RU Русский | EN English

AmneziaWG 3.1 / 2.0 VPN installer for Ubuntu, Debian, Raspberry Pi and ARM64 VPS

Install AmneziaWG 3.1 / 2.0 VPN on Ubuntu and Debian VPS

One-command, self-hosted AmneziaWG 3.1 VPN for Ubuntu 24.04 / 26.04 and Debian 13, with AmneziaWG 2.0 for older clients and routers. Kernel-native DKMS, no Docker, no web panel, runs on any cheap VPS.

Project website Ubuntu 24.04 | 26.04 Debian 13 x86_64 | ARM64 | ARMv7 AmneziaWG 3.1 and 2.0 License Version Tests Stars Last commit Ask DeepWiki

In-kernel, no Docker or panels - zero overhead  |  VPN-only server, hardened by default  |  set it and forget it  |  QR or one-tap vpn:// import

**Facts as of 2026-10-22.** Installer 6.1.1. OS support dates verified against vendor data on 2026-08-29. | | | |---|---| | **For a new server** | Ubuntu 24.04, Debian 13 | | **Also supported** | Ubuntu 26.04 | | **Not for new servers** | Debian 12 - no longer under standard vendor support | | **Architectures** | x86_64, ARM64, ARMv7 | | **Kernel module** | DKMS from the Amnezia PPA; on kernels older than 6.7 (a stock Debian 12) a pinned 2.0 module built from source; prebuilt packages for some ARM targets | | **Config profile** | AmneziaWG 3.1 for a new install; 2.0 with `--protocol=2.0`, or automatically where the installer does not issue 3.1 (kernel older than 6.7, ARM); a running server keeps its generation | ## 🚀 Quick Start ```bash wget -O install_amneziawg_en.sh https://github.com/bivlked/amneziawg-installer/releases/latest/download/install_amneziawg_en.sh chmod +x install_amneziawg_en.sh sudo bash ./install_amneziawg_en.sh ``` > What you get (on x86_64 with Ubuntu 24.04 / 26.04 or Debian 13): an AmneziaWG 3.1 server tuned for VPN (forwarding, kernel tuning) and hardened (the UFW firewall, if you agree), and two ready clients, `my_phone` and `my_laptop`: their configs, QR codes and `vpn://` links are in `/root/awg/`. 3 commands, 2 reboots along the way (answer `y` each time it asks to reboot, and after each one run the last command again), about 20 minutes. For a clean Ubuntu/Debian VPS, not a home router or shared hosting. [Details →](#installation) > > **Connect a device.** You need a client with 3.1 support: on Android, WG Tunnel or AmneziaWG; on iPhone, AmneziaWG (scan the `my_phone.png` QR code); on Mac, AmneziaWG (import the `.conf`); on Windows, AmneziaWG (import `my_laptop.conf`); on any platform, Amnezia VPN (the `vpn://` link); on Linux, [with awg-quick](ADVANCED.en.md#linux-client-adv). How to get the files off the server is in [After installation](#after-installation); another device later is a single `add` command. > > Have a router on stock firmware, Hiddify, or apps that have not been updated for a long time? Add `--protocol=2.0` to the last command, [here is why](#awg3). On ARM and on a stock Debian 12 the installer picks 2.0 by itself. > 📘 Full deployment guide: [Install AmneziaWG VPN server on Ubuntu/Debian VPS](INSTALL_VPS.md) - covers VPS choice, ARM, troubleshooting, and uninstall. > 🔐 Integrity: the installer is downloaded over HTTPS from the latest GitHub release. You can check it before running with its minisign signature: [Verifying a release](#verifying-a-release). The helper scripts it fetches itself (`awg_common`, `manage`) come from the tag of its own version and are checked against SHA256 hashes built into it, so the installer's signature covers them too (unless you override `AWG_BRANCH`). Threat model: [docs/SIGNING_DESIGN.md](docs/SIGNING_DESIGN.md#threat-model); how to report a vulnerability: [SECURITY.md](SECURITY.md).
What the installer changes on your server (transparency) The script runs as root. Below are the main changes it makes to the system. - **System update.** `apt-get upgrade --with-new-pkgs`: it never removes packages, but a new kernel can arrive. Before that it writes `/etc/apt/apt.conf.d/99-amneziawg-lock-timeout` (wait up to 5 minutes for the dpkg lock) and marks as manually installed the packages the server needs to boot and keep its network (`udev`, `initramfs-tools`, `openssh-server`, `netplan.io` and others). - **Package removal**, with your consent: if the server has no snaps, Enter means yes, and `--yes` counts as consent; keep the packages with `--keep-packages`. It removes `modemmanager`, `networkd-dispatcher`, `unattended-upgrades` (security updates stop installing automatically), `packagekit` and `udisks2`. On Ubuntu also `snapd` with `/snap`, `/var/snap`, `/var/lib/snapd`, and `lxd-agent-loader`. `cloud-init` goes, with `/etc/cloud` and `/var/lib/cloud`, only when it does not manage the network. - **Packages installed.** `curl`, `wget`, `gpg`, `sudo`, `amneziawg-dkms`, `amneziawg-tools`, `wireguard-tools`, `dkms`, `build-essential`, `dpkg-dev`, `qrencode`, kernel headers, `ufw`, `fail2ban` (plus `python3-systemd` on Debian). When the 2.0 module is built from source, `git` is added; stale kernel headers bring `gcc-13`. On some ARM boards a prebuilt module package from the `arm-packages` release is installed instead of a build. - **Repository.** The Amnezia PPA: `/etc/apt/sources.list.d/amnezia-ppa.sources` (`.list` on Debian 12) and the key `/etc/apt/keyrings/amnezia-ppa.gpg`. The key ships inside the installer, is checked by its full fingerprint and is trusted for this repository only. - **Kernel module.** `amneziawg` is built via DKMS and loaded at boot (`/etc/modules-load.d/amneziawg.conf`). After a kernel update the module is rebuilt automatically by `/usr/local/sbin/amneziawg-ensure-module`, the apt hook `/etc/apt/apt.conf.d/99-amneziawg-post-kernel` and the `amneziawg-ensure-module.service` unit, with a log in `/var/log/amneziawg-ensure-module.log`. ARM hosts with a prebuilt package do not get this: after a kernel change, run the installer again. - **sysctl**, in `/etc/sysctl.d/99-amneziawg-security.conf`: forwarding, host IPv6 off (keep it with `--allow-ipv6`), BBR, buffers sized to RAM, `rp_filter = 2`, no redirects, SYN cookies, `vm.swappiness = 10`, `net.netfilter.nf_conntrack_max = 65536`, `kernel.sysrq = 0`, `kernel.printk = 3 4 1 3`. - **Swap.** When swap is below 1 GB (up to 2 GB of RAM) or below 512 MB (more RAM), it creates `/swapfile` and adds a line to `/etc/fstab`. - **Firewall.** UFW: incoming denied, SSH rate-limited on the detected port (or `--ssh-port`), the VPN UDP port open, and a forwarding rule from `awg0` to the external interface. If UFW is not on yet, the installer asks whether to enable it (with `--yes` it is enabled without asking). Fail2Ban protects SSH, with its settings in `/etc/fail2ban/jail.d/amneziawg.conf`. **The SSH server configuration is not touched.** - **VPN.** The server config `/etc/amnezia/amneziawg/awg0.conf` with `iptables` rules in `PostUp`, the `awg-quick@awg0` service, the `/root/awg/` directory (keys, client configs, log, management scripts) with 700/600 permissions, and the cron job `/etc/cron.d/awg-expiry` for clients with an expiry date. - **Reboots.** There are two: after the system update and after the module install (the installer asks, answer `y`). After each one, run the same command again. - **Rollback**: `--uninstall` removes its own module, configs, sysctl files, cron jobs, the VPN-port UFW allow rule and the `awg0` UFW route rule. It disables UFW and purges Fail2Ban only if it enabled/installed them itself; if UFW was already active before install, the SSH rate-limit rule it added stays. It does not restore swap settings or removed packages, and the dependency packages it added (dkms, the compiler, kernel headers) stay. By default, `--yes` included, it first creates the archive `/root/awg_uninstall_backup_*.tar.gz` with the configs and private keys; it stays on the server, so delete it yourself once you no longer need it. `--no-tweaks` leaves packages, swap, sysctl hardening, UFW and Fail2Ban alone. Forwarding is enabled anyway, in `/etc/sysctl.d/99-amneziawg-forwarding.conf`, and the same file turns host IPv6 off unless you pass `--allow-ipv6`; the system update runs as usual. What stays after an uninstall is in [INSTALL_VPS.md](INSTALL_VPS.md#uninstall), the threat model in [docs/SIGNING_DESIGN.md](docs/SIGNING_DESIGN.md#threat-model), signature verification in [Verifying a release](#verifying-a-release).
Non-interactive installation (for automation) ```bash sudo bash ./install_amneziawg_en.sh --yes --route-all ``` All parameters are accepted automatically. Details: [ADVANCED.en.md#cli-params-adv](ADVANCED.en.md#cli-params-adv)
### 🎯 Pick your case | Your situation | What to add | |---|---| | Plain cheap VPS, you just need a VPN | Nothing - the command above already does it | | Mobile data, DPI cuts the link (TSPU, Iran, school or office) | During install, add `--mobile` - the obfuscation preset plus port 443/udp in one go ([tested carriers](#carriers)) | | ARM: Raspberry Pi, Oracle Ampere, Hetzner CAX | Same command: ready-made ARM kernel modules are selected automatically, and the protocol is AmneziaWG 2.0 (3.1 is x86_64 only for now), so clients need 2.0 support ([here is why](#awg3)) | | Time-limited access for a friend or guest | After install: `sudo bash /root/awg/manage_amneziawg.sh add guest --expires=7d` | ---

