> The full list of articles is in [llms.txt](https://docs.f3cloud.com/llms.txt). Every page has a Markdown version: add .md to its address. This page as Markdown: [https://docs.f3cloud.com/en/vpn-guide/setup-amnezia.md](https://docs.f3cloud.com/en/vpn-guide/setup-amnezia.md). # Installing Amnezia VPN on your own server – AmneziaWG 3.1 and XRay Installing Amnezia VPN on your own server without the command line. AmneziaWG 3.1 and XRay, choosing a port, sharing access with family, error 1200 and other error codes when the VPN does not connect. **Amnezia VPN** is a free open-source app that sets up a VPN on your server by itself. You enter the server address and password, and the app does everything else for you, **with no terminal and no commands**. In this article we look at how such an installation works, which protocol to choose and why, and then go through every step from connecting the server to sharing access with family. The screenshots were taken in AmneziaVPN 5.0.3 on our test server. They show the app in Russian, so the button names in the text are given as they appear in the English version of the app. *** ## How Amnezia sets up the server To understand why an IP address and a password are enough for the installation, it helps to picture what actually happens after you press the install button. The app connects to the server **over SSH**, the same way an administrator logs in to a server from a terminal, and runs all the commands itself as `root` (or another user with sudo rights). First it installs **Docker**, and then for each chosen protocol it starts a **separate container** running the VPN server of that protocol. Each container gets its own keys and root certificate, so the protocols on one server do not depend on each other, and any of them can be removed or reinstalled without touching the rest. This design also explains the server requirements. Docker and the Amnezia containers only work in a full virtual machine, so you need a server with **KVM** virtualisation and an **x86-64** processor, and the system must use systemd. F3 Cloud servers run on KVM, so all you need to do when ordering is pick a suitable system. | Parameter | Minimum | For 10 or more connections | | --- | --- | --- | | System | Debian 12 or 13, Ubuntu 22.04 or 24.04 | the same | | Processor | 1 x86-64 core | 2 cores | | Memory | 1 GB | 2 GB | | Disk | 10 GB | 10 GB | | Virtualisation | KVM | KVM | After the installation, the app on your computer gets **full access to the server**. Through it you manage protocols, create connections for other people and revoke them. Friends and relatives do not need this full access, you give them guest connections, which are covered in the last step. *** ## Which protocol to choose Amnezia can install several protocols, but in Russia two of them make sense first of all, **AmneziaWG** and **XRay with REALITY**. To make an informed choice, let us look at why ordinary VPN protocols get blocked and how these two protocols get around blocking in different ways. Take WireGuard, which AmneziaWG is based on. On its own it encrypts data reliably, but its packets are very uniform. Every message starts with a fixed number that marks the packet type, the handshake packets **always have the same size** (148, 92 and 64 bytes), and they are exchanged at predictable intervals. A deep packet inspection (DPI) system does not need to decrypt anything, it only has to see these constant features to recognise WireGuard with confidence and cut the connection. AmneziaWG keeps the WireGuard cryptography unchanged and alters **only the look and behaviour of the packets**. The easiest way to see this is in the settings the app chose when installing on our test server. The values below come from the AmneziaWG server settings section, yours may differ. ```ini{3-6,8,12} Port = 1234 Jc = 5 Jmin = 10 Jmax = 50 S1 = S2 = S3 = S4 = 12 H1 = 1, H2 = 2, H3 = 3, H4 = 4 I1 = RekeyAfterTime = 100-120 KeepaliveTimeout = 5-15 HeaderProtectionKey = on RandomTrailers = on DisableCookies = on ``` Before each handshake the server and the client send a series of `Jc` "junk" packets with a random length from `Jmin` to `Jmax` bytes, and the start of a session no longer looks like the start of WireGuard. The `I1` parameter adds one more decoy packet, which in our installation imitates a **response from a DNS server**, that is, the most ordinary UDP traffic. The `S1`–`S4` parameters add 12 random bytes to each packet type, so the familiar sizes of 148, 92 and 64 bytes disappear. The packet type numbers `H1`–`H4` are left standard here, because instead of replacing them, **HeaderProtectionKey** encrypts the service fields of a packet entirely, and for that it needs at least 12 bytes in `S1`–`S4`. Finally, the reconnect and keepalive intervals are set as ranges like `100-120` seconds rather than fixed numbers, so the rhythm of the exchange becomes unpredictable too. The `RandomTrailers` flag appends random bytes to the end of service packets, and `DisableCookies` turns off the service replies by which the server could be recognised during active probing. As a result the traffic is **left without a constant signature** that a single rule could catch. Since AmneziaWG runs over UDP and spends no time on extra wrappers, it usually gives the highest speed and the lowest latency.