Amnezia VPN is a free open-source app that sets up a VPN on your server by itself. You enter the server address and password, and the app does everything else for you, with no terminal and no commands. In this article we look at how such an installation works, which protocol to choose and why, and then go through every step from connecting the server to sharing access with family. The screenshots were taken in AmneziaVPN 5.0.3 on our test server. They show the app in Russian, so the button names in the text are given as they appear in the English version of the app.
How Amnezia sets up the server
To understand why an IP address and a password are enough for the installation, it helps to picture what actually happens after you press the install button. The app connects to the server over SSH, the same way an administrator logs in to a server from a terminal, and runs all the commands itself as root (or another user with sudo rights). First it installs Docker, and then for each chosen protocol it starts a separate container running the VPN server of that protocol. Each container gets its own keys and root certificate, so the protocols on one server do not depend on each other, and any of them can be removed or reinstalled without touching the rest.
This design also explains the server requirements. Docker and the Amnezia containers only work in a full virtual machine, so you need a server with KVM virtualisation and an x86-64 processor, and the system must use systemd. F3 Cloud servers run on KVM, so all you need to do when ordering is pick a suitable system.
| Parameter | Minimum | For 10 or more connections |
|---|---|---|
| System | Debian 12 or 13, Ubuntu 22.04 or 24.04 | the same |
| Processor | 1 x86-64 core | 2 cores |
| Memory | 1 GB | 2 GB |
| Disk | 10 GB | 10 GB |
| Virtualisation | KVM | KVM |
After the installation, the app on your computer gets full access to the server. Through it you manage protocols, create connections for other people and revoke them. Friends and relatives do not need this full access, you give them guest connections, which are covered in the last step.
Which protocol to choose
Amnezia can install several protocols, but in Russia two of them make sense first of all, AmneziaWG and XRay with REALITY. To make an informed choice, let us look at why ordinary VPN protocols get blocked and how these two protocols get around blocking in different ways.
Take WireGuard, which AmneziaWG is based on. On its own it encrypts data reliably, but its packets are very uniform. Every message starts with a fixed number that marks the packet type, the handshake packets always have the same size (148, 92 and 64 bytes), and they are exchanged at predictable intervals. A deep packet inspection (DPI) system does not need to decrypt anything, it only has to see these constant features to recognise WireGuard with confidence and cut the connection.
AmneziaWG keeps the WireGuard cryptography unchanged and alters only the look and behaviour of the packets. The easiest way to see this is in the settings the app chose when installing on our test server. The values below come from the AmneziaWG server settings section, yours may differ.
Port = 1234
Jc = 5
Jmin = 10
Jmax = 50
S1 = S2 = S3 = S4 = 12
H1 = 1, H2 = 2, H3 = 3, H4 = 4
I1 = <a packet that looks like a DNS response>
RekeyAfterTime = 100-120
KeepaliveTimeout = 5-15
HeaderProtectionKey = on
RandomTrailers = on
DisableCookies = onBefore each handshake the server and the client send a series of Jc "junk" packets with a random length from Jmin to Jmax bytes, and the start of a session no longer looks like the start of WireGuard. The I1 parameter adds one more decoy packet, which in our installation imitates a response from a DNS server, that is, the most ordinary UDP traffic. The S1–S4 parameters add 12 random bytes to each packet type, so the familiar sizes of 148, 92 and 64 bytes disappear. The packet type numbers H1–H4 are left standard here, because instead of replacing them, HeaderProtectionKey encrypts the service fields of a packet entirely, and for that it needs at least 12 bytes in S1–S4. Finally, the reconnect and keepalive intervals are set as ranges like 100-120 seconds rather than fixed numbers, so the rhythm of the exchange becomes unpredictable too. The RandomTrailers flag appends random bytes to the end of service packets, and DisableCookies turns off the service replies by which the server could be recognised during active probing.
As a result the traffic is left without a constant signature that a single rule could catch. Since AmneziaWG runs over UDP and spends no time on extra wrappers, it usually gives the highest speed and the lowest latency.
Masking parameters in the AmneziaWG server settings
XRay with REALITY works differently. It runs over TCP and disguises the connection as an ordinary secure connection (TLS) to a real external website, so from the outside it looks like a visit to that site. This approach helps where UDP traffic to foreign servers is restricted as such, because in that case no AmneziaWG masking will help. The price of this versatility is the slightly higher latency typical of TCP.
| Protocol | Transport | How it hides from DPI | When to choose |
|---|---|---|---|
| AmneziaWG | UDP | encrypts service fields, changes packet sizes and rhythm, sends decoy packets | by default, the fastest |
| XRay with REALITY | TCP | looks like a TLS connection to a real website | if AmneziaWG does not connect or UDP is throttled |
| WireGuard, OpenVPN, IPsec | UDP or TCP | not at all | do not use |
Do not install protocols without masking
Plain WireGuard, OpenVPN and IPsec (IKEv2) are easily recognised by DPI. The Amnezia developers advise against using them in countries with strict censorship, because they can get the IP address of the whole server blocked.
