amneziawg-installer

AmneziaWG 3.1 VPN server in one command

Turn a clean Ubuntu or Debian VPS into a self-hosted, DPI-resistant VPN. No Docker, no web panel, no Linux experience required.

A new install gets AmneziaWG 3.1 by default. Routers whose firmware does not support 3.1 yet (stable KeeneticOS, for one), Hiddify and apps that have not been updated for a long time need 2.0: add --protocol=2.0. On ARM and on kernels older than 6.7 the installer picks 2.0 by itself, and a server that already runs keeps its version. What you get and how to go back to 2.0

Quick start Full guide GitHub 
$ wget -O install_amneziawg_en.sh https://github.com/bivlked/amneziawg-installer/releases/latest/download/install_amneziawg_en.sh
$ chmod +x install_amneziawg_en.sh
$ sudo bash ./install_amneziawg_en.sh

The command always fetches the latest release; all versions are on the releases page. Before running it you can verify the signature. Three commands, two reboots, about twenty minutes to a working VPN.

MIT licensed Ubuntu and Debian x86_64 and ARM64 No Docker, no web panel 2000+ automated tests

What it does

AmneziaWG is WireGuard with traffic obfuscation, so the handshake no longer looks like a standard VPN to deep packet inspection. This script sets up the whole server for you.

You give the command a fresh VPS over SSH. It installs the AmneziaWG kernel module, hardens the firewall, enables forwarding, tunes the system for a single-purpose VPN box, and creates your first client. At the end you get a QR code to scan in WG Tunnel or the AmneziaWG app, and a vpn:// link for Amnezia VPN. Adding another device later is a single command.

Features

Everything a small VPN server needs, set up with sane defaults and no manual config files.

DPI bypass

AmneziaWG 3.1 by default: header encryption and extra padding on top of junk packets, S1 to S4 padding and the I1 concealment packet. The 2.0 profile, with header masking (H1 to H4) instead of encryption, is one flag away.

Hardened by default

UFW firewall with deny-all and SSH rate limiting, Fail2Ban, strict file permissions, and sysctl hardening.

Client management

Add, remove, list, and regenerate clients. QR codes, vpn links for one-tap import, and time-limited guest configs with an expiry date.

IPv6

With the default profile the device IPv6 goes into the tunnel and stops there, so it no longer reaches the internet with its own address. While such a VPN is on, IPv6-only resources are unreachable, and so is the local network over IPv6. The default full tunnel takes the IPv4 local network in as well, and whether it stays reachable is up to the client: if you need home devices while the VPN is on, install with --route-amnezia. For working IPv6 inside the tunnel use --allow-ipv6-tunnel with native IPv6 on the server.

ARM and Raspberry Pi

Prebuilt kernel modules for Raspberry Pi and for Ubuntu 24.04 and Debian 12/13 on ARM64 servers (Hetzner CAX, Oracle Ampere A1, AWS Graviton), with a DKMS build where no package matches. ARM servers get the 2.0 profile.

Survives reboots

A resume-after-reboot state machine. After a kernel upgrade DKMS builds the module for the new kernel on its own; on the ARM prebuilt path, running the installer again installs it.

Scripts and bots can drive it

Most management commands take --json and answer with a single object even when something fails (list and stats return an array). A third-party Telegram bot already runs on it.

Cellular carriers

The --mobile flag turns on a cellular profile and, unless you pass a port yourself, picks 443/udp, because carriers often drop traffic on unusual UDP ports.

How to install AmneziaWG 3.1 on your server

From a clean VPS to a working VPN in three steps.

  1. Rent a clean Ubuntu or Debian VPS and connect over SSH as root.

  2. Run the command above. The script reboots when it needs to. After a reboot, run it again and it resumes from where it stopped.

  3. Download the client files from /root/awg/ on the server (the README shows how), then add them to the app: WG Tunnel or AmneziaWG on Android, AmneziaWG on iPhone (QR code or the .conf file), AmneziaWG on Mac and Windows (the .conf file) (why these). Amnezia VPN takes the vpn:// link instead. For a 3.1 server the app has to support 3.1: which ones do.

For automation, the same script takes --yes --route-all and every other parameter as a flag. The full guide covers VPS choice, ARM notes, troubleshooting, and uninstall.

Supported systems

Tested on clean, minimal server installs. Kernel upgrades are handled automatically through DKMS, and on ARM hosts running a prebuilt module you run the installer again after a kernel upgrade.

Ubuntu 24.04 LTS Debian 13 trixie Ubuntu 26.04 Debian 12 bookworm

For a new server: Ubuntu 24.04 LTS or Debian 13 are the default choice, and Ubuntu 26.04 works too.

Debian 12 installs and works, but it is not a good pick for a new server. Debian 12 left regular support on 11 July 2026; its security updates now come through Debian LTS until 30 June 2028. Its stock 6.1 kernel also gets AmneziaWG 2.0 rather than 3.1. Ubuntu 25.10 is no longer supported since version 6.0.0: its vendor support has ended.

Built for cheap budgets: 1 vCPU, 512 MB of RAM minimum, 2 GB of free disk (3 GB recommended). Both amd64 and arm64.

Why a plain bash script

It runs as a kernel module, with nothing extra sitting between you and the tunnel.

A web panel is worth it only if you add and rotate clients constantly. For most people a VPN server is set once and left alone, so the bash approach keeps the footprint tiny and runs comfortably on the cheapest VPS. The kernel-native module is faster than a userspace tunnel, and there is nothing extra to keep patched. If you do want a UI or a different trade-off, the comparison in the README is honest about when another tool fits better. For a side-by-side with the official Amnezia app, see how it differs.

