---
layout: page
title: What is AmneziaWG?
permalink: /blog/amneziawg-en/
keywords: amneziawg,amnezia,wireguard,dpi
description: What is AmneziaWG? And what do the parameters actually mean?
lang: en
feed: true
date: 2024-09-22 20:00:00 +0100
---

[AmneziaWG](https://docs.amnezia.org/documentation/amnezia-wg/) is a WireGuard fork that implements anti-detection techniques against DPI systems. These anti-detection techniques are called "Advanced Security". AmneziaWG can be configured to be backwards compatible with vanilla WireGuard.

![The picture shows the Amnezia logo. It is the classic anarchy "A" in a circle. However, the logo is very colorful - areas are filled with orange, lula, light blue, pink and gray.](/assets/img/amnezia_logo.svg)

(from [https://github.com/amnezia-vpn/amnezia-client](https://github.com/amnezia-vpn/amnezia-client), GPL-3.0, cut out by me)

It introduces nine additional parameters (`Jc`, `Jmin`, `Jmax`, `S1`, `S2`, `H1`, `H2`, `H3`, `H4`).

## Vanilla WireGuard

The WireGuard protocol consists of a variety of messages. Some of the most important messages are the "Handshake Initiation", the "Handshake Response" and the actual data packets.
These WireGuard messages all have a header in which their type is defined. This is specified using an integer.
To establish a WireGuard connection, a "handshake initiation" is generally sent by the peer that wants to establish the connection. The other peer then responds with a "handshake response".
These packets can be recognized with the help of DPI systems and then blocked accordingly. This prevents the entire WireGuard tunnel and means that WireGuard is blocked.

## Junk packets

AmneziaWG can send junk packets before the handshake. These are packets that contain random data and are not intended to communicate any information. There are three parameters to define the type of junk packets: `Jc`, `Jmin` and `Jmax`.

`Jc` defines the number of junk packets. For example, a `Jc` of three means that three packets with random data should be sent before the handshake. The maximum size of `Jc` is 128 (inclusive).

`Jmin` and `Jmax` define the size of the junk packets in bytes - more precisely the size of the UDP payload (the size of the UDP header and the IP header do not count when specifying the size). 'Jmin' specifies the minimum size of the payload and 'Jmax' the maximum size of the payload. The size of the actual payload is then randomly selected so that it lies between `Jmin` (inclusive) and `Jmax` (inclusive). `Jmin` must be less than or equal to `Jmax`. Both values may be a maximum of 1280 (inclusive) bytes in size.

If `Jmin` and `Jmax` are the same size, the size of the payload lies randomly between `Jmin` and `Jmax + 1`.

### Recommended values

Depending on the region and circumstances, different values may be recommended. In general, 'Jc' should be between 3 (inclusive) and 10 (inclusive). Often 3 or 4 is used.
For `Jmin` and `Jmax`, 50 and 1000 or 10 and 50 are recommended respectively.

## Junk in the handshake

In addition to the separate junk packets, random data is also added before the actual WireGuard data in the "Handshake initiation" and the "Handshake response". The parameters 'S1' and 'S2' define how many bytes of junk data are to be placed before the actual WireGuard data. In the "Handshake Initiation", `S1` bytes are added before the actual data and in the "Handshake Response" `S2` bytes of random data. This setting must be the same for all peers so that everyone knows where the actual meaningful data begins.

### Recommended values

A random value between 15 (inclusive) and 150 (inclusive) is recommended for `S1` and `S2`. However, `S1 + 56` must not equal `S2`.

## User-defined types

To identify what type of WireGuard message it is, a type is specified in the WireGuard header in the form of an integer. For example, the "Handshake Initiation" is type 1 and the "Handshake Response" is type 2. There are (currently) a total of four defined types. As these types are fixed, they are suitable as a criterion for recognizing WireGuard packets. It is therefore possible to overwrite the predefined types in AmneziaWG. Type 1 becomes `H1`, type 2 becomes `H2`, type 3 becomes `H3` and type 4 becomes `H4`. The `H` values must be different from each other.

