AmneziaWG

AmneziaWG is WireGuard with traffic obfuscation, to get past deep packet inspection. An AmneziaWG monitor works like a WireGuard monitor: it brings a tunnel up from your client config and connects to the Endpoint in its [Peer] section.

New to TunnelHQ?

Start with the Quick start.

Adding an AmneziaWG monitor

Paste the config into Add monitor, or upload it as a .conf or .wg file.

Field	Required	Details
Config	Yes	The full AmneziaWG config, pasted or uploaded as a .conf or .wg file. TunnelHQ reads the obfuscation parameters, such as Jc, Jmin, and S1, from it.

The server address read from Endpoint appears as IP Address in the monitor’s settings.

awg0.conf

[Interface]
PrivateKey = <client-private-key>
Address = 10.8.0.2/32
DNS = 1.1.1.1
Jc = 4
Jmin = 40
Jmax = 70
S1 = 0
S2 = 0
H1 = 1
H2 = 2
H3 = 3
H4 = 4

[Peer]
PublicKey = <server-public-key>
Endpoint = vpn.example.com:51820
AllowedIPs = 0.0.0.0/0

When a check fails

The most common failures are Tunnel unreachable, Tunnel established - Internet is stuck, and, less often, a rejected configuration.

• Tunnel unreachable: the handshake didn’t complete. Check that the server is running, that the UDP port in Endpoint is reachable, that the server has this client’s public key as a peer, and that the obfuscation parameters match the server’s.
• Tunnel established - Internet is stuck: the handshake worked, but traffic didn’t reach the internet. Check the server’s routing and NAT, its DNS, and whether its outbound traffic is blocked.
• Couldn’t complete this check — the monitor’s configuration or credentials were rejected. The server’s status is unknown.: the config couldn’t be used. The monitor shows Unknown, with no alert. Check the config against one that works in an AmneziaWG client.

What a failed check says lists every failure message.