Why this project • AmneziaWG 3.x • AWG vs WG • CLI vs panels • Similar tools • Quick Start • Features • Carriers • Requirements • Hosting • Installation • Verifying a release • After installation • Management • More • FAQ • Troubleshooting • Ecosystem • License

## 💡 Why this project [AmneziaWG](https://github.com/amnezia-vpn) is a fork of WireGuard with traffic obfuscation. The obfuscation makes the traffic hard for DPI systems to tell apart from random noise, so where plain WireGuard gets detected and blocked, AmneziaWG usually keeps working. This set of scripts turns a clean VPS into a ready-to-use VPN server. No Linux knowledge required - the script configures the firewall, optimizes the system, and generates client configs and QR codes automatically. The server is tuned for a single job - VPN: extra packages are removed, the kernel, network stack and swap are tuned to the hardware, and the firewall and baseline hardening are enabled. AmneziaWG runs in the kernel, so overhead is minimal - fast and lean. Set it up once for your home or family and forget it: adding a friend or a new device a month later takes a minute, with the config and QR generated by a single command. You need a clean x86_64 VPS with Ubuntu 24.04 / 26.04 or Debian 13: these get AmneziaWG 3.1. Any cheap VPS will do, from 512 MB RAM (1 GB is comfortable). Other systems, architectures and support dates are in [Requirements](#requirements). --- ## 🆕 AmneziaWG 3.1 by default Since version 6.0.0 a new install gets **AmneziaWG 3.1** by default: both the server and the client profiles carry third-line parameters - header encryption (`HeaderProtectionKey`) and extra padding inside the encrypted part (`ContentPaddingAddition`). The install command is the same, no flags needed. Junk packets `Jc`, padding `S1`-`S4` and the `I1` concealment packet stay. `H1`-`H4` are set to 1-4 in the 3.1 profile: header encryption now hides the message type, and random ranges no longer conceal anything. **Who needs `--protocol=2.0`.** A client without 3.1 support will not accept a 3.1 profile: there is no handshake, and there may be no error message either. So if any of your devices runs such a client, install the server on 2.0 from the start: ```bash sudo bash ./install_amneziawg_en.sh --protocol=2.0 ``` Still without 3.1 support: routers on stock firmware (stable KeeneticOS, OpenWrt with an old amneziawg package), Hiddify, and apps that have not been updated for a long time. Which clients understand 3.1 and from which version is in the [client table](ADVANCED.en.md#client-gen-adv). Better decide before installing: the generation of a running server changes only through a reinstall, and then every client profile is issued again. **Where the installer picks 2.0 by itself.** On kernels older than 6.7 (a stock Debian 12 with kernel 6.1) and on ARM the installer deliberately does not issue 3.1: these platforms have not been measured yet. If you did not choose a generation, it installs 2.0 by itself, explains the reason in the log and repeats it in the final report. Where the installed `awg` tools or the kernel module do not understand 3.1 parameters, it switches to 2.0 if the module accepts the 2.0 set, and otherwise stops and says what to fix (for old tools, the package to upgrade). An explicit `--protocol=3.1` on an unsuitable machine stops the install and names the reason. **Servers that already run** keep their generation: updating the scripts and `manage` do not change it. Moving from 2.0 to 3.1 means removing the install (`--uninstall`) and installing again, and every client profile is issued again. Back from 3.1 to 2.0 works the same way: `--uninstall` (it removes the server and its 3.1 profiles, keeping a backup copy by default), then an install with `--protocol=2.0` and new profiles for every client. The installer prints the generation in the final report, on the "Protocol generation" line, and later `sudo bash /root/awg/manage_amneziawg.sh check` shows it ("Installation protocol generation"). Versions of the tools and of the loaded module: ```bash awg --version # tools version cat /sys/module/amneziawg/version # version of the loaded module ``` The detailed write-up - what changes on the wire, what has to match between server and client, and what the 3.1 profile is made of - lives in [ADVANCED.en.md](ADVANCED.en.md#awg3-adv). --- ## ⚖️ AmneziaWG vs WireGuard | | WireGuard | AmneziaWG 3.1 | |---|---|---| | **DPI detection** | Fingerprinted by fixed packet sizes and magic bytes | Hard to fingerprint: encrypted headers (`HeaderProtectionKey`), padding inside and outside the encryption, junk packets and the `I1` concealment packet | | **Blocked in** | China, Russia, Iran, UAE, Turkmenistan | Nothing to block by fixed signature - there is none. Address and UDP port blocking remain: another port or `--mobile` can help | | **Server setup** | Manual: keys, iptables, sysctl, systemd | One command, 20 min, fully automatic | | **Hardening** | DIY: UFW, Fail2Ban, sysctl | Automatic: firewall + brute-force protection + kernel tuning | | **Client management** | Edit configs by hand, restart | `add`/`remove`/`list`/`stats` with hot-reload | | **Temporary access** | Not built-in | `--expires=7d` with auto-cleanup | | **Server requirements** | - | Same - any $3-5/mo VPS, 512 MB RAM and up (1 GB is comfortable) | | **Speed overhead** | Baseline | Kernel module: encryption and obfuscation run in kernel space, no userspace round-trip | > On speed: on a server with a single shared vCPU the CPU becomes the bottleneck, because encryption and obfuscation run on that same core. Diagnostics: [FAQ in ADVANCED](ADVANCED.en.md#faq-advanced-adv). > If WireGuard works for you and isn't blocked - keep using it. If it's blocked or throttled - AmneziaWG 3.1 is the drop-in replacement. --- ## ⚙️ CLI Installer vs Web Panels > **The goal: set up a VPN on a cheap VPS in 20 minutes.** The script doesn't pull in Docker, a web server, or a database. After installation only AWG and the firewall are running - minimal footprint, maximum resources for VPN. | | This project (CLI) | Docker-based web panels | |---|---|---| | **AWG module** | Kernel module - runs at kernel level | Userspace inside a container | | **Server requirements** | Any VPS with 512 MB RAM | Needs PHP/Python, database, web server, Docker | | **Attack surface** | SSH + UDP VPN port | + HTTP panel, database, Docker | | **Installation** | Single command on the server, 20 minutes | docker-compose + giving SSH access to the panel | | **After reboot** | Resumes installation from the same step | Depends on container and database state | | **Web interface** | ❌ None, SSH only (managed via the `manage` script) | ✅ GUI, browser-based management | | **Multiple protocols** | AmneziaWG only | WireGuard, OpenVPN, VLESS and others | > Need a VPN without GUI on a dedicated server - this project. Need a web panel with multiple protocols - look for Docker-based solutions. --- ## 🔧 Comparison with similar tools There are a few other ways to get AmneziaWG running. Each picks a different trade-off: | Tool | Path | Best for | |---|---|---| | **This installer** | SSH + one bash command | Headless VPS, single-purpose box, no Docker or panel, ARM prebuilts | | **[wiresock/amneziawg-install](https://github.com/wiresock/amneziawg-install)** | SSH + bash, optional native web panel and obfuscation proxy (Rust) | Want a browser panel without Docker, or traffic masking via a separate service | | **[wg-easy](https://github.com/wg-easy/wg-easy)** | Docker + web UI | Home-lab boxes that already run Docker; want a browser panel for peers. AmneziaWG there is experimental (`EXPERIMENTAL_AWG=true` plus the kernel module on the host); the third line is only on the master branch since 9 September 2026, release v15.4.0 does not have it | | **[Amnezia VPN app](https://amnezia.org/)** | Desktop/mobile GUI, deploys the server side in Docker over SSH | Click-through setup with no terminal; want a graphical client | **Quick pick:** * Frequently add and rotate peers and prefer a browser GUI - a web panel: **wiresock** (native, no Docker) or **wg-easy** (Docker). Note: a panel is an extra always-on service, an open port and ongoing resource use; for a set-and-forget box it is needless overhead. * Cheap or low-spec VPS, ARM (Raspberry Pi, Oracle Ampere) - **this installer**, with ready-made prebuilts and no module-build wait. * One-tap phone import (QR or `vpn://`), time-limited clients (`--expires`), mobile-carrier presets - **this installer**. * Point-and-click setup with no terminal - the **Amnezia VPN** desktop client. **When this project is not your best fit:** * Frequently add and rotate peers and want a browser panel - pick **wiresock** or **wg-easy**. There is no panel here by design: if peers change rarely, an always-on panel only burns server resources, and management is done from the CLI (`manage` add/remove/list) over SSH. * You want resistance to active probing - masking the traffic as another protocol (such as QUIC or DNS): **wiresock** has a separate obfuscation proxy for that (the server-side masking works with any standard client; the full bidirectional capability pairs with their commercial WireSock Secure Connect client). Here the obfuscation lives in the protocol itself - AmneziaWG 3.1 header encryption and padding plus the `I1` concealment packet - and is aimed at everyday mobile DPI, with no separate proxy daemon and no paid client. * You want a graphical client or point-and-click setup with no terminal - the **Amnezia VPN** desktop client. ### How it differs from the official Amnezia app The official Amnezia app is the official graphical client: you install the app, point it at a server, and it deploys the server side in Docker over SSH. Handy when all you want is a GUI. This installer is built for a different goal - to get the most out of a single dedicated VPS as a VPN server. That is where the differences come from: * **No Docker, and none of its overhead.