AmneziaWG is a version of WireGuard that changes how its traffic looks. The encryption stays the same, but the patterns that give WireGuard away are reshaped, so networks that ban VPNs find it harder to spot. In Tunnexa it's free with an account.
Networks that block VPNs often inspect the size, order and first bytes of your traffic. WireGuard has a very regular pattern. AmneziaWG blurs it.
Network filter viewBefore
Regular WireGuard
Handshake · data
First packet
Fixed-size handshake
Match
Packet headers
Standard WireGuard values
Match
Rhythm
Regular and repeating
Match
✕Recognized as WireGuard and blocked
Network filter viewAfter
AmneziaWG
Junk · padded handshake · data
First packets
Junk of random sizes
Unclear
Handshake
Padded, size varies
Unclear
Packet headers
Changed for this server
Unclear
●Harder to tell apart from other traffic
A simplified illustration. Real filters differ, and some networks may still block AmneziaWG.
How it works
Three changes, same encryption
The settings come from our servers. Their names below are the ones AmneziaWG itself uses.
01
Junk packets first
Jc · Jmin · Jmax
Before the handshake, the app sends a few packets of random junk at random sizes. A filter waiting for WireGuard's familiar opening sees noise instead.
02
A padded handshake
S1 · S2
WireGuard's handshake messages are always the same size, which makes them easy to fingerprint. AmneziaWG pads them so the sizes no longer match.
03
New header values
H1 – H4
Every WireGuard packet starts with a small number that says what kind of packet it is. AmneziaWG swaps those for values set by the server.
No quiet fallbackUnderneath, the tunnel keeps WireGuard's encryption and key exchange exactly as they are. And if a server's AmneziaWG settings are incomplete, Tunnexa won't connect at all, rather than quietly running plain WireGuard under the AmneziaWG name.
Compared
AmneziaWG vs WireGuard
If you don't need the disguise, plain WireGuard is the simpler, lighter choice.
WireGuard
vs
AmneziaWG
Modern, one fixed set
Encryption
The same
A clear WireGuard pattern
To a network
Reshaped, harder to spot
None
Overhead
Junk packets and padding add a little
UDP
Travels over
UDP
Free for guests
In Tunnexa
Free account
Everyday browsing and streaming
Use it for
Networks that ban VPNs
When to use it
Try AmneziaWG when a network blocks VPNs
Some networks block VPNs on purpose: certain workplaces, campuses, hotels, and whole countries. The usual sign is that nothing connects on that one network. Our guide to getting through VPN blocks explains the signs in more detail.
Step 1
Spot the block
Every protocol fails on one network but works fine everywhere else.
Something not covered here? Write to us at support@tunnexa.com.
What is AmneziaWG?
+
AmneziaWG is a modified version of WireGuard that disguises its traffic patterns. It adds junk packets, pads the handshake and changes packet headers, so networks that block VPNs find it harder to recognize.
Is AmneziaWG the same as WireGuard?
+
Underneath, yes: the same encryption and key exchange. The difference is how its packets look to the network on the way.
Can networks still detect AmneziaWG?
+
Sometimes. It's harder to spot than regular WireGuard, not invisible, and detection varies by network. If AmneziaWG is blocked too, try Stealth.
Is AmneziaWG free in Tunnexa?
+
Yes. It needs a free account and nothing more. Sign in with an email code, Google or Apple.
Is AmneziaWG slower than WireGuard?
+
The junk packets and padding add a little overhead. That's why WireGuard stays the better pick when you don't need the disguise.
Does AmneziaWG work on Android?
+
Yes. Tunnexa runs AmneziaWG inside the app on Android 7.0 and later. You don't need a separate app or a config file.
Built on WireGuard
AmneziaWGHarder to spot
WireGuard
vs