1. Edit parameters (Jc, S1-S4, H1-H4, I1-I5) in the [Interface] section of /etc/amnezia/amneziawg/awg0.conf.
2. Restart the service: sudo systemctl restart awg-quick@awg0.
3. Regenerate every client config: sudo bash /root/awg/manage_amneziawg.sh regen <name>. As of v5.8.0, regen reads live values directly from awg0.conf (the source of truth) instead of the cached awgsetup_cfg.init.
4. Distribute the new .conf / QR codes / vpn:// URIs to clients.

• AmneziaWG runs as a kernel module (DKMS), with no Docker - no background daemon and none of its RAM/CPU cost.
• The whole server is tuned to the hardware: sysctl buffers, swap, NIC offloads, BBR, unneeded packages stripped.
• The attack surface is kept small: UFW deny-all, Fail2Ban, strict permissions, sysctl hardening, one service instead of a stack.
• Fine tuning is available: a mobile-network preset and direct access to the AWG 2.0 parameters.
• Management is from the CLI (manage add/remove/list/--expires), with prebuilt ARM modules and a headless mode for automation.

• client .conf files are hand-edited to remove S3 / S4;
• the server preset is imported into a WireGuard client without AWG extensions (plain wg-quick on an older kernel without the amneziawg module);
• migrating from an AWG 1.x setup where clients deliberately used S3=0 / S4=0.

1. apt hook /etc/apt/apt.conf.d/99-amneziawg-post-kernel — after apt upgrade the helper /usr/local/sbin/amneziawg-ensure-module --hook rebuilds DKMS for the new kernel. Log: /var/log/amneziawg-ensure-module.log (weekly rotate, 4 copies).
2. systemd unit amneziawg-ensure-module.service — at boot, before awg-quick@awg0, the helper iterates kernels with already-installed headers, rebuilds DKMS for the current kernel, runs modprobe amneziawg, and verifies the load via lsmod. If headers are not yet installed, it logs a WARN and exits successfully so it does not block boot. Logs in journal: journalctl -u amneziawg-ensure-module.service.
3. manage repair-module — explicit fallback: sudo bash /root/awg/manage_amneziawg.sh repair-module installs kernel-headers (with AWG_ALLOW_APT_IN_ENSURE=1), rebuilds DKMS, restarts awg-quick.

sudo apt install linux-headers-$(uname -r)
sudo dkms autoinstall
sudo modprobe amneziawg
sudo systemctl restart awg-quick@awg0

• ARM prebuilt (Raspberry Pi, Hetzner CAX, Oracle Ampere) uses a prebuilt .deb rather than DKMS — auto-repair is not engaged. After a kernel upgrade either rerun the installer (it will pick a fresh prebuilt or fall back to DKMS), or run manage repair-module.
• Cloud kernels (Azure / AWS / GCP / Oracle / Debian-cloud) — the installer detects the meta-package from the uname -r suffix (e.g. linux-headers-azure). If you have a custom kernel or an unusual flavor, manage repair-module does the same in reactive mode.

sudo bash install_amneziawg_en.sh --preset=mobile --yes --route-amnezia

1. Open /etc/amnezia/amneziawg/awg0.conf and change Jc to 3 and I1 to <r 64>.
2. sudo systemctl restart awg-quick@awg0
3. sudo bash /root/awg/manage_amneziawg.sh regen <client_name> for each client.
4. Redistribute updated configs.

1. Open /etc/sysctl.d/99-amneziawg-security.conf
2. Change rp_filter = 1 to rp_filter = 2 (both lines: conf.all and conf.default)
3. Add a line kernel.printk = 3 4 1 3
4. sudo sysctl -p /etc/sysctl.d/99-amneziawg-security.conf

1. Open incoming on awg0 in UFW:

   sudo ufw allow in on awg0
   sudo ufw reload

   This allows all incoming on the tunnel interface — narrow ICMP filtering is done via -i in before.rules (see below).
2. If you edited /etc/ufw/before.rules, add -i <public_iface> to every ICMP DROP line:

   # instead of
   -A ufw-before-input -p icmp --icmp-type echo-request -j DROP
   # use (ens3 — your public iface)
   -A ufw-before-input -i ens3 -p icmp --icmp-type echo-request -j DROP

   Same for destination-unreachable, time-exceeded, parameter-problem. Find your public interface name: ip route get 8.8.8.8 | awk '{for(i=1;i<=NF;i++) if($i=="dev") print $(i+1)}'. Apply: sudo ufw reload.