FAQ

What is AmneziaWG?
A WireGuard fork from the Amnezia team. Plain WireGuard is recognisable from its very first packet, because that packet carries a fixed signature. AmneziaWG removes it: it sends separate junk packets, pads the protocol messages, replaces the fixed identifiers with values drawn from configurable ranges, and can hide the handshake behind an I1 concealment packet. That makes the connection harder to fingerprint, but it is no guarantee against every operator. The installer sets such a server up as a kernel module, so the throughput cost stays minimal.
How do I install AmneziaWG 3.1 on my own server?
You can install AmneziaWG 3.1 on your own server with two commands from amneziawg-installer: take a clean x86_64 VPS with Ubuntu 24.04, 26.04 or Debian 13 and run it as root. Download the script from the latest release with wget -O install_amneziawg_en.sh https://github.com/bivlked/amneziawg-installer/releases/latest/download/install_amneziawg_en.sh and run it with sudo bash ./install_amneziawg_en.sh. Expect two reboots: answer y when it asks "Reboot now?", then log in again and repeat the second command. The 3.1 profile is the default and runs as a kernel module, without Docker; on ARM and on stock Debian 12 the installer picks 2.0 by itself. The other route is the official Amnezia VPN app: it connects to the server over SSH and deploys AmneziaWG in Docker, and you manage clients from the app. The comparison page explains how the two differ.
Is it free?
Yes, the installer is free and open source under the MIT license. You only pay for the VPS, which starts around 3 to 5 dollars a month.
Do I need Linux experience?
No, you do not need Linux experience: you copy one command into an SSH session on a clean VPS. The script handles the kernel module, firewall and forwarding and creates two clients. Their configs and QR codes are saved in /root/awg/ on the server, and the README shows how to get them onto your phone.
Which VPS should I pick?
A clean Ubuntu or Debian VPS with 1 vCPU and at least 512 MB of RAM. It is meant for a dedicated VPS, not a home router or shared hosting. Check separately whether your host gives you an emergency console and whether it actually works: that is the simplest way back in if SSH stops answering, either after a reboot or because of a firewall rule. If there is none, recovery takes much longer: provider support, a snapshot rollback, or a reinstall. And if your SSH listens on a non-standard port, pass it at install time with --ssh-port=PORT. The installer does detect the port on its own, but an unattended --yes install skips the confirmation, so there is nobody left to double-check it.
Does it bypass DPI and censorship?
AmneziaWG adds obfuscation on top of WireGuard to resist the deep packet inspection used in Russia, Iran, China, and on school or corporate networks. A new install gets the 3.1 profile, which also encrypts the packet headers. No method is guaranteed against every operator, but the protocol gives you the obfuscation settings that get through today.
Which AmneziaWG version does the installer set up, 3.1 or 2.0?
The installer sets up AmneziaWG 3.1 unless your server or your clients need 2.0. A new install gets the 3.1 profile on x86_64 with kernel 6.7 or newer: header encryption (HeaderProtectionKey) and extra padding on top of the 2.0 obfuscation. On a kernel older than 6.7 (a stock Debian 12) and on ARM it picks 2.0 by itself and says why in the final report. Clients without 3.1 support, such as routers on stable KeeneticOS, Hiddify and apps that have not been updated for a long time, need a server installed with --protocol=2.0. A server that already runs keeps its version after updates. Switching normally means --uninstall, a new install and new profiles for every client; restoring a backup made on the other generation also changes it, with a warning first.
Does it run on ARM and Raspberry Pi?
Yes. Prebuilt kernel modules exist for Raspberry Pi and for Ubuntu 24.04 and Debian 12/13 on ARM64 servers such as Hetzner CAX, Oracle Ampere A1 and AWS Graviton; where no package matches your kernel, the installer builds the module through DKMS. The same command picks the right path. ARM servers get the AmneziaWG 2.0 profile for now: the third version has not been measured there.
How do I update to a new release?
Download the new release script on the same server and run it with the --force flag. Server keys, clients, and obfuscation settings survive the reinstall, and so does the protocol version: a 2.0 server stays on 2.0. After a kernel update DKMS builds the module for the new kernel on its own. On the ARM prebuilt path, running the installer again installs the module for the current kernel.
Can I drive it from a script or a bot?
Yes, most management commands take --json and answer with a single JSON object even when the command failed, so the reply is always parseable. The exceptions: list and stats return an array, and show and diagnose do not take the flag. New fields show up over time; existing ones do not get renamed. For unattended runs there is --yes, and with AWG_STRICT_CONFIRM=1 a command like removing a client refuses to run when --yes is missing instead of quietly agreeing. A third-party Telegram bot, awgram, already runs on this interface.
AmneziaWG won't connect, though plain WireGuard works?
Almost always an obfuscation or version mismatch, not the network. If plain WireGuard comes up on the same server but AmneziaWG does not, compare the [Interface] parameters on the server and the client. S1-S4 must match: the receiver strips that padding, so a mismatch means the packet is dropped and the handshake never completes. H1-H4 must be compatible: the receiver checks that the value it gets falls inside its own range, so keeping them identical is the simplest choice. In 2.0 they are ranges; in the 3.1 profile they are 1 to 4. A 3.1 server also needs the same HeaderProtectionKey on every client: without it, or with a different key, there is no handshake and often no error either. Jc/Jmin/Jmax, the I1-I5 concealment packets and ContentPaddingAddition do NOT have to match: the other side discards decoy packets, and a node without I1 simply never sends them. Case does matter for I1-I5: uppercase only. Check the versions too: an app without 3.1 support cannot connect to a 3.1 server, and older amneziawg-tools builds cannot speak 2.0. Full walkthrough in the detailed troubleshooting guide.