** AmneziaWG runs as a kernel module rather than inside a container. There is no Docker daemon sitting in the background, so RAM and CPU use stay lower. On a cheap VPS that matters a lot, and it does no harm on a bigger one either. * **The whole server is tuned to the hardware.** The script reads the server's RAM, then sets sysctl buffers and swap size and turns on BBR - it wrings the most out of the plan you are paying for. The official app deploys its containers and does not optimize or tune the server itself. * **Smaller attack surface.** Unneeded packages and services are stripped, so the box does one thing - VPN. On top of that: UFW deny-all, Fail2Ban, strict file permissions, and sysctl hardening. * **Fine control over the obfuscation.** A mobile-network preset (`--preset=mobile`), direct access to the AmneziaWG parameters, and field data on carriers and DPI - you can tune it for a specific network or carrier. * **Headless and scriptable.** One SSH command, every parameter as a flag, CLI client management, time-limited guests (`--expires`), QR or `vpn://` import, and prebuilt modules for ARM. The protocol and the DPI resistance are the same - it is the same AmneziaWG protocol underneath. The code is open under the MIT license, it is readable bash you can review before running, and it has 2000+ automated tests. It installs the same upstream AmneziaWG - this is automation and server tuning, not a fork of the protocol. Detailed comparison: [amneziawg-installer vs the official Amnezia app](https://bivlked.github.io/amneziawg-installer/compare/). --- ## ✨ Features * **DPI bypass** - AmneziaWG 3.1 (or 2.0 for older clients) with traffic obfuscation. DPI cannot detect the connection * **One command - working VPN** - from a clean VPS to a running server with client configs and QR codes * **Secure by default** - UFW, Fail2Ban, sysctl hardening, strict file permissions (600/700) * **Easy management** - add/remove clients, temporary clients with auto-removal, traffic stats, backups * **Broad OS support** - Ubuntu 24.04, 26.04 and Debian 13; Debian 12 for moving an existing server across * **x86_64 and ARM** - cloud VPS, Raspberry Pi 3/4/5, ARM64 servers (AWS Graviton, Oracle Ampere, Hetzner); ARM gets AmneziaWG 2.0 * **Mobile network optimization** - `--preset=mobile` for Tele2, Yota, Megafon and other carriers with DPI blocking. Fine-tune with `--jc`, `--jmin`, `--jmax` ([details](ADVANCED.en.md#presets-adv)) * **Optional dual-stack IPv6** - the `--allow-ipv6-tunnel` flag adds IPv6 inside the tunnel next to IPv4 (off by default, [details](ADVANCED.en.md#ipv6-tunnel-adv))
All features * Native key and config generation via `awg` - no Python or external dependencies * Hardware-aware optimization: swap and network buffers tuned to server specs * DKMS - automatic kernel module rebuild on updates * `vpn://` URI for one-tap import into Amnezia Client (`.vpnuri` files) * Per-client traffic statistics (`stats`, `stats --json`) * Temporary clients with auto-removal (`--expires=1h`, `7d`, `4w`, etc.) * Diagnostic report (`--diagnostic`) and full uninstall (`--uninstall`) * All actions logged to `/root/awg/` * Resume after reboot - the script picks up from where it left off * Choice of port, subnet, IPv6 mode, routing mode, and client isolation (`--isolation=on|off`). `--endpoint` flag for servers behind NAT
--- ## 📡 Tested mobile carriers (Russia) The installer tunes AmneziaWG obfuscation for mobile networks with DPI: `--mobile` switches on the mobile preset and port 443/udp in a single flag. If your VPN is unstable on mobile data, use `--mobile` right away on a new server. On a running server this means reinstalling with `--force --mobile`: the obfuscation parameters and the port change, and every client needs its config reissued with `regen`. If the handshake never completes on mobile data, read the [walkthrough](ADVANCED.en.md#no-hs-mobile-adv) first. The configurations below come from user reports in issues and discussions, collected on 2.0 servers (no guarantee: blocking and carrier parameters change over time). The presets and `I1` are set the same way in the 3.1 profile; please share 3.1 results in [Discussions](https://github.com/bivlked/amneziawg-installer/discussions). Reported configurations: - **Yota** - Moscow, `--preset=mobile` - **Tele2** - Moscow (`--preset=mobile`); Krasnoyarsk (`--preset=mobile`; the May 2026 wave needed `I1=`) - **Tattelecom / Letai** - Tatarstan, `--preset=mobile` - **Megafon** - regional networks, `--preset=mobile` + remove the `I1` parameter - **Beeline** - default preset, no flags needed - **Home / wired ISPs** - default preset usually works out of the box Your carrier is not on the list? Try `--preset=mobile`. If that doesn't work - open a thread in [Discussions](https://github.com/bivlked/amneziawg-installer/discussions) or [Issues](https://github.com/bivlked/amneziawg-installer/issues) and I'll add the entry. > Full operator parameter table (Jc, Jmin, Jmax, I1) - in [ADVANCED.en.md → FAQ "connects over cellular only on the third attempt"](ADVANCED.en.md#faq-mobile-unstable-adv). Per-flag overrides via `--jc`/`--jmin`/`--jmax` - in [ADVANCED.en.md → Presets](ADVANCED.en.md#presets-adv). --- ## 🖥️ Requirements * **OS:** A **clean** installation of **Ubuntu Server 24.04 LTS** / **Ubuntu 26.04** / **Debian 13** Minimal. Debian 12 is supported too, but do not pick it for a NEW server - see the compatibility table * **Access:** `root` privileges (via `sudo`) * **Internet:** Stable connection * **Resources:** 512 MB RAM minimum, 1 GB recommended (2+ GB comfortable); minimum ~2 GB disk (3+ GB recommended) * **SSH:** SSH access to the server **OS Compatibility:** | OS | Our pick | Vendor support | Notes | |----|----------|----------------|-------| | Ubuntu 24.04 LTS | ✅ default pick | until 2029-05-31 | The best-tested platform. The HWE kernel 7.0.0-38 is supported: the installer fixes the PPA module source itself ([details](ADVANCED.en.md#kernel-70-backport-adv)) | | Debian 13 (trixie) | ✅ default pick | until 2028-08-09 | Tested. PPA via codename mapping to noble, DEB822 | | Ubuntu 26.04 | ✅ supported | until 2031-05-29 | The PPA publishes packages for it (`resolute`). The PPA module does not build for kernel 7.0.0-38 on its own; the installer fixes its source itself ([details](ADVANCED.en.md#kernel-70-backport-adv)) | | Debian 12 (bookworm) | ⚠️ for migration | regular ended 2026-07-11, Debian LTS until 2028-06-30 | Works and is tested, security updates continue through Debian LTS. PPA via codename mapping to focal. For a new server prefer Debian 13 | | Ubuntu 25.10 (questing) | ❌ not supported since v6.0.0 | ended 2026-07-01, no extension | Out of vendor support, no security updates are published for it. The installer warns about an untested release and asks for confirmation. Move to 26.04 LTS (`do-release-upgrade`, then run the latest installer again) or reinstall on 24.04 LTS | **Architecture support:** | Architecture | Status | Protocol | Platforms | |---|---|---|---| | x86_64 (amd64) | ✅ Fully supported | AmneziaWG 3.1 (on kernel 6.7+, otherwise 2.0) | All cloud VPS | | ARM64 (aarch64) | ✅ Supported | AmneziaWG 2.0 | Raspberry Pi 3/4/5, AWS Graviton, Oracle Ampere, Hetzner | | ARMv7 (armhf) | ✅ Supported | AmneziaWG 2.0 | Raspberry Pi 3/4 (32-bit) | > On ARM, the installer downloads prebuilt kernel modules when available and falls back to DKMS compilation automatically. The 3.1 profile is not issued on ARM yet: the installer sets up 2.0 by itself, and clients need 2.0 support. > ⚠️ **Non-standard SSH port:** The installer usually detects the SSH port automatically. If SSH runs on a non-standard port or autodetection is unavailable, run with `--ssh-port=YOUR_PORT` (comma-separated for several ports). As an extra conservative safeguard you can run `sudo ufw allow YOUR_PORT/tcp` **before** starting the installer. **Clients:** * **Android:** [WG Tunnel](https://github.com/wgtunnel/android) (the 3.1 profile from version **5.6.0**) or the lightweight [AmneziaWG](https://github.com/amnezia-vpn/amneziawg-android) (the 3.1 profile from **3.1.4** on Google Play). Import via the `name.png` QR code; why these two - [which client to choose](#ecosystem) * **All platforms:** [Amnezia VPN](https://github.com/amnezia-vpn/amnezia-client/releases) - full-featured VPN client: the 