Hence a simple rule. Start with AmneziaWG. If it does not connect or works unstably on your network, add XRay to the same server, and you will have two connections to switch between.
What you will need
- A server with Debian 12 or Ubuntu 24.04. Amnezia also supports Debian 13, but error 208 with access to the home directory sometimes occurs on it, and in that case the developers themselves recommend Debian 12. If you do not have a server yet, order one using this guide or try a free trial server. The DE-Promo plan is enough for one or two people, and for a family or a small team DE-RZ9-2 with two cores and 4 GB of memory is a better fit.
- The server login details, that is, the IP address, user name and password. In the client area, tick the server and click Instructions (Инструкция), and the details will be in the window that opens.
- The AmneziaVPN app version 5.0.2.1 or newer for your computer or phone.
The Instructions button in the client area
Server IP address, user name and password
1. Install AmneziaVPN
Download the app from the official website amnezia.org. If the site does not open, all versions of the app are published in the official GitHub repository.
The app is available for Windows, macOS, Linux, Android and iOS. It is more convenient to install the VPN on the server from a computer, and you can then pass a ready connection to your phone.
Update the app if you already have it
If AmneziaVPN is already installed, update it first. Versions before 5.0.1.5 do not see connections in the new format, and newer versions have improved AmneziaWG performance and connection stability.
2. Connect the server
- Open AmneziaVPN and click Let's get started. If the app already has connections, click + in the bottom bar.
First launch of AmneziaVPN
- Choose Self-hosted VPN.
The Self-hosted VPN option
- Fill in the Configure your server form:
- Server IP address [:port]. You do not need to enter a port unless you have changed the standard SSH port
22. If you have, enter the address asIP:port, for example203.0.113.10:2222. - SSH Username, which is
root. - Password or SSH private key, that is, the password from the server instructions.
- Server IP address [:port]. You do not need to enter a port unless you have changed the standard SSH port
- Click Continue.
The server connection form
Do you log in to the server with a key?
Instead of a password you can paste a private SSH key. The app accepts ED25519 and RSA keys in PEM format, and you need to paste the whole key, including the BEGIN and END lines.
3. Install AmneziaWG on your own port
The app offers two installation types.
- Automatic installs AmneziaWG on a random port straight away.
- Manual lets you choose the protocol and set the port yourself.
Choosing the installation type
The port matters more than it seems. With the automatic installation AmneziaWG takes a random port, usually a high number such as 35581. Some providers block UDP traffic on high ports, and then the VPN installs without errors but does not connect. That is why the Amnezia developers advise using a port no higher than 9999, and the easiest way is to set it right away with the manual installation.
- Choose Manual and click Continue.
- In the list of protocols, choose AmneziaWG.
Protocols available in the manual installation
- In the Port field, replace the random value with a free port up to 9999, for example
585or1234. - Click Install.
The AmneziaWG port before installation
The installation takes up to five minutes, and on our test server it finished in less than half a minute. When it is done, the main screen shows Server 1 with the caption AmneziaWG (version 3.1) and the Connect button.
The first installation may stop with error 1200
This happened to us on the very first attempt. We had just installed AmneziaVPN, entered the server details, chosen AmneziaWG and clicked Install. About a minute later the message ErrorCode: 1200. QFile error: The file could not be opened appeared at the bottom of the window, and the installation stopped.
Error 1200 during the first installation
Error 1200 happens in the app on your computer, not on the server. The app could not open one of its own service files, and according to the developers this happens right after installing AmneziaVPN, on the first connection to a server, when setting up the VPN or when creating guest connections. The server is not affected, and nothing needs to be removed from it. A full restart of the app helps.
- Click Close in the error message.
- Click the gear icon in the bottom bar and choose Close application, so the app quits completely.
- Open AmneziaVPN again.
- If the server was not saved and the app shows the Let's get started screen again, repeat steps 2 and 3 with the same details.
For us, after the restart the app did open on the welcome screen, the server had to be added again, and the second installation went through without errors in less than half a minute. If the error comes back after a restart, the developers advise writing to them by email or in the Amnezia Telegram group. You can also open a ticket with us, and we will help you sort it out.
Has the server been set up before?
The Skip setup button is only needed when Amnezia is already installed on the server, for example if you reinstalled the app on your computer. To restore the settings of such a server, open Settings, then Servers, click the server, go to the Management tab and choose Check the server for previously installed Amnezia services.
4. Connect to the VPN
On the main screen, click the big Connect button. Once the connection is established, all of the device's traffic goes through your server.
The main screen with a ready connection
The easiest way to check this is any site that shows your IP address, for example ifconfig.me. It should show your server's IP, not your provider's address. If the connection is not established, see the If something does not work section at the end of the article.
5. Share access
For family and friends Amnezia creates guest connections. Each of them works with only one protocol and on only one device, so one person's phone and laptop need two separate connections. On the other hand, any of them can be revoked without affecting the others.
Do not give away your own full-access connection
The connection on your computer gives full access to the server. A person with such access can remove protocols and revoke other people's connections, so in effect they control your VPN. Give other people guest connections only.
- Click the Share icon in the bottom bar, it is the second from the left.
