# AmneziaWG AmneziaWG is WireGuard with traffic obfuscation, to get past deep packet inspection. An AmneziaWG monitor works like a [WireGuard](/docs/protocols/wireguard/) monitor: it brings a tunnel up from your client config and connects to the `Endpoint` in its `[Peer]` section. :::tip[New to TunnelHQ?] Start with the [Quick start](/docs/quickstart/). ::: ## Adding an AmneziaWG monitor Paste the config into **Add monitor**, or upload it as a `.conf` or `.wg` file. | Field | Required | Details | | --- | --- | --- | | Config | Yes | The full AmneziaWG config, pasted or uploaded as a `.conf` or `.wg` file. TunnelHQ reads the obfuscation parameters, such as `Jc`, `Jmin`, and `S1`, from it. | The server address read from `Endpoint` appears as **IP Address** in the monitor's settings. ```ini title="awg0.conf" [Interface] PrivateKey = Address = 10.8.0.2/32 DNS = 1.1.1.1 Jc = 4 Jmin = 40 Jmax = 70 S1 = 0 S2 = 0 H1 = 1 H2 = 2 H3 = 3 H4 = 4 [Peer] PublicKey = Endpoint = vpn.example.com:51820 AllowedIPs = 0.0.0.0/0 ``` ## When a check fails The most common failures are **Tunnel unreachable**, **Tunnel established - Internet is stuck**, and, less often, a rejected configuration. - **Tunnel unreachable**: the handshake didn't complete. Check that the server is running, that the UDP port in `Endpoint` is reachable, that the server has this client's public key as a peer, and that the obfuscation parameters match the server's. - **Tunnel established - Internet is stuck**: the handshake worked, but traffic didn't reach the internet. Check the server's routing and NAT, its DNS, and whether its outbound traffic is blocked. - **Couldn't complete this check — the monitor's configuration or credentials were rejected. The server's status is unknown.**: the config couldn't be used. The monitor shows **Unknown**, with no alert. Check the config against one that works in an AmneziaWG client. [What a failed check says](/docs/concepts/monitors/#what-a-failed-check-says) lists every failure message.