An AmneziaWG setup on your own server takes three pieces: a Linux host that meets Amnezia's requirements, the official AmneziaVPN app to install the protocol over SSH, and a separate client file for each device. This guide uses one Ubuntu 24.04 LTS server and one Windows 11 computer.［1］

Key Takeaways

Check the host first: x86-64, KVM virtualization, a public IPv4 address and a supported distribution.

Verify the server's SSH host key yourself before typing credentials into any app.

Keep the full-access connection for administration and give each device its own guest connection.

An AmneziaWG native .conf file is not a standard WireGuard configuration.

Revoke guest access in the app; a leaked full-access key needs a password change and server cleanup.

This procedure is based on the official sources listed below; a complete end-to-end test has not been performed. Labels in the apps can change between versions, so follow the current wording on your screen. Begin by deciding who maintains and recovers the server.

When does a self-hosted AmneziaWG setup make sense?

AmneziaWG keeps WireGuard's cryptography but changes the packet format, adding junk packets before the handshake, random prefixes and different header values, so the traffic is harder to classify by signature.［2］ Those extra parameters are why an AmneziaWG file is not interchangeable with an ordinary WireGuard client file. The WireGuard explainer covers the standard protocol this one builds on.

Running AmneziaWG self hosted fits when you want to own the server, choose its region and decide who gets access. It also makes you responsible for the host's updates, firewall, credentials and shutdown. If you only need everyday browsing from a phone and a laptop, compare that duty first in the VPS versus VPN guide.

Role	What it is in this guide	Who can change the server
Server	Ubuntu 24.04 LTS x64 on a KVM host	You, through SSH and the full-access connection
Admin app	AmneziaVPN on your Windows 11 computer	Holds full access; keep it private
Client app	AmneziaWG on the same Windows 11 computer	Guest connection only; can be revoked

Step 1: Prepare a server that meets Amnezia's requirements

Rent or create a fresh server instead of reusing one that runs other services. Amnezia lists Ubuntu 22.04 and 24.04 and Debian 12 and 13 as officially supported, requires an x86-64 CPU, and states that container virtualization such as OpenVZ or LXC will not work.［3］

Check the rest of the list before you pay:

at least 1 vCPU, 1 GB of RAM and 10 GB of SSD storage, with 2 GB and 2 vCPU suggested for ten or more simultaneous connections;
a public IPv4 address, because IPv6 is not supported;
root, or a sudo user that can run any command without a password prompt;
a kernel recent enough for the protocol version, which Ubuntu 24.04 meets.［3］

Take a provider snapshot or note how to reinstall the image, and confirm you can reach the provider's web console. That console is your way back in if a firewall change or a failed install locks SSH out.

Record what the host looks like before installation so you can see what changed afterward:

sudo ss -lntup > before-sockets.txt
systemctl list-units --type=service --state=running > before-services.txt
dpkg -l > before-packages.txt
sudo iptables-save > before-firewall.txt

Step 2: Verify SSH trust before handing over credentials

The AmneziaVPN app connects to the server with the IP address, SSH username and a password or private key you enter.［1］ Before doing that, make your own first connection from a terminal and compare the host key fingerprint with the one shown in the provider's console or installation output.

ssh root@SERVER_IPV4

When the prompt shows the fingerprint, do not type yes until it matches what the provider reports. If you can open the provider console, read the key fingerprint there with ssh-keygen -lf, which prints the fingerprint of a public key file:［4］

ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub

A mismatch means you may not be talking to your server, so stop. A key-based login is preferable to a reused password; if you give the app a private key, use one created for this server only and never paste it into a chat or ticket.

Step 3: Install AmneziaWG with the official app

Install the current AmneziaVPN release from Amnezia's official download page on the Windows 11 computer. Then follow the self-hosted flow:［1］

Click the plus icon or Get Started, then choose Self-hosted VPN.
Enter the server address, adding :PORT if SSH does not use port 22.
Enter the SSH username and the password or private key.
Choose Automatic installation, which installs only AmneziaWG, or Manual to pick the protocol yourself, then continue.

When it finishes, the app holds a connection with full access to the server. Amnezia notes that AmneziaWG picks a random UDP port by default and that some ISPs block UDP on high ports, so it suggests a port at or below 9999.［1］ Whatever port you keep, allow only that UDP port in the provider's firewall or security group, alongside your existing SSH rule.

Repeat the inventory commands with after- file names and compare them with diff. Keep the result: it is your record of the listening ports, services, packages and firewall rules the installer added, and it tells you what cleanup should remove later.

Step 4: Create a separate client connection for Windows 11

Do not use the full-access connection for daily browsing. Amnezia states that a full-access key cannot be revoked or reset; if it leaks, the remedy is changing the server's root password and removing Amnezia's services.［5］ A guest connection, by contrast, only allows connecting and can be revoked at any time.［6］

Create one in AmneziaVPN:［6］

Click the Share icon on the bottom bar.
Enter a name that identifies the device, such as win11-laptop.
Choose the AmneziaWG protocol and the AmneziaWG native format, then save the .conf file.

Install the AmneziaWG app for Windows, choosing the installer that matches your Windows version and architecture. Click Add Tunnel, select the .conf file and click Activate.［7］ Then check that the client works:

Open a site you use and confirm it loads.
Compare the public address on the IP checker with your server's IPv4 address.
Deactivate the tunnel and confirm the address returns to your normal one.