3.1 profile from version **5.0.1.5**, the 2.0 profile from **4.8.12.7**. Import via `vpn://` URI * **iPhone, iPad, Mac:** [AmneziaWG](https://apps.apple.com/app/amneziawg/id6478942365) (the 3.1 profile from version **3.1.4**, also in the Russian App Store as of October 2026). On iPhone and iPad import via the `name.png` QR code or the `name.conf` file, on Mac via the `name.conf` file * **Windows:** [AmneziaWG](https://github.com/amnezia-vpn/amneziawg-windows-client/releases) - lightweight tunnel manager: the 3.1 profile from version **3.1.0**, the 2.0 profile from **2.0.0**. Import via `.conf` files * **Linux, including a server without a desktop:** `awg-quick` from `amneziawg-tools` - [connecting a Linux machine as a client](ADVANCED.en.md#linux-client-adv) > [Which clients understand 3.1, the full table →](ADVANCED.en.md#client-gen-adv) --- ## 🚀 Hosting Recommendation For a stable, high-throughput VPN server, you need reliable hosting with a good network. **What to look for in a VPS for VPN:** - IPs not flagged as datacenter ranges - lower risk of range-based blocks. - Generous or unlimited traffic and a 1 Gbps+ port. - Your target OS (Ubuntu 24.04 LTS, 26.04 or Debian 13; Debian 12 works too) and root access. I've tested and recommend [**FreakHosting**](https://freakhosting.com/clientarea/aff.php?aff=392). Their **BUDGET VPS** lineup offers excellent value for money. This is an affiliate link: I get a small commission if you order through it, the price for you is the same. Their IPs are not flagged as datacenter - they are not blocked by services that restrict hosting/datacenter IP ranges (unlike Azure and some major clouds). * **Recommended plan:** **BVPS-2** * **Specs:** 2 vCPU, 2 GB RAM, 40 GB NVMe SSD. * **Key advantage:** **10 Gbps** port with **unlimited traffic**. Perfect for VPN! * **Price:** Just **€25 per year** (at time of writing; may change). This configuration is more than enough for comfortable AmneziaWG operation with many connections and heavy traffic. --- ## 🔧 Installation (Recommended Method) Installing AmneziaWG on Ubuntu or Debian comes down to three commands: download the script, run it with `sudo`, and answer a few questions. This method handles interactive prompts and colored output correctly in your terminal. 1. **Connect** to a **clean** server (Ubuntu 24.04 / Ubuntu 26.04 / Debian 13) via SSH. > **Tip:** After creating the server, wait 5-10 minutes for all background initialization processes to complete before starting the installation. 2. **Download the script:** ```bash wget -O install_amneziawg_en.sh https://github.com/bivlked/amneziawg-installer/releases/latest/download/install_amneziawg_en.sh # or: curl -fLo install_amneziawg_en.sh https://github.com/bivlked/amneziawg-installer/releases/latest/download/install_amneziawg_en.sh ``` > Minimal Debian may not ship curl (wget is usually present) - use `wget`. The installer itself adds curl in step 1. 3. **Make it executable:** ```bash chmod +x install_amneziawg_en.sh ``` 4. **Run with `sudo`:** ```bash sudo bash ./install_amneziawg_en.sh ``` *(You can also pass command-line parameters, see `sudo bash ./install_amneziawg_en.sh --help` or [ADVANCED.en.md#install-cli-adv](ADVANCED.en.md#install-cli-adv))* > **Russian version:** For Russian output, use `install_amneziawg.sh`: > ```bash > wget -O install_amneziawg.sh https://github.com/bivlked/amneziawg-installer/releases/latest/download/install_amneziawg.sh > sudo bash ./install_amneziawg.sh > ``` > The Russian version is functionally identical; only user-facing messages and logs are in Russian. > After reboots, resume with the same file: `sudo bash ./install_amneziawg.sh` 5. **Initial setup:** The script will interactively ask for: * **UDP port:** Port for client connections (1-65535). Default: `39743`. * **Tunnel subnet:** Internal VPN network. Default: `10.9.9.1/24`. * **Disable IPv6:** recommended (`Y`). This is IPv6 on the server itself; whether your device's IPv6 goes into the tunnel is decided by the routing mode, see [Device IPv6, `::/0` and the local network](ADVANCED.en.md#client-ipv6-adv). * **Routing mode:** Determines which traffic goes through the VPN. Default `1` (all traffic, `0.0.0.0/0`) - the full-tunnel form clients expect. Mode `2` (Amnezia List + DNS) keeps the private ranges (`10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`) out of the tunnel, but some clients treat such a list as split routing and behave differently. * **Client isolation:** Whether to block traffic between clients inside the VPN. Enabled (`Y`) by default - clients cannot see each other; non-interactive: `--isolation=on|off`. * **Server name:** The server shows up under this name in the Amnezia app on `vpn://` import. Default `AWG Server`; non-interactive: `--server-name=NAME`. * **Package cleanup:** the script lists what it would remove (snapd, unattended-upgrades and others) and asks first. To keep them, answer `n` or pass `--keep-packages`. Obfuscation parameters (on 3.1 together with the header protection key) are generated **automatically** - no action required. 6. **Reboots:** **TWO** reboots are required. The script will ask for confirmation `[y/N]`. Type `y` and press Enter. 7. **Resume:** After each reboot, **run the script again** with the same command: ```bash sudo bash ./install_amneziawg_en.sh ``` The script resumes from where it left off, and earlier questions are not asked again. If UFW is not on yet, one new question comes in the third run: "Enable UFW? [y/N]". Answer `y`: pressing Enter leaves the firewall off, and the server stays without one. With `--yes`, UFW is enabled without asking. 8. **Completion:** After the second reboot and the third script run, you will see the message: `AmneziaWG 3.1 installation and configuration COMPLETED SUCCESSFULLY!` (or `2.0` if the server was installed on it) and a "Protocol generation" line with the reason when the installer picked 2.0 by itself. --- ## 🔏 Verifying a release (optional, best done before running) The installer is signed with a minisign key that the maintainer keeps offline and that never reaches GitHub Actions. Releases carry signatures from v5.29.0 on. ```bash sudo apt install minisign BASE="https://github.com/bivlked/amneziawg-installer/releases/latest/download" wget -O install_amneziawg_en.sh "$BASE/install_amneziawg_en.sh" wget -O install_amneziawg_en.sh.minisig "$BASE/install_amneziawg_en.sh.minisig" minisign -V -P RWQXfpABHIpZPttqrwYrQNHRTk/iLIz4cVh9KkRwAElHP+CoW/NPEysN \ -m install_amneziawg_en.sh -x install_amneziawg_en.sh.minisig ``` Expected: `Signature and comment signature verified`, and on the next line `Trusted comment: amneziawg-installer vX.Y.Z install_amneziawg_en.sh`. The tag must match the latest release on the [releases page](https://github.com/bivlked/amneziawg-installer/releases), and the name must match the file you downloaded. If the check fails, download both files again, since a new release may have come out between the two downloads. If it fails again, do not run the script. **Compare the whole key.** The project public key is `RWQXfpABHIpZPttqrwYrQNHRTk/iLIz4cVh9KkRwAElHP+CoW/NPEysN`. The same key is in `KEYS.txt` at the repository root and in every signed release (v5.29.0 and later). `3E598A1C01907E17` is the key ID, not a fingerprint: another key can carry the same ID, so it proves nothing on its own. Keep your own copy of the key and use it next time. **What the signature covers.** You verify the installer itself. The scripts it fetches later (`awg_common_en.sh`, `manage_amneziawg_en.sh`) are checked against SHA256 hashes built into it, so a signed installer covers them too, as long as `AWG_BRANCH` is left at its default. Not covered: - prebuilt ARM module packages from the `arm-packages` release: their hash sits next to them and only catches a broken download; - packages from the Amnezia PPA: apt checks them with the PPA key; - scripts you replace by hand: repeat the command above with their names. ⚠️ **What this does not give you.** If you copy the key from this page in the same session, the check protects against tampering on the way to you, not against a compromised account: whoever can replace the script can replace this page. It starts to mean something once the key is one you saved earlier. ## 📦 After installation **Where to find client files:** | File | Path | Purpose | |------|------|---------| | `.conf` | `/root/awg/name.conf` | Configuration for client import | | `.png` | `/root/awg/name.png` | QR code of the same `.conf` for AmneziaWG clients | | `.vpnuri` | `/root/awg/name.vpnuri` | `vpn://` URI for Amnezia Client | | `.vpnuri.png` | `/root/awg/name.vpnuri.png` | QR code of the `vpn://` link for the Amnezia VPN app | **Download config to your computer:** ```bash scp root@SERVER_IP:/root/awg/my_phone.conf . ```
Import into WG Tunnel or AmneziaWG on Android, AmneziaWG on iPhone 1. Download the QR code of the config: `scp root@SERVER_IP:/root/awg/my_phone.png .` 2. Open the file on your computer screen 3. On your phone: "+" → the QR code option
Import into Amnezia VPN (phone) via vpn:// URI 1. On the server, run: `cat /root/awg/my_phone.vpnuri` 2. Copy the text and send it to yourself (Telegram, email, etc.) 3. On your phone: Amnezia VPN → "Add VPN" → "Paste from clipboard"
