AmneziaWG 2.0 isn’t built into any commercial VPN app yet, which means the only way to use it today is to run it yourself. That sounds more technical than it is. The AmneziaVPN app handles almost the entire server setup for you, as long as you have a VPS and about twenty minutes. This guide walks through the process from renting a server to connecting your first device.
If you want the background on what AmneziaWG 2.0 actually does and why it matters, read our explainer on what AmneziaWG 2.0 is first. This guide is the practical follow-up.
What you need before starting
A VPS (virtual private server). Any provider that gives you root SSH access works: DigitalOcean, Hetzner, Vultr, and similar budget providers are all common choices in Amnezia’s own community guides. Pick a location outside the country where you’re trying to evade censorship, since a server inside a heavily monitored jurisdiction defeats part of the purpose.
SSH access details. You’ll need the server’s IP address, the root username, and either a password or an SSH key, whichever your VPS provider gave you at setup.
The AmneziaVPN app, downloaded from Amnezia’s official site or app store listing for your platform (Windows, macOS, Linux, iOS, or Android). Make sure you’re on version 4.8.12.9 or later, since earlier versions don’t support AmneziaWG 2.0.
Step 1: Rent a VPS
Sign up with a VPS provider and spin up the cheapest instance available. AmneziaWG doesn’t need much horsepower, a $5 to $6 a month plan with 1 vCPU and 1GB of RAM is enough for personal use covering a handful of devices. Choose a standard Ubuntu or Debian image, since these are the most reliably supported by Amnezia’s automated setup script.
Note down the server’s public IP address once it’s running. You’ll need it in the next step.
Step 2: Connect the AmneziaVPN app to your server
Open the AmneziaVPN app and choose the option to configure a self-hosted server (sometimes labeled “connect your server” or similar, depending on the app version). Enter your VPS’s IP address and your SSH credentials (root username plus password or key).
The app connects over SSH and installs the necessary server software automatically. You don’t need to manually run installation commands on the VPS yourself, the app’s setup wizard handles package installation and configuration in the background.
Step 3: Choose AmneziaWG as your protocol
During setup, the app will ask which protocol (or protocols) to install on the server. AmneziaVPN supports several, including OpenVPN, standard WireGuard, Shadowsocks, and AmneziaWG. Select AmneziaWG, and make sure you’re deploying version 2.0 rather than the original AmneziaWG if the app gives you that choice explicitly (this depends on your app version; check Amnezia’s release notes if you’re unsure which one your install defaults to).
You can install more than one protocol on the same server if you want a fallback option. This is worth doing if you’re in a location where you’re actively testing which protocol gets through most reliably.
Want to compare all VPNs side by side? Check our full VPN comparison table with scores across 18 criteria.
Step 4: Let the app generate your client configuration
Once the server-side installation finishes, the app automatically generates a client configuration profile for the device you’re using. This includes your keys and connection settings, you don’t need to create or edit configuration files by hand.
If you want to connect additional devices, most versions of the app let you export the configuration as a QR code or a .conf file, which you can then import into the AmneziaVPN app (or a compatible WireGuard-based client) on your other devices.
Step 5: Test the connection
Connect through the app and check that your traffic is actually routing through your server. A quick way to confirm this: check your IP address before and after connecting (any “what’s my IP” site works) and make sure it matches your VPS’s location rather than your real one.
If you’re testing this specifically for censorship resistance, the more meaningful test is whether you can reach sites and services that are normally blocked in your location. Test this cautiously and be aware of your local legal situation before doing so.
Troubleshooting common issues
Connection times out during setup. Double check your SSH credentials and make sure your VPS provider hasn’t blocked incoming SSH connections from unfamiliar IPs by default (some providers require you to whitelist your own IP first).
The app can’t reach the server after installation. Confirm your VPS’s firewall isn’t blocking the ports AmneziaWG uses. Most VPS providers ship with a permissive default firewall, but some managed images lock things down by default.
Traffic isn’t actually rerouting. Restart the app and reconnect. If the issue persists, remove the profile and regenerate it from the self-hosted server setup screen, configuration mismatches after an app update are the most common cause.
Choosing a VPS provider
Not all VPS providers are equally good fits for this. A few things worth checking before you commit to one:
Location options. You want a data center outside the country where you’re evading censorship, and ideally somewhere with reasonable network latency to your actual location, since a server on the wrong continent adds noticeable lag even with a fast protocol.
Payment anonymity, if that matters to your threat model. Some VPS providers accept cryptocurrency, which decouples your server rental from your real identity more than a credit card does. If your reason for self-hosting AmneziaWG involves genuine personal risk, this is worth thinking through before you sign up rather than after.
A clean IP reputation. Cheap VPS providers sometimes reuse IP addresses that were previously flagged for abuse by a prior tenant. If your new server’s IP is already on a blocklist somewhere, you’ll spend time troubleshooting a problem that has nothing to do with your AmneziaWG configuration.
Security hardening after setup
Getting AmneziaWG running is the first step, not the last one. A few things worth doing once your server is live:
Disable password-based SSH login and switch to key-based authentication. The AmneziaVPN app’s initial setup often uses password auth to get started, but leaving that in place afterward gives anyone who finds your server’s IP a straightforward target for brute-force attempts.
Keep the underlying OS updated. AmneziaVPN handles the VPN software itself, but the base Ubuntu or Debian image still needs regular security patches like any other server you’re responsible for.
Restrict SSH access to your own IP if it’s static, or use a VPS provider’s firewall rules to limit which addresses can even attempt to connect. This closes off most opportunistic scanning traffic before it reaches your login prompt at all.
Is self-hosting worth the effort
For most people, no, not for everyday use. A commercial VPN with obfuscated servers, like the options covered in our best audited no-logs VPN roundup, is faster to set up and doesn’t put you on the hook for server maintenance or your own IP’s reputation. Self-hosting AmneziaWG makes the most sense if you’re specifically dealing with DPI-based blocking that’s already defeating your current VPN, or if you simply want full control over your own infrastructure rather than trusting a provider’s claims.
Setting up AmneziaWG 2.0 takes about twenty minutes if you already have a VPS, and the AmneziaVPN app removes most of the manual configuration work. It's the right project for anyone dealing with active DPI blocking or who wants a self-hosted alternative outside the commercial VPN market. For everyone else, a commercial VPN with built-in obfuscation remains the faster, lower-maintenance choice.
Keep reading: How to Set Up a VPN on an OpenWrt Router and Obfuscated Servers Explained