Self-host amneziawg-installer
v6.1.1One-command AmneziaWG VPN server that dodges DPI blocks
- Stars
- 1 422
- CPU
- 1 vCPU
- RAM
- 512 MB
- Storage
- 2 GB free disk
- Port
- 39743 (Default UDP ListenPort of the AmneziaWG VPN tunnel interface awg0 (changeable with --port))
What is amneziawg-installer?
amneziawg-installer is a pure-bash provisioning script: point it at a clean VPS running Debian 13 or Ubuntu 24.04/26.04 and it delivers a working AmneziaWG VPN box in roughly twenty minutes, with two reboots along the way. AmneziaWG, the obfuscated fork of WireGuard, hides the handshake from deep packet inspection, so tunnels keep working on networks that block standard WireGuard. Fresh setups land on the 3.1 profile (encrypted headers plus extra padding), while --protocol=2.0 covers routers and older apps, and ARM machines or kernels older than 6.7 fall back to 2.0 automatically. The script builds the module through DKMS from the Amnezia PPA rather than using containers, strips packages a VPN box does not need, applies sysctl and BBR tuning sized to the machine's memory, and turns on UFW with deny-all, SSH rate limiting and Fail2Ban. Client configs, QR codes and vpn:// links end up in /root/awg, and the bundled manage script handles add, remove, list, regen, modify, per-client traffic stats, expiring guest profiles, backups, diagnostics and machine-readable JSON replies for bots. There is deliberately no web UI, and the installer wants root on a dedicated virtual machine, not shared hosting or an OpenVZ/LXC/Docker container. It is MIT licensed by bivlked, signed with minisign since v5.29.0, and covered by automated tests.
Should you self-host amneziawg-installer?
amneziawg-installer scores 58/100 on selfhost.directory (how scoring works) and ranks #23 of 56 in VPN. It has 1 422 GitHub stars.
It shipped 25 stable releases in the past year. The latest, v6.1.1, came out on 22 October 2026. New versions land roughly every 3 days.
Setup is easy: most people get it running in one sitting. It is MIT-licensed and written mostly in Shell.
Its closest alternative on selfhost.directory is Tailscale (84/100, 38 231 stars). It scores higher overall, so compare the two before you pick. See amneziawg-installer vs Tailscale side by side.
Features
- AmneziaWG 3.1 and 2.0 profiles3.1 is only offered on x86_64 with kernel 6.7+; ARM and stock Debian 12 fall back to 2.0.
- ARM and Raspberry Pi supportARM installs get the AmneziaWG 2.0 profile.
- Backup and Restore
- Client management CLI
- DPI-resistant traffic obfuscation
- JSON output for automation
- Kernel-module install without Docker
- Per-client traffic statistics
- QR code and vpn:// config import
- Resume after reboot and DKMS rebuild
- Routing modes and split tunneling
- Server hardening by default
- Time-limited guest clients
amneziawg-installer README
FAQ
AmneziaWG won't connect, though plain WireGuard works?
That is nearly always a parameter mismatch rather than a network problem: S1-S4 and H1-H4 must agree on both ends, and a 3.1 server requires the identical HeaderProtectionKey on every client. Jc/Jmin/Jmax, the concealment packets and ContentPaddingAddition do not have to match.
Can I drive it from a script or a bot?
Yes. Most management commands accept --json and always print one parseable JSON object, there is --yes for unattended runs, and AWG_STRICT_CONFIRM=1 makes destructive commands refuse without it. A third-party Telegram bot already uses this interface.
How do I update to a new release?
Download the newer release script on the same server and run it with --force; keys, clients, obfuscation parameters and the protocol generation are preserved. After a kernel upgrade DKMS rebuilds the module automatically.
Does it run on ARM and Raspberry Pi?
Yes, with prebuilt kernel modules for Raspberry Pi and ARM64 cloud servers, falling back to a DKMS build where no package matches. ARM installations use the AmneziaWG 2.0 profile for now.
Which AmneziaWG version does the installer set up, 3.1 or 2.0?
3.1 on x86_64 with kernel 6.7 or newer; on older kernels and on ARM the installer selects 2.0 by itself and explains why in its report. Clients that lack 3.1 support need a server installed with --protocol=2.0.
Does it bypass DPI and censorship?
AmneziaWG layers obfuscation on WireGuard to withstand DPI such as the systems used in Russia, Iran and China. A new install also gets encrypted packet headers. The docs state plainly that no method is guaranteed against every operator.
Which VPS should I pick?
A dedicated, clean Ubuntu or Debian VPS with 1 vCPU and at least 512 MB RAM, ideally with a working emergency console. If SSH listens on a non-standard port, pass it with --ssh-port during installation.
Do I need Linux experience?
No. You paste one command into an SSH session on a fresh VPS; the script handles the kernel module, firewall, forwarding and initial client profiles, whose files and QR codes are stored in /root/awg.
Is it free?
Yes, the installer itself costs nothing and is MIT licensed; the only expense is the VPS, which the docs put at about 3 to 5 dollars a month.
How do I install AmneziaWG 3.1 on my own server?
Download the release script on a clean x86_64 Ubuntu or Debian server and run it with sudo bash as root. The 3.1 profile is installed by default as a kernel module, and you rerun the same command after each of the two reboots.
What is AmneziaWG?
It is a WireGuard fork by the Amnezia team that removes the fixed packet signature plain WireGuard has, using junk packets, padding, randomized identifiers and an optional concealment packet, which makes the tunnel harder for DPI to fingerprint.
More in Network Security
beelzebubOpen-source, self-hosted deception runtime that turns SSH, HTTP, TCP, Telnet, MCP decoys into honeypots, configured via YAML rules, with LLM replies and Go plugins.
bettercapOpen-source, self-hosted Go framework for network reconnaissance and MITM attacks on WiFi, BLE, HID, CAN-bus and IPv4/IPv6 networks, with a built-in web UI and REST API.
CacheGuard-OSSelf-hosted open-source UTM appliance OS turning x86/x64 machines into complete network security gateways with firewall, VPN, WAF, antivirus, and more.
cactusdcactusd is an open-source, self-hosted daemon that aggregates and serves domain/IP blocklists for DNS-based ad-blocking, updating every 12 hours with a built-in web UI.
circuitbreakerSelf-hosted, open-source firewall for Lightning nodes that limits in-flight HTLCs and applies per-peer rate limits to protect channel liquidity.
cloudflare-allowmeSelf-hosted open-source service that dynamically manages Cloudflare firewall IP allowlists via REST API for securing self-hosted apps.
CrowdSec Blocklist MirrorSelf-hosted, open-source HTTP blocklist mirror exposing CrowdSec decisions in multiple formats for network appliances.
defguardSelf-hosted WireGuard VPN platform bundling an identity provider, per-connection MFA, LDAP/AD sync and firewall ACLs; open-source AGPL core written in Rust.
dnscrypt-proxySelf-hosted, open-source DNS proxy for your machine or router: encrypts queries with DNSCrypt, DoH and ODoH, filters ads/malware, caches and balances resolvers.
docker-adguardMinimal, security-hardened Docker image for self-hosted AdGuard Home ad blocking. Runs rootless, distroless from scratch, with health checks and CVE scanning.
docker-ipsec-vpn-serverSelf-hosted IPsec VPN server in a ~19 MB Alpine Docker image with L2TP, Cisco IPsec and IKEv2, auto-generating credentials and client profiles.
endlessh-goendlessh-go is a self-hosted, open-source Go SSH tarpit that traps brute-force attackers while exporting Prometheus metrics for a Grafana dashboard.
0 comments