How this installer differs from the official Amnezia app

Both set up an AmneziaWG server. The official app is a graphical client that deploys the server in Docker. This installer is built for one goal: to get the most out of a single dedicated VPS as a VPN server. Here is what that changes.

What it does differently Quick start

Two approaches to the same protocol

AmneziaWG underneath either way. The difference is how the server is delivered and how far it is tuned.

Official GUI

Official Amnezia app

A graphical client for desktop and phone. You point it at a server and it deploys the server side in Docker over SSH, then manages clients from the app. A convenient official path when a GUI is all you need, and it does not take on host-wide tuning or hardening.

This installer

amneziawg-installer

One SSH command that turns a dedicated VPS into a tuned VPN box. AmneziaWG runs as a kernel module, the whole server is optimized and hardened for the one job, and clients are managed from the command line. No Docker, nothing extra running in the background.

What this installer does differently

Everything here follows from one idea: a lean, fully tuned, single-purpose VPN box you control end to end.

No Docker overhead

AmneziaWG runs as a kernel module, not inside a container, so there is no Docker daemon in the background. RAM and CPU stay free for the tunnel - critical on a cheap VPS and welcome on a bigger one.

The server is tuned to the hardware

The script checks how much RAM the server has, sizes sysctl buffers and swap to match, and enables BBR. It wrings the most out of the plan you pay for, rather than treating host-wide tuning as out of scope.

Smaller attack surface

Unneeded packages and services are stripped, so the box does one thing. On top of that: UFW deny-all, Fail2Ban, strict file permissions, and sysctl hardening. One service to keep an eye on, not a stack.

Fine control over the obfuscation

A mobile-network preset (--preset=mobile), direct access to the AmneziaWG parameters, and field data on carriers and DPI. When an operator or network is awkward, you can tune the obfuscation for it rather than hope a default fits.

Headless and scriptable

One SSH command, every option as a flag, no desktop app required. CLI client management, time-limited guest configs, QR and vpn link import, and JSON output for automation.

ARM prebuilts

Prebuilt kernel modules for Raspberry Pi and for Ubuntu 24.04 and Debian 12/13 ARM64 kernels; where no package matches the running kernel, a DKMS build. The same command picks the right one.

Same protocol, same obfuscation

The differences are in delivery and tuning, not in how well it resists DPI.

It is the same AmneziaWG underneath, with the same obfuscation designed to resist deep packet inspection. This installer sets up the 3.1 profile by default and 2.0 with --protocol=2.0. The installer is open source under the MIT license, it is readable bash you can review before running, and it carries more than 2000 automated tests. It installs the same upstream AmneziaWG - this is automation and server tuning, not a fork of the protocol.

Quick start Full guide

FAQ

How does amneziawg-installer differ from the official Amnezia app?

Both set up an AmneziaWG server. The official app is a GUI that deploys the server side in Docker over SSH. This installer skips Docker and runs AmneziaWG as a kernel module, then tunes and hardens the whole server for a single-purpose VPN - lower overhead, a smaller attack surface, and fine control over the obfuscation.

Does it use Docker on the server?

No, it installs AmneziaWG as a kernel module through DKMS or, on some ARM boards, a matching prebuilt package, so there is no Docker daemon or container stack running in the background. That keeps RAM and CPU use low, which matters most on a cheap VPS but helps on any server.

Does it optimize the server itself?

Yes, the script checks the server's RAM, sizes sysctl buffers and swap to match, and enables BBR. It also strips unneeded packages and services so the box does one job. The container-based official app deploys its containers and does not do this kind of host-wide tuning and hardening.

Can I tune the obfuscation for my carrier or network?

Yes, there is a mobile-network preset, direct access to the AmneziaWG parameters, and field data on DPI behaviour, so you can tune the obfuscation for a specific operator or network.

Is the protocol and security the same?

Yes, it is the same AmneziaWG underneath, with the same obfuscation designed to resist DPI. This installer sets up the 3.1 profile by default and 2.0 with --protocol=2.0. The installer is open source under the MIT license, readable bash you can review before running, and it has more than 2000 automated tests. It installs the same upstream AmneziaWG - automation and server tuning, not a fork of the protocol.

How is it different from other AmneziaWG install scripts?

amneziawg-installer focuses on a fully tuned, single-purpose VPS: deeper server optimization and hardening, mobile-network DPI and CPS tuning, time-limited clients, full Russian and English versions, and no web panel by default. Many other scripts stop at a working tunnel or add a web UI; this one automates the whole server end to end and is tested with more than 2000 automated tests.

How does it differ from wiresock/amneziawg-install?

Both install AmneziaWG from bash. wiresock is a wider stack: an optional native web panel and an optional Rust obfuscation proxy that makes traffic look like another protocol (QUIC, DNS, STUN, SIP) to resist active probing; its server-side masking works with any standard AmneziaWG client, while full bidirectional masking requires WireSock Secure Connect. This project stays a single-purpose installer: the obfuscation lives in the AmneziaWG config itself (header encryption in the 3.1 profile, the I1 concealment packet), tuned for typical mobile-carrier DPI, with no separate proxy daemon and no paid client. It also adds ARM prebuilts, time-limited clients, one-tap vpn:// import, and full Russian and English versions. If you want a browser panel or active-probing resistance built around a separate proxy, wiresock's stack fits; for a simple VPS installer focused on everyday DPI, this project fits.