Import into Amnezia VPN via the link QR code 1. Download the QR code of the link: `scp root@SERVER_IP:/root/awg/my_phone.vpnuri.png .` 2. Open the file on your computer screen 3. On your phone: Amnezia VPN → "Add VPN" → "Scan QR code" If the Amnezia VPN scanner does not recognize the code (this happened on Android with version 5.0.3), read it with the phone's regular camera, copy the `vpn://...` text and paste it into Amnezia VPN as in the method above. `my_phone.png` (without `vpnuri` in the name) is the QR code of the `.conf` itself, for an AmneziaWG client; do not scan it in Amnezia VPN.
Import into AmneziaWG for Windows 1. Download the `.conf` file to your computer via `scp` or `sftp` 2. AmneziaWG → Import tunnel(s) from file → select the `.conf` file
**Other files on the server:** * Server configuration: `/etc/amnezia/amneziawg/awg0.conf` * Script settings: `/root/awg/awgsetup_cfg.init` * Management script: `/root/awg/manage_amneziawg.sh` * Shared functions: `/root/awg/awg_common.sh` * Client expiry data: `/root/awg/expiry/` * Logs: `/root/awg/*.log` --- ## 👥 Client Management (`manage_amneziawg.sh`) The `manage_amneziawg.sh` script is downloaded automatically during installation. **Usage:** ```bash sudo bash /root/awg/manage_amneziawg.sh [arguments] ``` Full list: `... help` or [ADVANCED.en.md#manage-commands-adv](ADVANCED.en.md#manage-commands-adv). **Everyday commands:** | Command | Arguments | Description | Restart? | | :-------- | :--------------------- | :----------------------------- | :------: | | `add` | ` [name2 ...] [--expires=DUR] [--allowed-ips=LIST]` | Add client(s) (opt. with expiry and per-client routes) | No (auto) | | `remove` | ` [name2 ...]` | Remove client(s) | No (auto) | | `list` | `[-v] [--json]` | List clients (`-v` for details, `--json` machine-readable with `client_ipv6` and `expires_at`)| No | | `show` | | Run `awg show` | No | | `stats` | `[--json]` | Per-client traffic statistics | No | **Maintenance and recovery:** | Command | Arguments | Description | Restart? | | :-------- | :--------------------- | :----------------------------- | :------: | | `regen` | `[name ...] [--reset-routes]` | Regenerate files (all/listed) | No | | `modify` | ` ` | Modify a client parameter | No | | `backup` | | Create a backup | No | | `restore` | `[file]` | Restore from backup | No | | `check` | | Check server status | No | | `diagnose`| `[--carrier=NAME]` | Diagnostics (opt. per carrier) | No | | `repair-module` | | Rebuild kernel module (DKMS) | Yes | | `restart` | | Restart AmneziaWG service | - | > **💡 Note:** `add` and `remove` commands auto-apply changes via `awg syncconf` - no service restart needed. > **🤖 For scripts and bots:** since v5.21.0 nearly every management command (from `add` to `repair-module`) understands `--json` and replies with a single JSON object, even when something goes wrong - so your script or bot can parse the output without guesswork. `list --json` and `stats --json` still return plain arrays, as before. The format and the strict confirmation mode `AWG_STRICT_CONFIRM=1` are covered in [ADVANCED.en.md → JSON interface](ADVANCED.en.md#json-api-adv), and there is already a Telegram bot built on this interface - [awgram](#ecosystem). ### 📌 Quick Reference ```bash # Installation (English) wget -O install_amneziawg_en.sh https://github.com/bivlked/amneziawg-installer/releases/latest/download/install_amneziawg_en.sh sudo bash ./install_amneziawg_en.sh # Run (+ 2 reboots) # Installation (Russian) wget -O install_amneziawg.sh https://github.com/bivlked/amneziawg-installer/releases/latest/download/install_amneziawg.sh sudo bash ./install_amneziawg.sh # Run (+ 2 reboots) # Client management sudo bash /root/awg/manage_amneziawg.sh add my_phone # Add sudo bash /root/awg/manage_amneziawg.sh add my_iphone --psk # +PresharedKey (Shadowrocket iOS/macOS) sudo bash /root/awg/manage_amneziawg.sh remove my_phone # Remove sudo bash /root/awg/manage_amneziawg.sh list # List sudo bash /root/awg/manage_amneziawg.sh list --json # List as JSON (for scripts) sudo bash /root/awg/manage_amneziawg.sh regen # Regenerate # Temporary client (7 days) sudo bash /root/awg/manage_amneziawg.sh add guest --expires=7d # Traffic statistics sudo bash /root/awg/manage_amneziawg.sh stats sudo bash /root/awg/manage_amneziawg.sh stats --json # Maintenance sudo bash /root/awg/manage_amneziawg.sh check # Diagnostics sudo bash /root/awg/manage_amneziawg.sh backup # Backup sudo bash /root/awg/manage_amneziawg.sh restart # Restart ``` --- ## ℹ️ Additional Information For detailed information on configuration, security settings, AmneziaWG 3.1 and 2.0 parameters, management commands, technical details, and more, see **[ADVANCED.en.md](ADVANCED.en.md)**. For the changelog, see **[CHANGELOG.en.md](CHANGELOG.en.md)**. For the roadmap and priorities, see **[docs/ROADMAP.md](docs/ROADMAP.md)**. For a two-server cascade with a split exit for Russian and foreign traffic (split-tunnel), see **[CASCADE.en.md](CASCADE.en.md)**. For selectively routing the Russian segment through Cloudflare WARP via a BGP feed on a single server, see **[WARP-RU.en.md](WARP-RU.en.md)**. --- ## ❓ FAQ > **In this section:** install and updates, connecting clients, mobile networks, choosing a host and migrating, security and parameters. Expand the relevant question below.
Q: How do I install AmneziaWG 3.1 on my own server? A: On a clean x86_64 VPS with Ubuntu 24.04, 26.04 or Debian 13, with the three commands from the Quick Start: download install_amneziawg_en.sh from the latest release and run it with sudo bash. The 3.1 profile is the default and runs as a kernel module, without Docker; on ARM and on stock Debian 12 the installer picks 2.0 by itself, and the 3.1 section lists the other cases. Expect two reboots: answer y each time it asks "Reboot now?", and after each reboot log in again and repeat the last command. The other route is the official Amnezia VPN app, which deploys the server in Docker; the comparison shows how the two differ.
Q: Will it survive a kernel update? A: On a regular DKMS install, yes: the module is rebuilt at the next boot; check with dkms status. On ARM with a prebuilt module, no: after a kernel change the tunnel will not come up by itself. The standard fix is to run the installer again (sudo bash ./install_amneziawg_en.sh --force), which installs the module for the new kernel; it is a full run with two reboots.
Q: How do I completely uninstall AmneziaWG? A: Download the installer script (if you don't have it) and run: sudo bash ./install_amneziawg_en.sh --uninstall.
Q: Clients can't connect - what should I do? A: 1. Check status: sudo bash /root/awg/manage_amneziawg.sh check. 2. Check firewall: sudo ufw status verbose. 3. Verify client config. 4. Check logs: sudo journalctl -u awg-quick@awg0 -n 50. 5. Make sure the client understands the server generation (the "Protocol generation" line in the installer final report, or "Installation protocol generation" in the check output): 3.1 needs Amnezia VPN >= 5.0.1.5, AmneziaWG >= 3.1.0 on Windows and >= 3.1.4 on Android and iOS, or WG Tunnel >= 5.6.0 on Android, 2.0 needs Amnezia VPN >= 4.8.12.7 or AmneziaWG >= 2.0.0.
Q: Why did I get AmneziaWG 2.0 instead of 3.1? A: The installer issues the 3.1 profile only on x86_64 with kernel 6.7 or newer, a deliberately cautious choice for platforms that have not been measured yet. So on ARM (Raspberry Pi, Oracle Ampere, Hetzner CAX) and on a stock Debian 12 (kernel 6.1) it sets up 2.0 by itself. It also switches to 2.0 when the installed awg tools or kernel module do not understand 3.1 parameters (or stops and says what to fix). It names the reason in the final report. For 3.1 you need an x86_64 server with Ubuntu 24.04 / 26.04 or Debian 13. A server installed before version 6.0.0 stays on 2.0 after an update too: the move is --uninstall and a fresh install with new profiles for every client. Copy a backup off the server first: --uninstall deletes /root/awg/. Details in ADVANCED.en.md.
Q: How do I connect a Linux machine, including a server without a desktop? A: With awg-quick from amneziawg-tools: put the client file in place as /etc/amnezia/amneziawg/awg0.conf and bring the tunnel up with sudo awg-quick up awg0. For a 3.1 profile, the module (or amneziawg-go) and the tools on the client have to support 3.1 too. Step by step: ADVANCED.en.md → Connecting a Linux machine as a client.
Q: Handshake completes but no traffic flows - what's wrong? A: A common cause is the split-tunneling AllowedIPs gotcha during manual customization. If you want to ping or SSH to the server by its inner tunnel IP (10.9.9.1 in the default subnet), add the tunnel subnet (default 10.9.9.0/24, or your custom one if you changed --subnet) to the client's AllowedIPs. Otherwise the client does not route traffic to the server even from inside the tunnel. The --route-all mode (full tunnel 0.0.0.0/0, the default) covers the subnet automatically; --route-amnezia (Amnezia List) and --route-custom= do not, add it explicitly. See ADVANCED.en.md → AllowedIPs.