- On the Connection tab, enter a User name by which you will recognise this connection later, for example "Mum, phone".
- Check Server and Protocol and choose the Connection format:
- For the AmneziaVPN app, if the person will use AmneziaVPN. You get a key that starts with
vpn://. - AmneziaWG native format, if the connection is for the AmneziaWG app or a router. You get a
.conffile.
- For the AmneziaVPN app, if the person will use AmneziaVPN. You get a key that starts with
- Click Share.
A guest connection for a phone
Two connection formats
The Connection to Server 1 window opens. Pass the connection on in any convenient way. You can send a file with the Share button, copy the key with the Copy button or show a QR code that the person scans in AmneziaVPN on their phone. Only the AmneziaWG native format has no QR code.
A ready connection, the QR code is hidden
The QR code and the key are access to your VPN
Anyone who gets hold of them can connect. Do not publish them or forward them through open chats.
To revoke access, click Share again, go to the Users tab, choose the server and protocol and click the person you need. In the window that opens, click Revoke. You can also rename the connection there.
The list of connections to the server
Revoking a guest connection
How to add XRay to the same server
- Click the gear icon in the bottom bar and open Servers.
- Click your server. On the Protocols tab, the installed AmneziaWG has an arrow, and the other protocols have a download icon.
- Click the download icon next to XRay and then Install.
Server protocols, XRay is installed with the download icon
After the installation, switch to XRay following the official Amnezia guide and connect.
If something does not work
| What happens | What to check first |
|---|---|
| Error 1200 "The file could not be opened" | close the app through the settings and try again |
| The app cannot connect to the server | the IP address, password, SSH port and that the server is active |
| AmneziaWG is installed, but the VPN does not connect | the protocol port, it should be no higher than 9999 |
| Changing the port did not help | install XRay on the same server |
| Connections stopped working after an app update | reinstall AmneziaWG and share the keys again |
| The VPN is slow or drops | compare AmneziaWG and XRay, run a traceroute |
Installation error codes
If the app shows an error code, look it up in the table. It lists the codes that occur when installing a VPN on your own server, based on the official Amnezia list.
| Code | What it means | What to do |
|---|---|---|
| 200 | the server check failed | check that the server meets the requirements |
| 201 | the port is already used by another program | choose a different port for the protocol |
| 202, 203 | a Docker error or a missing container | add the server again and check that the ports are free |
| 205, 207, 209, 210 | the user lacks the required sudo rights | connect as root |
| 206 | the package manager is busy | wait a few minutes or reboot the server |
| 208 | no access to the home directory | connect as root, on Debian 13 update the app or use Debian 12 |
| 211, 212 | Docker does not work with this virtualisation | you need a KVM server, not LXC or OpenVZ |
| 213 | Docker Hub has temporarily limited downloads | wait and repeat the installation |
| 214 | the Linux kernel is too old | reinstall the system with Debian 12 or Ubuntu 24.04 |
| 300 | the server rejected the SSH login | check the password and that password login is allowed |
| 302 | an internal SSH error | restart the app and try a different network |
| 303, 304 | a wrong key or an unsuitable format | use an ED25519 or RSA key in PEM format |
| 305 | the server did not respond over SSH | check the IP, the SSH port and that the server is active |
| 700 | another VPN is already running | turn off the other VPN app |
| 1200–1205 | the app could not open or read a file | close the app through the settings and try again |
Error 1200 "QFile error: The file could not be opened"
This is an error of the app itself on your computer, not of the server. According to the developers, it happens right after installing AmneziaVPN. Click the gear icon and choose Close application, then open AmneziaVPN again and repeat the action. How it went for us is described in detail in step 3.
The app cannot connect to the server during installation
Check that the server is active in the client area and that you copied the IP address and password without extra spaces. If you changed the SSH port, add it after a colon in the address field. If you have disabled password login, use a private SSH key.
Try logging in to the server over SSH, for example with Termius. If that does not work either, the problem is in the login details rather than in Amnezia, and you can change them using this guide.
AmneziaWG is installed, but the VPN does not connect
Most often the provider blocks UDP on a high port. Look up the port in the server card, in the AmneziaWG server settings section. If it is higher than 9999, remove AmneziaWG with the Remove button in the protocol settings and install it again on a port up to 9999, as described in step 3. Keep in mind that removing it also deletes all guest connections of this protocol.
If that did not help, add XRay to the same server.
Connections stopped working after an app update
New versions of AmneziaWG are incompatible with old ones, and both versions use the same container, so the protocol cannot be updated in place. Update AmneziaVPN to version 5.0.2.1 or newer, remove AmneziaWG in the server settings and install it again on a port up to 9999.
After that, all guest connections need to be created and shared again, the old keys will not work.
The VPN connects, but is slow or drops
Compare the speed on AmneziaWG and XRay, as one protocol or the other works better with different providers. If both are slow, run a traceroute and speed test and send us the result in a ticket, and we will look at where the speed is lost.
Our resources
Telegram channel: https://t.me/f3cloud_news
F3 Cloud: https://f3cloud.com