Skip to content
Get started

AmneziaWG server on a VPS

AmneziaWG is a WireGuard fork that removes the recognisable signatures of its traffic, so DPI systems do not spot the tunnel and cut it. Three ways to run your own server: the 3x-ui panel from the bot, the AmneziaVPN app, or by hand.

Install 3x-ui with AmneziaWG

Updated · 3x-ui installs from the bot in about 6 min

What AmneziaWG is

WireGuard has fixed headers and predictable packet sizes: Init is exactly 148 bytes, Response 92, Cookie 64. DPI recognises the protocol by that signature and drops the connection.

AmneziaWG changes how the packets look, not the cryptography: key exchange and encryption are the same as in WireGuard. Version 3.1 was built in response to widespread blocking in Russia in June and July 2026 — it also hides service fields and varies timings. According to Amnezia, AmneziaWG 2.0 and 1.5 are already vulnerable to blocking.

WireGuard and AmneziaWG
AspectWireGuardAmneziaWG
Message type in the headerFixedA random value from the H1–H4 ranges, or Header Protection (3.1)
Handshake packet sizes148, 92 and 64 bytesPlus random S1–S4 prefixes
Before the handshakeNothing extraI1–I5 signature packets that imitate QUIC, DNS or SIP, and Jc junk packets of Jmin–Jmax bytes
TimersFixedRandom values from ranges (3.1)
CryptographyNoise_IK, Curve25519, ChaCha20-Poly1305The same — the WireGuard core is unchanged
TransportUDPUDP

With the masking parameters turned off, an AmneziaWG config is fully compatible with WireGuard.

Which VPS you need

Amnezia’s server requirements for an install with AmneziaVPN. The minimum is enough for a few devices.

System
Ubuntu 22.04 / 24.04 or Debian 12 / 13 officially; both are in our OS catalog
Resources
1 core, 1 GB RAM, 10 GB SSD; for 10+ simultaneous connections, 2 vCPU and 2 GB RAM
Network
A public IPv4 — the app does not connect over IPv6; every VPS of ours has its own IPv4, and an IPv6 /64 is free
Platform
x86-64 and KVM virtualization, OpenVZ and LXC containers won’t work; every VPS of ours runs on KVM

Plans that fit

The cheapest plans for Amnezia’s minimum (1 vCPU, 1 GB RAM, 10 GB) and for 10+ simultaneous connections (2 vCPU, 2 GB RAM, 10 GB) in the locations that have servers right now.

  • Minimum · 1 vCPU, 2 GB RAM, 10 GB

    DE-R9-1

    Germany, Frankfurt

    $3.14/mo

    $0.11 for 24 hours · $0.79 for 7 days

    CPU
    1 × vCPU Ryzen 9950x
    Memory
    2 GB DDR5
    Disk
    10 GB NVMe
    Port
    25 Gbps
    Install with this plan

    Pick 3x-ui at the “Scripts” step when you order the server.

  • 10+ connections · 2 vCPU, 3 GB RAM, 45 GB

    DE-R9-3

    Germany, Frankfurt

    $6.50/mo

    $0.23 for 24 hours · $1.63 for 7 days

    CPU
    2 × vCPU Ryzen 9950x
    Memory
    3 GB DDR5
    Disk
    45 GB NVMe
    Port
    25 Gbps
    Install with this plan

    Pick 3x-ui at the “Scripts” step when you order the server.

  • Minimum · 1 vCPU, 2 GB RAM, 10 GB

    PL-R9-1

    Poland, Warsaw

    Lowest price

    $2.79/mo

    $0.10 for 24 hours · $0.70 for 7 days

    CPU
    1 × vCPU Ryzen 9950x
    Memory
    2 GB DDR5
    Disk
    10 GB NVMe
    Port
    5 Gbps
    Install with this plan

    Pick 3x-ui at the “Scripts” step when you order the server.

  • 10+ connections · 2 vCPU, 3 GB RAM, 45 GB

    PL-R9-3

    Poland, Warsaw

    $4.63/mo

    $0.17 for 24 hours · $1.16 for 7 days

    CPU
    2 × vCPU Ryzen 9950x
    Memory
    3 GB DDR5
    Disk
    45 GB NVMe
    Port
    5 Gbps
    Install with this plan

    Pick 3x-ui at the “Scripts” step when you order the server.