Separate from the routing mode: by default clients are isolated from each other on the server (a FORWARD awg0→awg0 DROP rule), even if both are in the same mode. To let devices see each other inside the VPN, set --isolation=off at install time - the server drops the block, and the tunnel subnet is added to clients' AllowedIPs automatically. See ADVANCED.en.md → Client Isolation.
Q: Can I make Russian traffic go directly while the rest exits abroad? A: Yes, via a two-server cascade: the client connects to an entry server (ideally in Russia), Russian traffic exits directly from it, and everything else goes through a second server abroad. The split is on the server side, nothing special is needed on the client. Step-by-step guide in CASCADE.en.md.
Q: Can I use this with AWG 1.x clients? A: No. AWG 1.x clients understand neither the 3.1 profile nor the 2.0 one: a client has to support the server generation - 3.1 by default, or 2.0 if the server was installed on it. For AWG 1.x, use the legacy/v4 branch.
Q: Config import error "Invalid key: s3" - what's wrong? A: You're using an outdated version of amneziawg-windows-client (< 2.0.0). Update to version 2.0.0+ which supports AWG 2.0; a 3.1 server needs version 3.1.0 or newer. Alternatively, use Amnezia VPN >= 4.8.12.7, or >= 5.0.1.5 for 3.1.
Q: How do I update the scripts to a newer version? A: No server reinstall is needed: replacing the two scripts in /root/awg/ is enough. Download them into a temporary directory, verify the signatures, and only then replace the files (this needs minisign: sudo apt install minisign). A plain wget -O over the working file would leave an empty file if the download failed.
  cd "$(mktemp -d)"
  KEY=RWQXfpABHIpZPttqrwYrQNHRTk/iLIz4cVh9KkRwAElHP+CoW/NPEysN
  M=manage_amneziawg_en.sh C=awg_common_en.sh   # Russian version: M=manage_amneziawg.sh C=awg_common.sh
  ok=1 tag=
  for f in "$M" "$C"; do
    wget -q -O "$f"         "https://github.com/bivlked/amneziawg-installer/releases/latest/download/$f" \
      && wget -q -O "$f.minisig" "https://github.com/bivlked/amneziawg-installer/releases/latest/download/$f.minisig" \
      && out=$(minisign -V -P "$KEY" -m "$f" -x "$f.minisig") \
      && t=$(printf '%s\n' "$out" | sed -n "s/^Trusted comment: amneziawg-installer \(v[0-9.]*\) $f\$/\1/p") \
      && [ -n "$t" ] && [ "${tag:-$t}" = "$t" ] || { echo "NOT VERIFIED: $f"; ok=0; break; }
    tag=$t
  done
  [ "$ok" = 1 ] && { old=$(sudo sed -n 's/^SCRIPT_VERSION="\(.*\)"/v\1/p' /root/awg/manage_amneziawg.sh) && [ -n "$old" ] \
    || { echo "NOT VERIFIED: cannot read the installed version from /root/awg/manage_amneziawg.sh"; ok=0; }; }
  [ "$ok" = 1 ] && [ "$(printf '%s\n' "$old" "$tag" | sort -V | tail -1)" != "$tag" ] \
    && { echo "NOT VERIFIED: release $tag is older than the installed $old"; ok=0; }
  [ "$ok" = 1 ] && { sudo install -m 700 "$M" /root/awg/manage_amneziawg.sh \
    && sudo install -m 700 "$C" /root/awg/awg_common.sh && echo "Installed verified release $tag" || echo "NOT FULLY INSTALLED: run the block again"; }
  
