Deploying a Self-Hosted AmneziaWG Server with a Web Management Panel
Set up your own AmneziaWG server using an installation script and add a web panel to automate client management. This solution maintains full control over your infrastructure without requiring root access for client apps and minimizes manual work as your user base grows.
AmneziaWG 2.0 requires up-to-date packages, so the script supports a limited set of operating systems. The basic install script sets up the server, generates keys and configs. A Rust-based web panel with SQLite extends it for user operations.
Installing the Base Server
Download and run the main script to deploy AmneziaWG:
curl -O https://raw.githubusercontent.com/wiresock/amneziawg-install/main/amneziawg-install.sh
chmod +x amneziawg-install.sh
sudo ./amneziawg-install.shNon-interactive mode speeds up the process:
sudo AUTO_INSTALL=y ./amneziawg-install.shManage clients via CLI:
- Add:
sudo ./amneziawg-install.sh --add-client alice - Remove:
sudo ./amneziawg-install.sh --remove-client alice - List:
sudo ./amneziawg-install.sh --list-clients
The S4 parameter affects MTU — choose values carefully to avoid connection issues.
From the repository:
git clone https://github.com/wiresock/amneziawg-install.git
cd amneziawg-install
sudo ./amneziawg-install.shAdding the Web Panel
Install the panel on top of a running VPN:
curl -O https://raw.githubusercontent.com/wiresock/amneziawg-install/main/amneziawg-web.sh
chmod +x amneziawg-web.sh
sudo ./amneziawg-web.sh installThe amneziawg-web.sh script supports install, update, remove, and status. The panel runs on 127.0.0.1:8080 and is not exposed externally by default.
For remote access via SSH tunnel:
ssh -L 8080:127.0.0.1:8080 [email protected]Then open http://127.0.0.1:8080 locally. For external access, configure a reverse proxy.
The panel implements script operations: adding/removing users, disabling, and statistics. The interface is minimalist, focused on daily tasks.
Traffic Obfuscation Parameters
AmneziaWG uses I1–I5 to mimic known protocols. Without obfuscation, the connection is vulnerable to detection. It's recommended to configure via protocol selection, domain, and browser for QUIC.
WireSock Secure Connect uses an application model instead of manual packet editing. I1–I5 parameters require testing — working combinations quickly become outdated.
Client Applications
- Windows: WireSock Secure Connect (version 3.3.1+ with AmneziaWG 2.0 support)
- iOS: AmneziaWG
- Android: WG Tunnel
These clients ensure stable operation with a self-hosted server.
Scaling the Infrastructure
Scripts are separated: the base VPN runs independently, the panel is an optional layer. As users grow, routine tasks (recreating configs, revoking access) are automated via the web interface.
Advantages of this approach:
- Full control without external apps requiring root.
- Modularity — the panel is not mandatory.
- Lifecycle management: install/update/remove.
- Local access by default for security.
- CLI for automation with scripts.
Key Points
- The script leaves control with the administrator, avoiding automated root actions.
- The web panel in Rust with SQLite is lightweight, with no external dependencies.
- I1–I5 obfuscation is critical for connection stability.
- AmneziaWG 2.0 support requires fresh OS packages.
- Clients: WireSock for Windows, AmneziaWG for iOS, WG Tunnel for Android.
— Editorial Team
No comments yet.