The port in Germany is 25 Gbps, in Poland 5 Gbps; the minimum plan there costs $0.35 more a month. Traffic is unlimited by volume everywhere.

AmneziaWG via 3x-ui in one click

The bot has no separate AmneziaWG script, but AmneziaWG is built into the 3x-ui panel. It runs inside the panel process — amneziawg-go over a gVisor network stack in user space — so no kernel module, DKMS or extra packages are needed. Client traffic goes through Xray routing, with per-client statistics.

  1. 01

    Order a VPS with 3x-ui

    The install button on this page opens the bot with the 3x-ui script. Pick a plan and Ubuntu 22.04 or 24.04 and pay for the server.

  2. 02

    Get the panel details

    The bot installs the latest 3x-ui release and issues a Let’s Encrypt certificate for the server’s domain. When it is done, it sends the panel address (Access URL), login and password; a copy is in /root/info.txt.

  3. 03

    Add an AmneziaWG inbound

    In Inbounds, create a connection with the AmneziaWG protocol and set the port and tunnel subnet, for example 10.8.1.0/24.

  4. 04

    Keep the default obfuscation

    The panel generates a random Jc, Jmin/Jmax, S1–S4, H1–H4 and I1 set; the Regenerate button makes a new one. No need to edit the values by hand: overlapping H1–H4 or S1 + 56 = S2 keep the interface from coming up.

  5. 05

    Add clients

    Each client gets its own keys and tunnel address. Download the .conf or copy the vpn:// link from the client list — the AmneziaWG and AmneziaVPN apps import them. Version 3.1 parameters need an app that supports 3.1.

  6. 06

    Optional: kernel mode

    The embedded mode stays the default. If you want the kernel module, install it with the panel command and turn on Kernel mode for a specific inbound. Traffic then bypasses Xray: no Xray routing, per-client IPv6 or port forwarding.

    Code
    sudo /usr/local/x-ui/x-ui install-awg-kernel

AmneziaWG via the AmneziaVPN app

AmneziaVPN installs the VPN on the server for you — no terminal and no commands. All it needs is SSH access: the bot sends the IP address and the root password once the server is created.

  1. 01

    Buy a VPS with Ubuntu or Debian

    AmneziaVPN officially supports Ubuntu 22.04, 24.04 and Debian 12, 13. No script is needed at checkout: nothing has to be preinstalled on the server.

  2. 02

    Install AmneziaVPN

    Download the app from the official download page — there are versions for Windows, macOS, Linux, Android and iOS. Update it to the latest version before you set up the server.

  3. 03

    Add your server

    Click ➕ or Get Started and choose Self-hosted VPN. Enter the server IP address, the username root and the password.

  4. 04

    Choose the installation type

    Automatic installs only AmneziaWG, Manual installs one protocol of your choice. Click Continue: the app creates a ready connection with full access to the server.

  5. 05

    Change the port

    AmneziaWG is installed on a random port, and some ISPs block UDP on high ports. The documentation recommends switching right away to a free port up to 9999, for example 585 or 1234.

By hand: the kernel module on Ubuntu

A manual install is for people who are confident with Linux: the Amnezia documentation itself warns that without understanding kernel headers and third-party repositories you are better off with the app. Update the system first; if the update brought a new kernel, reboot the server.

  1. 01

    Install the dependencies

    You need the headers of the running kernel — the module is built for it.

    Code
    sudo apt update && sudo apt install -y software-properties-common python3-launchpadlib gnupg2 linux-headers-$(uname -r)
  2. 02

    Add the Amnezia PPA

    Code
    sudo add-apt-repository ppa:amnezia/ppa
  3. 03

    Check the package

    The output should have a Candidate line with a version. If it shows (none), run sudo apt update and check again.

    Code
    apt-cache policy amneziawg
  4. 04

    Install AmneziaWG

    The amneziawg package pulls in the amneziawg-dkms module and the amneziawg-tools utilities — the awg and awg-quick commands.

    Code
    sudo apt install -y amneziawg
  5. 05

    Check the module

    The command should show the filename and version. Module amneziawg not found means the module was not built for the running kernel.

    Code
    modinfo amneziawg

The kernel module on Debian

Debian uses the same PPA. The official guide adds the key with apt-key, and Debian 13 no longer has that command — there, AmneziaVPN or amneziawg-go is the easier route.

