amneziawg-installer

AmneziaWG 2.0 VPN server in one command

Turn a clean Ubuntu or Debian VPS into a self-hosted, DPI-resistant VPN. No Docker, no web panel, no Linux experience required.

Quick start Full guide GitHub 
$ wget -O install_amneziawg_en.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.16.0/install_amneziawg_en.sh
$ chmod +x install_amneziawg_en.sh
$ sudo bash ./install_amneziawg_en.sh

Pin the latest version from the releases page. Three commands, two reboots, about twenty minutes to a working VPN.

MIT licensed Ubuntu and Debian x86_64 and ARM64 No runtime dependencies 800+ automated tests

What it does

AmneziaWG is WireGuard with traffic obfuscation, so the handshake no longer looks like a standard VPN to deep packet inspection. This script sets up the whole server for you.

You give the command a fresh VPS over SSH. It installs the AmneziaWG 2.0 kernel module through DKMS, hardens the firewall, enables forwarding, tunes the system for a single-purpose VPN box, and creates your first client. At the end you get a QR code and a vpn link for one-tap import into the Amnezia client. Adding another device later is a single command.

Features

Everything a small VPN server needs, set up with sane defaults and no manual config files.

DPI bypass

Full AmneziaWG 2.0 obfuscation: junk packets, header masking (H1 to H4), padding (S1 to S4), and I1 to I5 concealment packets.

Hardened by default

UFW firewall with deny-all and SSH rate limiting, Fail2Ban, strict file permissions, and sysctl hardening.

Client management

Add, remove, list, and regenerate clients. QR codes, vpn links for one-tap import, and time-limited guest configs with an expiry date.

IPv6 dual-stack

Optional dual-stack routing, off by default and enabled with a single flag when you need it.

ARM and Raspberry Pi

Prebuilt kernel modules for Raspberry Pi 3, 4 and 5, Hetzner CAX, Oracle Ampere A1, and AWS Graviton.

Survives reboots

A resume-after-reboot state machine, plus DKMS auto-repair that rebuilds the module after kernel upgrades.

Quick start

From a clean VPS to a working VPN in three steps.

  1. Rent a clean Ubuntu or Debian VPS and connect over SSH as root.

  2. Run the command above. The script reboots when it needs to. After a reboot, run it again and it resumes from where it stopped.

  3. Scan the QR code or open the vpn link in the Amnezia client. You are connected.

For automation, the same script takes --yes --route-all and every other parameter as a flag. The full guide covers VPS choice, ARM notes, troubleshooting, and uninstall.

Supported systems

Tested on clean, minimal server installs. Kernel upgrades are handled automatically through DKMS.

Ubuntu 24.04 LTS Ubuntu 25.10 and 26.04 Debian 12 bookworm Debian 13 trixie

Built for cheap budgets: 1 vCPU, 512 MB of RAM minimum, 5 GB of disk. Both amd64 and arm64.

Why a plain bash script

It runs as a kernel module, with nothing extra sitting between you and the tunnel.

A web panel is worth it only if you add and rotate clients constantly. For most people a VPN server is set once and left alone, so the bash approach keeps the footprint tiny and runs comfortably on the cheapest VPS. The kernel-native module is faster than a userspace tunnel, and there is nothing extra to keep patched. If you do want a UI or a different trade-off, the comparison in the README is honest about when another tool fits better.

FAQ

Is it free?
Yes. The installer is open source under the MIT license. You only pay for the VPS, which starts around 3 to 5 dollars a month.
Do I need Linux experience?
No. You copy one command into an SSH session on a clean VPS. The script handles the kernel module, firewall, forwarding, and the first client, then prints a QR code and a vpn link.
Which VPS should I pick?
A clean Ubuntu or Debian VPS with 1 vCPU and at least 512 MB of RAM. It is meant for a dedicated VPS, not a home router or shared hosting.
Does it bypass DPI and censorship?
AmneziaWG 2.0 adds obfuscation on top of WireGuard to resist the deep packet inspection used in Russia, Iran, China, and on school or corporate networks. No method is guaranteed against every operator, but the protocol gives you the obfuscation settings that get through today.
Does it run on ARM and Raspberry Pi?
Yes. Prebuilt ARM64 modules cover Raspberry Pi 3, 4 and 5, Hetzner CAX, Oracle Ampere A1, and AWS Graviton. The same command picks the right one.
How do I update to a new release?
Download the new release script on the same server and run it with the --force flag. Server keys, clients, and obfuscation settings survive the reinstall. After kernel updates the DKMS module rebuilds automatically on the next boot.