystem

Clients

Which client should I use? Install Amnezia VPN (>= 4.8.12.7) - works on all platforms, supports vpn:// URI import. For a lightweight connection (.conf import only), use AmneziaWG for your platform.

Client	Platform	AWG 2.0	Type	Notes
Amnezia VPN	Windows, macOS, Linux, Android, iOS	✅ >= 4.8.12.7	Official	Recommended. Full-featured, vpn:// URI
AmneziaWG	Windows	✅ >= 2.0.0	Official	Lightweight tunnel manager, .conf import
AmneziaWG	Android	✅ >= 2.0.0	Official	Lightweight tunnel manager, .conf import
AmneziaWG	iOS	✅	Official	Lightweight tunnel manager, .conf import
WG Tunnel	Android	⚠️ partial	Third-party, FOSS	Auto-tunneling, split tunnel, F-Droid
VeilBox	Windows, macOS	✅	Third-party, FOSS	Also supports VLESS

Full compatibility table with AWG 1.x details →

Configuration Tools

Project	Description
Junker	AmneziaWG signature generator by @spatiumstas - for manual setup without an installer
Any-Tech-ARCHITECT	Obfuscation parameter generator by @Vadim-Khristenko - value selection and validation with a client compatibility matrix (GitHub)

Router Firmware

Project	Platform	Description
AWG Manager	Keenetic (Entware)	Web UI for managing AWG tunnels on Keenetic routers
AmneziaWG for Merlin	ASUS (Asuswrt-Merlin)	AWG 2.0 addon with web UI, GeoIP/GeoSite routing

Server Management

Project	Platform	Description
amneziawg-manager	macOS	Native GUI that drives the server over SSH via the bundled manage script - no web panel or daemons
awgram	Telegram	Rust bot: add/remove clients, stats, backup - via the bundled manage script
amneziawg-installer-tg-bot	Telegram	Python bot that runs on the server itself: clients by button, guest access with an expiry, stats, backup - via the bundled manage script

📰 Featured in

📖 Tutorials & Guides

• Hetzner Community - Making a website accessible from restricted regions (cross-link in Resources)
• Debian Forums - HowTo: Install AmneziaWG 2.0 on Debian 12/13
• LowEndTalk - [Tutorial] One-command AmneziaWG VPN server install on Ubuntu / Debian / ARM
• AVA Hosting - Self-Hosted VPN: Setup AmneziaWG Easily (step-by-step guide built on the installer)

📰 Articles & Reviews

• XDA Developers - "I found a self-hosted VPN that works where WireGuard gets blocked"
• Pinggy - Top 5 Best Self-Hosted VPNs in 2026
• gHacks Tech News - AmneziaWG 2.0

📋 Listings & Directories

• VPN Status (RU) - AmneziaWG services and server-side options catalog
• AlternativeTo - amneziawg-installer (42 alternatives)
• LibHunt - #1 in Shell VPN category

💬 Forums & Communities

• Qubes OS Forum - AmneziaWG for censored regions
• Lemmy.world /c/selfhosted - amneziawg-installer announce (143 upvotes / 39 comments)

---

📝 License & Author

• Author: @bivlked - GitHub
• License: MIT - free and open-source (see LICENSE)

---

If this project helped you, a ⭐ helps others find it.

↑ Back to top