Amnezia: Open-source self-hosted VPN with advanced DPI obfuscation

General Project Showcase
1

Hi Privacy Guides community!

We’re the Amnezia team, an open-source VPN software with a feature that allows anyone to easily create a VPN on a personal VPS server for free.

Amnezia started as an activist-led initiative in 2020 at a digital rights hackathon in Russia as a response to political censorship. At first, our app only had a self-hosted VPN feature, which was mentioned on PrivacyGuides.net by another user a few years ago. Since then, we’ve grown and launched Amnezia Premium – a traditional VPN service, and Amnezia Free – a cost-free tool to access specific websites and apps in censored regions.

To keep VPN connections stable in these regions, we developed the AmneziaWG protocol based on WireGuard. This year, we released version 2.0, because DPI-systems have learned to better recognize VPN traffic by its structure and started to block earlier obfuscation protocols that relied on sets of random bytes to mislead DPI.

AmneziaWG 2.0 disguises VPN traffic as a legitimate UDP by mimicking DNS queries, QUIC connections, or SIP calls. Our protocol uses several tools to bypass DPI:

– Signature Packets, looking like a DNS query, a QUIC handshake, or any other common protocol;
– Custom Protocol Signature – a builder that dresses up VPN traffic, which combines special tags defined in the connection configuration;
– Advanced Padding – previously, only the handshake messages had variable sizes, now random bytes are being added to every packet and to all message types;
– Dynamic Header Ranges – protocol assigns a random header value from a configurable range to each packet, instead of using a fixed one.

We described how the protocol works in this article: AmneziaWG 2.0 Is Here

Website: https://amnezia.org/
GitHub: GitHub - amnezia-vpn/amnezia-client: Amnezia VPN Client (Desktop+Mobile) · GitHub
Latest security audit: New AmneziaVPN Security Audit by 7ASecurity - 7ASecurity Blog

Most of our users are from Russia, Iran, Myanmar, Venezuela, and other countries with censorship. But we think that our app, especially our self-hosted feature, can be useful for people globally. Amnezia Self-hosted is free, and we’d be glad to hear feedback from the community!

7 Likes
2

Thank you for sharing all this info!

Question: Do you have any testimonials from folks who have used your product in those highly restrictive countries? I’d like to hear more about it and how their experience was. As I see it, that’s the real selling point of Amnezia and I don’t see anything else other VPNs don’t already do well. No?

2 Likes
3

Comment from Russia:

Amnezia is one of two solutions that works for most people (second one is vless-reality). Speed is slower compared to vless but besides that Amnezia is a solid choice.

3 Likes
4

Thanks for sharing.

1 Like
5

Amnezia should consider crediting the projects from whence it borrowed the techniques from.

Is it other protocols (like VLESS) that the Amnezia app supports that are more effective or Amnezia modification of the WireGuard protocol? In my experience with folks in Iran, Amnezia-like WireGuard (not the exact modifications but related ones) once worked nicely. In my talking with folks elsewhere, with more stringent censorship, it never worked, mostly because of aggressive blocking of suspicious UDP and ‘VPN IP ranges’ in general.

1 Like
6

Thank you for the question!

I see that Mitsuha already answered that question. Our commitment to provide stable connection in restricted networks was recognised by WhatsApp. The internet situation in Russia and Iran is among the worst in the world, and these are the countries where most of our users come from.

There are some publications about operating in Russia: Wired, independent blog on Dev.to. But we also have friends and family living there who use Amnezia.

We want to highlight that Amnezia doesn’t work in Iran during the internet shutdown, since there is no access to the global internet and it’s impossible to turn on VPN. However, before the shutdown, people in Iran were actively using Amnezia. We saw this in our local chat for Iran users in Telegram (@amnezia_vpn_ir), and here’s an example of a VPN, popular in Iran, which uses our protocol – Rostam VPN

By the way, our app supports VLESS REALITY too.

Amnezia offers both a traditional VPN option – Amnezia Premium, where users just press a button to connect – and a self-hosted option that can be configured individually. It helps in censored environments for several reasons: users can make a VPN cascade, choose a hosting provider and IP address. Plus, when there is only one user, it’s harder for DPI systems to detect the VPN traffic.

2 Likes
7

Thank you for your comment and questions!

We have great respect for all protocol developers, including VLESS REALITY (XRay), OpenVPN over Cloak and Shadowsocks, as well as OpenVPN, WireGuard, IKEv2 and many others.

Amnezia supports VLESS and some other protocols, and we’re glad that other VPN providers adopt our open-source protocol.

We believe that our main contribution is observing how DPI systems work now and understanding why previous protocols were blocked. Based on these observations, we developed a unique set of tools designed to prevent blocking.

You’re right, blocking has become more aggressive, but authorities can’t block all UDP traffic. That’s why it’s important to constantly monitor the situation and update obfuscation methods.

As for blocking VPN IP ranges – unfortunately, it is a real problem for VPN providers. Self-hosted VPNs can be a solution, as users can choose hosting providers, whose servers haven’t been blocked yet. Plus, it’s harder to block them, because their servers can be used not only for VPN, but for “legitimate” business as well.

I attached some links in my comment above – about our work in Russia and Iran.

1 Like
8

Is there really a distinction between VLESS and Xray’s bundled TLS strategy?

  1. I haven’t looked at your project in a while. If i recall correctly, you were using an ubuntu/debian base, not even slim layer to bundle essentially a compiled, fully static go binaries. Is this still the case? And how do you guys manage both OS and image updates? Is your Premium product built upon the same wonky shell script or you use k8s? Did anyone audit your infrastructure?

  2. Could you share some details regarding the OpenWRT upstreaming process? Why did it stall? As you probably know, the adoption of amneziawg is lacking amongst the openwrt community due to poor packaging. English speaking users have to rely on 3rd party projects to get a compiled package.

  3. What’s euphoria?