If the script printed "NOT VERIFIED", the working files are untouched; "NOT FULLY INSTALLED" means the files were not both replaced, so run the block again. If the installed `manage` predates v5.7.0, it has no version line and the block will refuse: update such a server with the new installer and `--force`. The block only accepts a pair of files from one release that is not older than the installed one, so a tampered "latest release" pointer cannot roll the scripts back to older signed versions. It prints the verified release number: compare it with the releases page.

Since v5.21.0 the script pair is protected against drift: if you update manage but forget awg_common (or the other way around) and the versions diverge, the script stops and shows the exact commands to fetch the other half, instead of throwing strange errors halfway through.
Q: What is the maximum number of clients? A: The default /24 subnet supports up to 253 clients (.2 - .254), which is sufficient for most use cases. Need more? Pass a wider CIDR via --subnet (e.g. /16) to raise the limit.
Q: Which hosting providers work well? A: Any VPS that is a full virtual machine (KVM or similar) on x86_64 with Ubuntu 24.04 LTS / Ubuntu 26.04 / Debian 13 (that is what gets AmneziaWG 3.1; a stock Debian 12 (kernel 6.1) is supported too, but on 2.0 and past regular support - see the compatibility table), root access, and at least 512 MB RAM (1 GB recommended). The installer does not work in a container (OpenVZ, LXC, Docker); for that there is the userspace route in ADVANCED.en.md. Pick providers with clean (non-blacklisted) IPs and unlimited traffic. See the recommendation below.
Q: How do I migrate the VPN to another server? A: 1. Create a backup: sudo bash /root/awg/manage_amneziawg.sh backup. 2. Copy the archive from /root/awg/backups/ to the new server. 3. Install AmneziaWG on the new server. 4. Restore: sudo bash /root/awg/manage_amneziawg.sh restore (interactive selection, or specify the full archive path). 5. Regenerate configs with new IP: sudo bash /root/awg/manage_amneziawg.sh regen. Mind the generation: restore brings the server back to the generation of the backup. If the old server ran 2.0 and the new one was installed on 3.1, it becomes 2.0 after the restore (restore warns about that). If you want to move to 3.1 along the way, do not restore the backup; hand out new profiles to your clients instead.
Q: How do I create a temporary client? A: sudo bash /root/awg/manage_amneziawg.sh add guest --expires=7d. Formats: 1h, 12h, 1d, 7d, 30d, 4w. A cron job checks every 5 minutes and automatically removes expired clients.
Q: What are .vpnuri files? A: .vpnuri files contain vpn:// URIs for one-tap config import into Amnezia Client. Copy the file contents → open Amnezia Client → "Add VPN" → "Paste from clipboard".
Q: Shadowrocket on iOS/macOS does not connect - needs PresharedKey A: The add command has a --psk flag for that: sudo bash /root/awg/manage_amneziawg.sh add my_iphone --psk. The client config will include a PresharedKey = ... line matching the server [Peer]. For existing clients: recreate with the flag (remove + add --psk) or manually - generate the key once (PSK=$(awg genpsk)) and paste the same value into both sides (the server [Peer] for that client and the client's [Peer] for the server); the handshake fails if the values differ. regen preserves an existing PSK across rotation. Details - in ADVANCED.en.md.
Q: iPhone connects but traffic stops after ~10 seconds A: Fixed in v5.16.1 (Issue #42, thanks to @LiaNdrY). The routing mode that was default back then (mode 2, Amnezia List) started with 0.0.0.0/5, and on iOS that block broke the whole route list, so the tunnel stalled after about 10 seconds. On an existing server the simplest fix is to set AllowedIPs = 0.0.0.0/0 in the iOS client config (a plain --force reinstall keeps the stored list). A precise split-tunnel-preserving edit is in ADVANCED.en.md.
Q: Why port 39743? A: It's a random port from the upper range, chosen as the default. You can change it during installation: --port=N (any port 1-65535). On mobile networks where the carrier drops unfamiliar ports, 443/udp often helps - the --mobile flag sets it together with the obfuscation preset.
Q: Is Perl required on the server? A: Perl is used optionally for generating vpn:// URIs (.vpnuri files). If Perl is absent, .conf files are still created normally - you can use them via file import or QR code. Perl is installed by default on Ubuntu and Debian.
Q: Can I manage the server from my own scripts or a Telegram bot? A: Yes. Since v5.21.0 the management commands take the --json flag and reply with a single JSON object even on failure, so the output is safe to parse from any script (list/stats have returned JSON arrays for a long time). I promise not to break the format: new fields may appear, existing ones keep their names and types. For unattended runs there is --yes, and the strict mode AWG_STRICT_CONFIRM=1 makes commands like remove refuse when --yes is missing, instead of quietly going ahead. The format breakdown lives in ADVANCED.en.md → JSON interface. For a real-world example, the awgram Telegram bot runs on exactly this interface.
Q: Is it safe to re-run the installer? Will clients need new configs? A: Yes, it is safe, and no re-issuing is needed. Re-running over an already working service requires the --force flag (or AWG_FORCE_REINSTALL=1) - without it the script reports that AmneziaWG is already installed and changes nothing. With --force the server config is written anew, but the server keys and the obfuscation parameters are taken from the existing setup, and the [Peer] blocks are carried over from the previous config. Every client is preserved, including the default my_phone and my_laptop: the creation loop skips the ones already present in the config. Config files and QR codes handed out earlier stay valid.