That check covers this device and this request. Each guest connection is meant for one device, and Amnezia warns that adding the same file to several devices makes the connection stop working on all of them.［6］［7］ Create another guest connection for each extra device; sharing your laptop's connection through a hotspot is a different arrangement, explained in the mobile hotspot guide.

Step 5: Check AmneziaWG client compatibility and revoke access

Most failed imports come from using the wrong format or the wrong client. Work through these before changing the server:

Symptom	Likely cause	What to do
AmneziaWG app rejects a `vpn://` key	That key format is for the AmneziaVPN app only	Re-export the connection in AmneziaWG native format［6］
A standard WireGuard client imports the file but never connects	The file carries AmneziaWG masking parameters	Use the AmneziaWG app; the formats only match when masking is disabled［2］
A file from a newer server fails in an older client	The client does not support that protocol version	Update the client before regenerating anything［2］
Several devices drop at once	One `.conf` file is in use on more than one device	Give each device its own guest connection［7］
Connection never completes on any device	UDP port blocked by the host firewall or the network	Check the security group, then try a port at or below 9999［1］

To revoke a device, open AmneziaVPN with the full-access connection, click Share, go to the Users tab, select the server and protocol, choose the user and click Revoke, then Continue.［6］ Then try to reconnect from that device and confirm it fails while another device still works.

How do you update, remove, and recover the server?

Keep the AmneziaVPN and AmneziaWG apps current, and update Ubuntu packages on the server as you would any internet-facing host. After an app or protocol update, re-test one existing guest connection before issuing new ones, because a client must support the protocol version its file was made for.［2］

To retire the server, open AmneziaVPN with full access, go to Settings → Servers, select the server, open its management tab and choose Clear server from Amnezia software, then Continue; Amnezia says this removes all changes the app made on the server.［8］ Removing the server from the app list alone leaves the installed protocols and services running.［9］ Afterward, compare the host with your before- files, close the UDP port in the security group, and delete the server or snapshot through the provider if you no longer need it.

If the full-access connection is lost or leaked, use the provider console: change the root password, rotate or remove any SSH key you gave the app, and clear the Amnezia software before issuing new connections.［5］

Summary

Choose a fresh x86-64 KVM server with a public IPv4 address and a supported distribution.
Verify the SSH host key yourself before giving the app credentials.
Use the full-access connection only to administer; give each device its own guest file.
Diagnose format, client and port issues before touching server settings.
Revoke guests in the app, and clear the server's Amnezia software before deleting it.

FAQ

Can I import an AmneziaWG file into the official WireGuard app?

Generally no. An AmneziaWG file carries extra masking parameters, and Amnezia describes it as matching standard WireGuard only when those mechanisms are disabled, so use the AmneziaWG app.

Does AmneziaWG work on an OpenVZ or LXC server?

No. Amnezia's requirements say container virtualization will not work, and the server needs a KVM virtual machine with an x86-64 CPU and a public IPv4 address.

Why give my own laptop a guest connection?

Because a full-access key cannot be revoked. If the laptop is lost, you can revoke its guest connection in the app instead of resetting the server password and cleaning the host.

Can two people share one configuration file?

No. Each guest connection is meant for one device, and using one file on several devices can break the connection on all of them, so create a separate guest connection for each.

Why does my connection fail on some networks only?

Some networks block UDP on high ports. Check that the provider firewall allows the chosen port, then try a port at or below 9999 as Amnezia suggests before changing anything else.

Does removing the server from the app uninstall it?

No. Removing the entry from the app leaves the protocols and services on the server. Use Clear server from Amnezia software first, then remove the server from the app.

What should I do if the full-access key leaks?

Treat it as server compromise. Change the root password from the provider console, remove any SSH key the app used, clear the Amnezia software, and issue fresh guest connections afterward.

Disclaimer: This guide is for configuring servers and networks you own or are authorized to manage. Follow the laws and network policies that apply to you and to your hosting provider's terms.

Sources:

Amnezia docs — Install VPN on your server — https://docs.amnezia.org/documentation/instructions/install-vpn-on-server/
Amnezia docs — AmneziaWG — https://docs.amnezia.org/documentation/amnezia-wg/
Amnezia docs — Supported Linux OS for VPS — https://docs.amnezia.org/documentation/supported-linux-os-for-vps
OpenBSD manual — ssh-keygen(1) — https://man.openbsd.org/ssh-keygen
Amnezia docs — Share full access — https://docs.amnezia.org/documentation/instructions/share-full-access
Amnezia docs — Share a guest connection — https://docs.amnezia.org/documentation/instructions/share-connection
Amnezia docs — Use the AmneziaWG app — https://docs.amnezia.org/documentation/instructions/use-amneziawg-app/
Amnezia docs — Remove Amnezia services from the server — https://docs.amnezia.org/documentation/instructions/delete-amnezia-services
Amnezia docs — Remove a server from AmneziaVPN — https://docs.amnezia.org/documentation/instructions/delete-server

Sources checked 14 October 2026.

Related Articles:

AmneziaWG Setup: Self-Host a Server and Connect Windows