  1. 01

    Install the dependencies

    Code
    sudo apt update && sudo apt install -y software-properties-common python3-launchpadlib gnupg2 linux-headers-$(uname -r) curl
  2. 02

    Add the repository

    The repository key, the sources and a package list update.

    Code
    sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 57290828
echo "deb https://ppa.launchpadcontent.net/amnezia/ppa/ubuntu focal main" | sudo tee /etc/apt/sources.list.d/amneziawg.list
echo "deb-src https://ppa.launchpadcontent.net/amnezia/ppa/ubuntu focal main" | sudo tee -a /etc/apt/sources.list.d/amneziawg.list
sudo apt update
  3. 03

    Install and check

    As on Ubuntu: apt-cache policy amneziawg should show a Candidate, and after the install modinfo amneziawg shows the module details.

    Code
    sudo apt install -y amneziawg
modinfo amneziawg

Without the kernel module: amneziawg-go

amneziawg-go is the user-space implementation of AmneziaWG — the same one 3x-ui uses. No kernel module or DKMS needed. On its own the program only creates the interface; the amneziawg-tools utilities configure it.

  1. 01

    Install Git, Go and the build tools

    Code
    sudo apt install git
sudo apt-get update
sudo apt install golang-go build-essential
  2. 02

    Build and install amneziawg-go

    On older distribution releases the build may fail because Go is too old — install a current one following the official Go instructions and run make again.

    Code
    git clone https://github.com/amnezia-vpn/amneziawg-go
cd amneziawg-go
make
sudo make install
amneziawg-go --version
  3. 03

    Build amneziawg-tools

    awg and awg-quick build with nothing but a C compiler. awg-quick starts amneziawg-go by itself when there is no kernel module.

    Code
    git clone https://github.com/amnezia-vpn/amneziawg-tools
cd amneziawg-tools/src
make
sudo make install

Server config and the first client

The config is the WireGuard format plus the obfuscation parameters. awg-quick awg0 reads /etc/amnezia/amneziawg/awg0.conf. Run the commands below as root.

  1. 01

    Generate the keys

    A key pair for the server and one for the first client. Never share the private keys.

    Code
    mkdir -p /etc/amnezia/amneziawg && cd /etc/amnezia/amneziawg
umask 077
awg genkey | tee server.key | awg pubkey > server.pub
awg genkey | tee client.key | awg pubkey > client.pub
  2. 02

    Write the server config

    Save it as /etc/amnezia/amneziawg/awg0.conf. The module recommends Jc from 4 to 12, Jmin 8, Jmax 80, S1 and S2 from 15 to 150 with S1 + 56 ≠ S2, and distinct H1–H4 from 5 to 2147483647. Every parameter except Jc, Jmin and Jmax must match on the server and the clients. A port up to 9999 for the same reason as in AmneziaVPN.

    Code
    [Interface]
PrivateKey = SERVER_PRIVATE_KEY
Address = 10.8.1.1/24
ListenPort = 1234
Jc = 4
Jmin = 8
Jmax = 80
S1 = S1_VALUE
S2 = S2_VALUE
H1 = H1_VALUE
H2 = H2_VALUE
H3 = H3_VALUE
H4 = H4_VALUE

[Peer]
PublicKey = CLIENT_PUBLIC_KEY
AllowedIPs = 10.8.1.2/32
  3. 03

    Turn on IPv4 forwarding

    For clients to reach the internet through the server you need packet forwarding and NAT of the tunnel subnet to the external interface — as with plain WireGuard. 3x-ui and AmneziaVPN set this up for you.

    Code
    echo "net.ipv4.ip_forward = 1" > /etc/sysctl.d/99-amneziawg.conf
sysctl --system
  4. 04

    Start the interface

    The awg-quick@awg0 service brings the tunnel up and starts it after every reboot. Open the UDP port from ListenPort in the firewall.

    Code
    systemctl enable --now awg-quick@awg0
awg show
  5. 05

    Build the client config

    The same obfuscation parameters, the client address and the server public key. Import the file into the AmneziaWG app.

    Code
    [Interface]
PrivateKey = CLIENT_PRIVATE_KEY
Address = 10.8.1.2/32
DNS = 8.8.8.8, 8.8.4.4
Jc = 4
Jmin = 8
Jmax = 80
S1 = S1_VALUE
S2 = S2_VALUE
H1 = H1_VALUE
H2 = H2_VALUE
H3 = H3_VALUE
H4 = H4_VALUE

[Peer]
PublicKey = SERVER_PUBLIC_KEY
Endpoint = SERVER_IP:1234
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

What to connect with

A config works in a client that supports the protocol version the file was issued for.

