How to VPN – Setup AmneziaWG (Censorship-Resistant WireGuard Tunnel)

You can setup a censorship resistant WireGuard tunnel called AmneziaWG, this is ideal for those who live in Russia, Iran, China etc where censorship is aggressive and deep inspection of UDP packages occur. The difference between WireGuard and AmneziaWG is that one is predictable and easily censored whilst the other is harder to detect. We will be setting up the latter on your Packetra server.

This article assumes you are already logged into your VPS/Dedicated Server. Don’t have an account with us, feel free to sign up over at our Portal. Once registered check out our selection of VPS and Dedicated Servers.
Already have one? Then feel free to proceed to follow the how-to guide below.

Select your Linux OS to Install AmneziaWG

First, before we start you must select the OS in the tab to which you are installing the AmneziaWG. If your OS is not in the list, you can look online on how to install AmneziaWG for your particular OS flavour.

Find your Interface and Public IP address

First, lets find out the interface and IP address

ip route get 8.8.8.8

Example: 8.8.8.8 via x.x.x.x dev ens18 src y.y.y.y uid 0 – This will give you your IP as well as Interface to which the profile will be built on.

Enable IP Forwarding

Next, we need to enable IP Forwarding, this way, taffic routes between the tunnel and the internet. This settings will persist across reboots.

echo 'net.ipv4.ip_forward=1' > /etc/sysctl.d/99-amneziawg.conf
sysctl -p /etc/sysctl.d/99-amneziawg.conf

Generate Server & Client Keys

First, this command creates one key pair for the server and one for the client, the server is where the software runs from, the client key is for the .conf file you will be using later after downloading AmneziaWG which you can find here

mkdir -p /etc/amnezia/amneziawg && cd /etc/amnezia/amneziawg
umask 077
awg genkey | tee server.key | awg pubkey > server.pub
awg genkey | tee client.key | awg pubkey > client.pub
cat server.key server.pub client.key client.pub

Then your terminal returns the values in this order: server private, server public – client private, client public. Keep the private keys a secret.

Choose obfuscation parameters

These parameters are what disguise the tunnel. Also, they must be identical on the server and the client, and should be unique to your setup only, reusing values from a public guide can itself become a recognisable pattern.

• Jc , Jmin , Jmax – count and size range of junk packets sent before the handshake
• S1 , S2 – junk data added to the handshake messages
• H1 – H4 – randomised packet header values (four distinct numbers)

Below is an Example of a set, you can set your own with your own random values for your production server.

Jc = 7 S1 = 116 H1 = 1634781092
Jmin = 50 S2 = 141 H2 = 1852741901
Jmax = 1000 H3 = 1067291765

Write the server configuration

Create the file below at /etc/amnezia/amneziawg/awg0.conf . Substitute your keys, obfuscation
parameters, WAN_IFACE , and YOUR_PUBLIC_IP. Note: You are not bound to use SNAT, you can definitely use MASQUERADE if you prefer, but for this example, we will use SNAT to send the traffic to the exact outgoing IP address of our choosing.

[Interface]
Address = 10.20.20.1/24
ListenPort = 51820
PrivateKey = SERVER_PRIVATE_KEY
Jc = 7
Jmin = 50
Jmax = 1000
S1 = 116
S2 = 141
H1 = 1634781092
H2 = 1852741901
H3 = 1067291765
H4 = 1975631248

# SNAT tunnelled traffic to the server's public IP — required
PostUp = iptables -t nat -A POSTROUTING -s 10.20.20.0/24 -o WAN_IFACE -j SNAT --to-source
YOUR_PUBLIC_IP
PostUp = iptables -A FORWARD -i %i -o WAN_IFACE -j ACCEPT
PostUp = iptables -A FORWARD -i WAN_IFACE -o %i -j ACCEPT
PostDown = iptables -t nat -D POSTROUTING -s 10.20.20.0/24 -o WAN_IFACE -j SNAT --to-source
YOUR_PUBLIC_IP
PostDown = iptables -D FORWARD -i %i -o WAN_IFACE -j ACCEPT
PostDown = iptables -D FORWARD -i WAN_IFACE -o %i -j ACCEPT

