22. AmneziaWG (Anti-Censorship)

Overview

AmneziaWG is a specialized fork of WireGuard designed to evade Deep Packet Inspection (DPI) and strict internet censorship systems. While standard WireGuard has easily detectable packet signatures, AmneziaWG obfuscates traffic while retaining WireGuard's speed and performance.

Key Capabilities

• Header Obfuscation — randomizes message headers (H1, H2, H3, H4) so DPI firewalls cannot detect WireGuard handshakes or data packets
• Junk Packet Injection — sends random junk packets (Jc count, within Jmin–Jmax byte size) before connection initiation to confuse DPI pattern analyzers
• Variable Junk Packet Sizes — custom sizes for initiation junk (S1) and response junk (S2)
• High Performance — runs with kernel module speed (amneziawg), offering WireGuard throughput with anti-censorship resistance
• Cross-Platform Clients — supported on Windows, macOS, Linux, Android, and iOS via Amnezia VPN client applications

Requirement: amneziawg (kernel module or DKMS) and amneziawg-tools packages must be installed on the host. Check via Settings > Environment.

Installation

AmneziaWG requires the kernel module (amneziawg-dkms) and CLI tools (amneziawg-tools). Choose the instructions corresponding to your operating system:

Debian (11 / 12 / 13)

Important for Debian: AmneziaWG is compiled on your server as a kernel module via DKMS. On Debian, DKMS requires kernel headers (linux-headers-$(uname -r)) and build tools (build-essential). Without them, the DKMS build will fail.

Copy and run the complete installation block as root:

# 1. Install build tools, DKMS, and current kernel headers
apt-get update && apt-get install -y build-essential dkms linux-headers-$(uname -r)

# 2. Add the official Amnezia PPA repository keyring and source
mkdir -p /etc/apt/keyrings && curl -fsSL "https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x75C9DD72C799870E310542E24166F2C257290828" | gpg --dearmor --yes -o /etc/apt/keyrings/amnezia.gpg
echo "deb [signed-by=/etc/apt/keyrings/amnezia.gpg] https://ppa.launchpadcontent.net/amnezia/ppa/ubuntu noble main" > /etc/apt/sources.list.d/amnezia.list

# 3. Install the DKMS module and tools
apt-get update && apt-get install -y amneziawg-dkms amneziawg-tools

# 4. Load the kernel module
modprobe amneziawg

Ubuntu (22.04 / 24.04 LTS)

Option 1: Using add-apt-repository (standard):

add-apt-repository -y ppa:amnezia/ppa
apt-get update && apt-get install -y amneziawg-dkms amneziawg-tools
modprobe amneziawg

Option 2: Using GPG keyring (minimal systems):

mkdir -p /etc/apt/keyrings && curl -fsSL "https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x75C9DD72C799870E310542E24166F2C257290828" | gpg --dearmor --yes -o /etc/apt/keyrings/amnezia.gpg
echo "deb [signed-by=/etc/apt/keyrings/amnezia.gpg] https://ppa.launchpadcontent.net/amnezia/ppa/ubuntu noble main" > /etc/apt/sources.list.d/amnezia.list
apt-get update && apt-get install -y amneziawg-dkms amneziawg-tools
modprobe amneziawg

Verification

Verify that the module has been compiled and loaded into the kernel:

# Check DKMS compilation status (should show 'installed')
dkms status

# Check that the kernel module is active
lsmod | grep amneziawg

# Check that the awg CLI utility is available
awg --version

Troubleshooting DKMS Compilation & Kernel Updates

If dkms status shows added or error, or if you upgrade the system kernel:

apt-get install -y build-essential dkms linux-headers-$(uname -r)
dpkg-reconfigure amneziawg-dkms
modprobe amneziawg

Note on DNS / resolvconf: If you run awg-quick manually and receive /usr/bin/awg-quick: resolvconf: command not found, install openresolv:

apt-get install -y openresolv

Navigate to VPN Servers > AmneziaWG to access AmneziaWG management. The page provides 5 tabs: Overview, Networks, Settings, Online, and Client Profiles.

Obfuscation Parameters Explained

Each network can inherit the global defaults or define custom obfuscation values to match specific ISP bypass requirements.

Overview Tab

The Overview tab displays:

Networks Tab

Lists all networks that have AmneziaWG enabled:

Settings Tab

Global defaults for AmneziaWG client profiles:

• Default MTU — interface MTU (recommended: 1420 or 1280 for mobile networks)
• Persistent Keepalive — interval in seconds to keep NAT sessions active (default: 25s)
• AllowedIPs — default route pushed to clients (default: 0.0.0.0/0, ::/0)
• Global Junk Settings — default Jc, Jmin, Jmax, S1, S2 values

Online Peers Tab

Shows real-time connected peers with active session data:

• Client Name & Username — client identity
• IP Address & Endpoint — assigned tunnel IP and client remote IP:port
• Latest Handshake — timestamp of most recent successful handshake
• Transfer RX/TX — live byte counters
• Bandwidth — configured bandwidth limit for the client

Client Profiles Tab

Lists all configured AmneziaWG client profiles across networks, indicating network membership, activation status, and cryptographic key status.

Network Configuration

When configuring AmneziaWG inside a network:

• Listen Port — UDP port on which AmneziaWG listens
• Allowed IPs — IP ranges routed through the tunnel
• MTU & Persistent Keepalive — per-network overrides
• Obfuscation Parameters — custom H1–H4 headers and Jc/Jmin/Jmax/S1/S2 values

Client Configuration & QR Codes

In the client management page, enabling AmneziaWG automatically generates:

1. Standard cryptographic keys adapted for AmneziaWG
2. Obfuscation parameters embedded into client .conf
3. QR code for instant mobile setup via AmneziaWG apps on iOS and Android

One-Time Links (OTL) for AmneziaWG

Administrators can configure the AmneziaWG download page on One-Time Links, setting custom button labels and download links for all supported platforms (Android, iOS, Windows, macOS).

The end-user sees a clean, self-service page with QR code, configuration preview, config file download button, and direct app store links to the official AmneziaWG clients.