What to connect with
AppPlatformsWhat it doesDownload
AmneziaWGAndroid 7+, iOS 15+, macOS 12+, WindowsImports a .conf; unofficial RomikB builds cover Windows 7/8
AmneziaVPNWindows, macOS, Linux, Android, iOSInstalls the server over SSH, shares access, imports vpn://
awg-quickLinuxA client .conf with amneziawg-tools, no graphical interface

Common AmneziaWG errors

  • The VPN connects but sites do not open

    Check your internet without the VPN first: under whitelist restrictions only approved sites open. Amnezia suggests a speed test on nperf.com to a foreign server — if it fails, the protocol is not the problem.

  • The server is unreachable even over SSH

    If neither SSH nor the AmneziaVPN management section opens from the same connection, your ISP has most likely blocked the server IP. Changing the IP through the hosting support helps.

  • AmneziaWG 2.0 stopped working

    Versions 2.0 and 1.5 are vulnerable to blocking. Update AmneziaVPN to 5.0.2.1 or later, remove the protocol from the server and install it again — you get 3.1. This removes the users, so the keys have to be issued again.

  • The ISP blocks UDP

    Some ISPs block UDP on high ports. Move AmneziaWG to a free port up to 9999, for example 585 or 1234.

  • The 3.1 signature is blocked

    Replace the I1 value in the AmneziaWG connection settings in the app — only that device changes, no need to recreate users. Amnezia’s troubleshooting page gives a ready string.

  • Guest access shows Not installed

    The AmneziaWG 3.1 connection was created in AmneziaVPN older than 5.0.1.5. Update the app and share access again.

  • The 3x-ui inbound does not come up

    This happens after editing the obfuscation by hand: H1–H4 overlap or S1 + 56 = S2. Click Regenerate and the panel creates a valid set.

  • Module amneziawg not found

    The module was not built for the running kernel. Install linux-headers-$(uname -r), reboot after a kernel upgrade and reinstall the package. If /tmp is short on space, point AWG_TEMP_DIR to another directory.

AmneziaWG FAQ

No answer here? Message @ExpressHost_SupportBot.

How is AmneziaWG different from WireGuard?

The cryptography is the same — Noise_IK, Curve25519 and ChaCha20-Poly1305. AmneziaWG changes how the traffic looks: random header values, random packet padding, junk packets and signature packets before the handshake. With masking turned off, the config is WireGuard-compatible.

Which install method should I choose?

For a panel with limits and many clients, 3x-ui — the bot installs it for you. For a personal VPN without a terminal, the AmneziaVPN app. For full control over the config, a manual install of the kernel module or amneziawg-go.

Do I need the kernel module?

No. In 3x-ui AmneziaWG runs on the embedded amneziawg-go, and awg-quick starts amneziawg-go by itself when there is no module. The kernel module is an option for a manual install; 3x-ui can turn it on for a single inbound.

What server does AmneziaWG need?

Amnezia asks for KVM virtualization and at least 1 core, 1 GB RAM and 10 GB of disk; for 10+ simultaneous connections, 2 vCPU and 2 GB RAM. All our VPS run on KVM; the cheapest plan that fits is 1 vCPU, 2 GB RAM and 10 GB NVMe for $2.79 a month in Poland.

Which AmneziaWG version should I install?

3.1. According to Amnezia, versions 2.0 and 1.5 are already vulnerable to blocking. 3.1 needs AmneziaVPN 5.0.2.1 or later, and clients need apps that support 3.1.

Does AmneziaWG work over IPv6?

An install with AmneziaVPN needs a public IPv4 on the server: the app does not support IPv6. 3x-ui can give clients IPv6 addresses from your own subnet; our VPS come with a free IPv6 /64.

Is there a traffic limit?

Traffic is unlimited by volume, and DDoS protection is included. Speed is capped by the location port: in Germany 25 Gbps, in Poland 5 Gbps.

Sources

Commands and steps were checked against the Amnezia and 3x-ui documentation and the AmneziaWG repositories on October 26, 2026. What the bot’s 3x-ui install does comes from its install script.

3x-ui with AmneziaWG — in one click from the bot.

Choose a planBuy in Telegram