There is one exception: passing --mobile, --preset, --jc, --jmin or --jmax regenerates the whole Jc/S/H/I1 set, while --port (and --mobile, which sets 443) changes the port. Either way the old configs stop connecting and have to be re-issued with regen and handed out again. --endpoint changes the address only in configs issued afterwards: the old ones keep the previous address and work as long as it still reaches the server, and they get the new one after regen. Leave those flags off for a plain update.

Most of the time --force is not needed at all: to get the newer management commands it is enough to update the two scripts on the server (see the question above). Re-running the installer itself is only worth it when the installer changed.
Q: AmneziaWG does not connect over mobile data but works on Wi-Fi - what should I do? A: Usually it is either a port the carrier blocks or the shape of the I1 concealment packet. The server tells them apart: while the phone tries to connect, look at sudo tcpdump -ni any udp and sudo awg show.
  • No packets from the phone at all: check the address and port in Endpoint, the firewall and whether the hosting address is blocked. If it is the port, try --mobile (the mobile preset plus port 443/udp); on a running server that is a --force reinstall and reissuing every client config.
  • Packets arrive, but the peer endpoint does not change: S1-S4 or H1-H4 differ between server and client.
  • The endpoint changes and the receive counter grows, but latest handshake stays empty: that is I1. Since v5.33.0 new installs get it in DNS-response shape automatically; on older profiles you edit I1 in the client .conf, the server stays as it is.
The walkthrough with a ready-made line is in ADVANCED.en.md → The handshake never completes on cellular, and common cases are collected in discussion #38.
Q: Why is my AmneziaWG config marked yellow in the Amnezia app? A: It is not an error: the Amnezia app marks second-line AmneziaWG configs in yellow. Those come from 2.0 servers: installed before version 6.0.0, with --protocol=2.0, or where the installer picked 2.0 by itself. The mark on its own does not mean anything is wrong with the connection, and nothing needs redoing because of it. More in the ADVANCED.en.md FAQ.
Q: With AmneziaWG on, my local network disappears or IPv6-only sites do not open - is that expected? A: Yes, that is how the full tunnel works, and it is the default mode: all device traffic, IPv6 included, goes into the VPN. By default IPv6 goes no further than the tunnel, so the device falls back to IPv4. Whether the local network stays reachable is up to the client: AmneziaWG for Windows cuts it off. If you need home devices while the VPN is on, switch the server to the Amnezia mode: reinstall with --force --route-amnezia, then run sudo bash /root/awg/manage_amneziawg.sh regen --reset-routes so the new mode reaches profiles you already handed out. The mode has its own trade-offs, see ADVANCED.en.md → Device IPv6 and the local network.
Q: Can I install AmneziaWG on a Synology NAS? A: Not with this installer: on the DS918+ we checked, DSM 7.4.1 runs kernel 4.4, the module needs 5.15 or newer, and the box has nothing to build it with. AmneziaWG itself can run on Synology manually through the userspace implementation, step by step in ADVANCED.en.md → AmneziaWG on a Synology NAS.
Q: AmneziaWG stopped connecting after an update - what should I check? A: Find out what exactly was updated. If the installer was run again with flags that change the obfuscation parameters or the port, the configs you handed out need reissuing; which flags those are is in the question "Is it safe to re-run the installer?" above. On ARM with a prebuilt module, run the installer again after a kernel upgrade. If the config turned yellow after an Amnezia app update, that is not an error (see the question above). Otherwise start with sudo bash /root/awg/manage_amneziawg.sh check.
> More answers and solutions in **[ADVANCED.en.md](ADVANCED.en.md)**. --- ## 🛠️ Troubleshooting 1. **Logs:** `/root/awg/install_amneziawg.log`, `/root/awg/manage_amneziawg.log` 2. **Service status:** `sudo systemctl status awg-quick@awg0` 3. **AmneziaWG status:** `sudo awg show` 4. **UFW status:** `sudo ufw status verbose` 5. **Diagnostic report:** `sudo bash ./install_amneziawg_en.sh --diagnostic` For a detailed breakdown of the report, see [ADVANCED.en.md](ADVANCED.en.md#diagnostic-report-adv). --- ## 🌐 Ecosystem ### Clients > **Which client should I use?** On Android, [**WG Tunnel**](https://github.com/wgtunnel/android) or the lightweight [**AmneziaWG**](https://github.com/amnezia-vpn/amneziawg-android): in our check on 13 October 2026 both reconnected in under a second and kept the tunnel when the phone moved from Wi-Fi to mobile data. On iPhone, Mac and Windows, the lightweight **AmneziaWG** for your platform (`.conf` import; iPhone and Mac were not part of that check). > [Amnezia VPN](https://github.com/amnezia-vpn/amnezia-client/releases) (>= 5.0.1.5 for a 3.1 server, >= 4.8.12.7 for 2.0) works on all platforms and accepts the `vpn://` link; it is not in the Russian App Store. | Client | Platform | AWG 3.1 | AWG 2.0 | Type | Notes | |--------|----------|:-------:|:-------:|------|-------| | [Amnezia VPN](https://github.com/amnezia-vpn/amnezia-client/releases) | Windows, macOS, Linux, Android, iOS | ✅ >= 5.0.1.5 | ✅ >= 4.8.12.7 | Official | Full-featured, `vpn://` URI; on Android the tunnel did not recover after Wi-Fi was switched off until the app was restarted (5.0.3, 13 Oct 2026); not in the Russian App Store | | [AmneziaWG](https://github.com/amnezia-vpn/amneziawg-windows-client/releases) | Windows | ✅ >= 3.1.0 | ✅ >= 2.0.0 | Official | Lightweight tunnel manager, `.conf` import | | **[AmneziaWG](https://github.com/amnezia-vpn/amneziawg-android)** | Android | ✅ >= 3.1.4 on Google Play | ✅ >= 2.0.0 | Official | **Recommended for Android.** Lightweight tunnel manager, `.conf` and QR import | | [AmneziaWG](https://apps.apple.com/app/amneziawg/id6478942365) | iOS, macOS | ✅ >= 3.1.4 | ✅ | Official | Lightweight tunnel manager, `.conf` import; available in the Russian App Store | | **[WG Tunnel](https://github.com/wgtunnel/android)** | Android | ✅ >= 5.6.0 | ✅ | Third-party, FOSS | **Recommended for Android.** Auto-tunneling, split tunnel; Google Play, IzzyOnDroid | | [WG Tunnel Desktop](https://github.com/wgtunnel/desktop) | Windows, Linux, macOS | ✅ v2 | ✅ | Third-party, FOSS | Same engine as the Android version | | [VeilBox](https://github.com/artem4150/VeilBox) | Windows, macOS | not verified | ✅ | Third-party, FOSS | Also supports VLESS | > Versions with 3.1 support are taken from release notes as of 12 October 2026. [Full client compatibility table →](ADVANCED.en.md#client-compat-adv) ### Configuration Tools | Project | Description | |---------|-------------| | [Junker](https://spatiumstas.github.io/junker/) | AmneziaWG signature generator by @spatiumstas - for manual setup without an installer | | [Any-Tech-ARCHITECT](https://architect.vai-rice.space/) | Obfuscation parameter generator by @Vadim-Khristenko - value selection and validation with a client compatibility matrix ([GitHub](https://github.com/Vadim-Khristenko/Any-Tech-ARCHITECT)) | ### Router Firmware | Project | Platform | Description | |---------|----------|-------------| | [AWG Manager](https://github.com/hoaxisr/awg-manager) | Keenetic (Entware) | Web UI for managing AWG tunnels on Keenetic routers | | [AmneziaWG for Merlin](https://github.com/r0otx/asuswrt-merlin-amneziawg) | ASUS (Asuswrt-Merlin) | AWG 2.0 addon with web UI, GeoIP/GeoSite routing | ### Server Management | Project | Platform | Description | |---------|----------|-------------| | [amneziawg-manager](https://github.com/rockysys/amneziawg-manager) | macOS | Native GUI that drives the server over SSH via the bundled manage script - no web panel or daemons | | [awgram](https://github.com/ekuraev/awgram) | Telegram | Rust bot: add/remove clients, stats, backup - via the bundled manage script | | [amneziawg-installer-tg-bot](https://github.com/blindtechnique/amneziawg-installer-tg-bot) | Telegram | Python bot that runs on the server itself: clients by button, guest access with an expiry, stats, backup - via the bundled manage script | | [amneziawg_dns_adblock](https://github.com/Cueuler/amneziawg_dns_adblock) | Server | DNS ad and tracker blocking for VPN clients by @Cueuler: Blocky on the tunnel address, installed on top of an existing setup, needs the full tunnel (`--route-all`). There is no license file; the author allowed free use in [discussion #237](https://github.com/bivlked/amneziawg-installer/discussions/237#discussioncomment-18605625) |
📰 Featured in **📖 Tutorials & Guides** - [Hetzner Community - Making a website accessible from restricted regions](https://community.hetzner.com/tutorials/making-website-accessible-from-restricted-regions) (cross-link in Resources) - [Debian Forums - HowTo: Install AmneziaWG 2.0 on Debian 12/13](https://forums.debian.net/viewtopic.php?t=166105) - [LowEndTalk - [Tutorial] One-command AmneziaWG VPN server install on Ubuntu / Debian / ARM](https://lowendtalk.com/discussion/217191) - [AVA Hosting - Self-Hosted VPN: Setup AmneziaWG Easily (step-by-step guide built on the installer)](https://ava.hosting/information/amneziawg/) **📰 Articles & Reviews** - [XDA Developers - "I found a self-hosted VPN that works where WireGuard gets blocked"](https://www.xda-developers.com/self-hosted-vpn-works-where-wireguard-gets-blocked/) - [Pinggy - Top 5 Best Self-Hosted VPNs in 2026](https://pinggy.io/blog/top_5_best_self_hosted_vpns/) - [gHacks Tech News - AmneziaWG 2.0](https://www.ghacks.net/2026/03/25/amnezia-releases-amneziawg-2-0-to-bypass-advanced-internet-censorship-systems/) **📋 Listings & Directories** - [VPN Status (RU) - AmneziaWG services and server-side options catalog](https://vpnstatus.site/protocols/amneziawg) - [AlternativeTo - amneziawg-installer (42 alternatives)](https://alternativeto.net/software/amneziawg-installer/about/) - [LibHunt - #1 in Shell VPN category](https://www.libhunt.com/r/amneziawg-installer) **💬 Forums & Communities** - [Qubes OS Forum - AmneziaWG for censored regions](https://forum.qubes-os.org/t/installation-of-amnezia-vpn-and-amnezia-wg-effective-tools-against-internet-blocks-via-dpi-for-china-russia-belarus-turkmenistan-iran-vpn-with-vless-xray-reality-best-obfuscation-for-wireguard-easy-self-hosted-vpn-bypass/39005) - [Lemmy.world /c/selfhosted - amneziawg-installer announce (143 upvotes / 39 comments)](https://lemmy.world/post/45242153)
--- ## 📝 License & Author * **Author:** @bivlked - [GitHub](https://github.com/bivlked) * **License:** MIT - free and open-source (see `LICENSE`) ---

If this project helped you, a ⭐ helps others find it.

↑ Back to top