VPN protocol guide
AmneziaWG keeps the WireGuard cryptographic and routing model while changing observable UDP packet characteristics. It requires AmneziaWG-compatible software and matching obfuscation parameters.
Technical review: 2026-09-03 · PublicVPNList Editorial Team
The tunnel still uses peers, keys, endpoint, addresses and AllowedIPs. AmneziaWG adds fields for junk packets, padding, alternative message headers and, in newer implementations, custom signature packets. These affect traffic appearance; they are not a replacement for WireGuard encryption.
Jc, Jmin, Jmax, S1–S4, H1–H4 and I1–I5 support depends on the AmneziaWG generation and client. Values expected by the server must be preserved. A standard WireGuard client ignores or rejects these additions and cannot reproduce an obfuscated session.
The protocol is used where recognizable WireGuard traffic is filtered, including some RU/CIS networks. Filtering changes by ISP and time, so the site does not promise that any profile bypasses a specific restriction. Users must comply with local law and their network policy.
| Decision point | What to verify |
|---|---|
| What differs from WireGuard | Protect PrivateKey and never upload it to a validator. |
| Configuration and version matching | Use a client compatible with the profile version. |
| RU/CIS deployment context | Check non-overlapping header values where required. |
A successful configuration or connectivity result proves only the tested technical behavior at that time. It does not prove a no-logging policy, legal status, operator identity or safety for sensitive accounts. Public profiles should be used for low-risk testing with end-to-end HTTPS.
Technical source: Official AmneziaWG documentation.