[Peer]
PublicKey = CLIENT_PUBLIC_KEY
AllowedIPs = 10.20.20.2/32

Bring the tunnel up

Next we’re going to bring the tunnel up, to do that we will type the following in our VM

awg-quick up awg0
awg show

awg show should list the awg0 interface, its listening port, all obfuscation parameters, and the registered peer. There is no handshake yet, that appears once a client connects. To start the tunnel automatically at boot:

systemctl enable awg-quick@awg0

Set up the Client

Also, the client device needs the AmneziaWG app, the regular WireGuard app cannot read the
obfuscation parameters. Download the official client:

• Windows, macOS, Linux, Android, iOS — amnezia.org/downloads
• Windows standalone (WireGuard-style) — github.com/amnezia-vpn/amneziawg-windowsclient

Give the client the configuration below. The Jc / S / H block must be exactly the same as the server’s. A single different value stops the handshake with no error message. You can paste it into AmneziaWG or create a .conf file and import from a file.

[Interface]
PrivateKey = CLIENT_PRIVATE_KEY
Address = 10.20.20.2/24
DNS = 1.1.1.1
Jc = 7
Jmin = 50
Jmax = 1000
S1 = 116
S2 = 141
H1 = 1634781092
H2 = 1852741901
H3 = 1067291765
H4 = 1975631248

[Peer]
PublicKey = SERVER_PUBLIC_KEY
Endpoint = YOUR_PUBLIC_IP:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

AllowedIPs = 0.0.0.0/0 routes all client traffic through the tunnel.
PersistentKeepalive = 25 keeps the connection alive through the client’s local network.

Verify the Connection (Public IP & Server Side

Next, activate the tunnel in the client app so you can confirm it is working. You can open a browser and goto a site like WhatIsMyIpAddress. As a result, it should show your Public IP as the IP of the server and not that of your ISP.

You can verify on the server by typing awg show to see the latest handshake and transfer data.

Final Words

You now know how to setup AmneziaWG to obfuscate your traffic better then a standard WireGuard. In particular, this suits those whowho live in territories where ISP’s are aggressively looking into the traffic, they mostly catch WireGuard easily. This is not to say, this is bulletproof for everyone, but this is a much better setup than a typical WireGuard.

Frequently Asked Questions

Why use AmneziaWG instead of regular WireGuard?
Standard WireGuard has a predictable traffic pattern that deep packet inspection can spot and block. AmneziaWG adds obfuscation, such as junk packets and randomized headers, so the traffic is much harder to fingerprint. Choose it when your ISP actively inspects and censors UDP traffic.

My tunnel won’t connect and there’s no error. What’s wrong?
Check your obfuscation parameters first. The Jc, S, and H values must match exactly on both the server and the client. A single mismatched value stops the handshake silently, so no error appears. Compare both configs line by line to find the difference.

Can I use the normal WireGuard app with this?
No. The standard WireGuard app can’t read the obfuscation parameters. You need the AmneziaWG client from amnezia.org/downloads, available for Windows, macOS, Linux, Android, and iOS. Only that app understands the Jc, S, and H settings.

Good to Know
Pick your own random obfuscation values rather than copying them from any guide, including this one. Reused values become a recognizable pattern themselves, which defeats the point of hiding the tunnel. Keep in mind that the Jc, S, and H block is the sensitive part, so store your working config somewhere safe once the handshake succeeds. Also remember your private keys must stay secret, since anyone with them can impersonate your server or client. AmneziaWG is a strong improvement over plain WireGuard in censored regions, but it isn’t a guarantee, so treat it as a much better option rather than a bulletproof one. Run into any issues? Open a support ticket through the client portal and our team will help you.