### Recommended values

A random value between 5 and 2^31-1=2147483647 or 2^32-1=4294967295 (see discussion [here](https://github.com/amnezia-vpn/amneziawg-go/issues/42#issuecomment-2366785806)) is recommended.

## Backward compatibility

AmneziaWG can be used backwards-compatible with Vanille WireGuard. Only the feature of junk packets before the handshake is activated and features such as junk data in the handshake and user-defined types are deactivated.

The [following parameters](https://zaneschepke.com/wgtunnel-docs/features.html#how-to-convert-an-existing-wireguard-config-to-amnezia) can be used for this: 'S1' of 0, 'S2' of 0, 'H1' of 1, 'H2' of 2, 'H3' of 3 and 'H4' of 4.

## Configuration

The additional parameters can be written to a WireGuard configuration file in the same way as address or key parameters:
```
[Interface]
PrivateKey = uMnqnbbo+bbnnPVPjjyLqB72JHPvSOew/MqWxPz6PEg=
Address = 192.168.2.4/32

Jc = 3
Jmin = 50
Jmax = 1000
S1 = 20
S2 = 78
H1 = 39131278
H2 = 832138185
H3 = 1436957857
H4 = 1635877746

[Peer]
PublicKey = 8Yr++qyZzEL4zHS7CEgi+9zMm0d09qUA0xeqohNs8F8=
PresharedKey = fbDzRFA/PGH05Uwl9EFcI42F8KABRpSKoqS+Xv2qOl8=
Endpoint = 192.168.1.1:1234
AllowedIPs = fd00::/8
```

## Packaging

### Linux

Under Linux, the [`awg-tools`](https://github.com/amnezia-vpn/amneziawg-tools) and the [Kernel](https://github.com/amnezia-vpn/amneziawg-linux-kernel-module) or the [Go](https://github.com/amnezia-vpn/amneziawg-go) implementation are required. For Debian there is a [repository](https://launchpad.net/~amnezia) provided by the AmneziaWG developers for the tools and the kernel implementation. For Arch Linux, the [Tools](https://aur.archlinux.org/packages/amneziawg-tools) and the [Go implementation](https://aur.archlinux.org/packages/amneziawg-go) are packaged in AUR.

### Android

Currently only [WG Tunnel](https://github.com/zaneschepke/wgtunnel) supports AmneziaWG in F-Droid.

However, the AmneziaWG developers also provide an [own VPN app](https://github.com/amnezia-vpn/amnezia-client) and an [AmneziaWG client](https://github.com/amnezia-vpn/amneziawg-android) for Android.
A [request](https://github.com/amnezia-vpn/amneziawg-android/issues/6) has been made to the AmneziaWG developers to include the client in F-Droid or IzzyOnDroid - currently without feedback from the developers. Furthermore, the AmneziaWG client seems to have been [not signed by the developers, but by Google](https://github.com/amnezia-vpn/amneziawg-android/issues/6#issuecomment-2313103667) - which is problematic in the case of a security application.
A [request was also sent to the developers](https://github.com/amnezia-vpn/amnezia-client/issues/263) and to [F-Droid](https://gitlab.com/fdroid/rfp/-/issues/2374) for the Amnezia client app. The Amnezia client app is [unfortunately too large](https://github.com/amnezia-vpn/amnezia-client/issues/263#issuecomment-2309026176) for IzzyOnDroid.

## Official documentation

There will probably be [no detailed official documentation](https://github.com/amnezia-vpn/amneziawg-go/issues/42#issuecomment-2351742762) in the foreseeable future out of concern that this would make it easier for censors to recognize AmenziaWG.

## Outlook

There are currently several requests to include AmneziaWG in [OpenWrt](https://github.com/openwrt/packages/pull/23632) ([Tools](https://github.com/openwrt/packages/pull/23633)), [MikroTik's RouterOS](https://forum.mikrotik.com/viewtopic.php?t=206646), [GL.iNet's OpenWrt](https://forum.gl-inet.com/t/feature-request-replace-wireguard-with-amneziawg/44783), [DD-Wrt](https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=337390) and other distributions.

Furthermore, it could be [planned](https://9.demhack.org/en/tasks) to introduce an `S3` or `S4` for the WireGuard Anti-DoS mechanism.

