Published May 22, 2026
AmneziaWG vs WireGuard: Which to Choose in 2026
How AmneziaWG differs from WireGuard, why its obfuscation defeats Roskomnadzor's DPI, and exactly when to pick each protocol amid the 2026 blocking wave.
In short: WireGuard is the fastest and simplest modern VPN protocol, but its traffic is easily fingerprinted by Deep Packet Inspection (DPI). AmneziaWG is the same WireGuard with obfuscation added: it masks the protocol's tell-tale signature, so it keeps working in places where plain WireGuard is already detected and blocked. In Russia in 2026, that is the deciding factor for a stable connection.
In brief: both protocols share the same cryptography and nearly the same speed. The difference is how the traffic looks from the outside. Plain WireGuard is visible to DPI via its fixed header and predictable handshake, and it is increasingly throttled at the carrier level. AmneziaWG (branded "AWG 2.0" at Fiery) adds junk packets, randomized headers and signature spoofing, so to DPI the flow looks like harmless UDP noise. If your WireGuard stopped connecting, switch to AmneziaWG.
What AmneziaWG and WireGuard have in common
AmneziaWG is a fork of WireGuard, not a protocol built from scratch. The Amnezia team took the original implementation and left the most important part untouched: the cryptography. Key exchange is still based on the Noise framework (Noise_IK), using the same primitives, Curve25519 for keys and ChaCha20-Poly1305 for data encryption. This means AmneziaWG's security level is identical to WireGuard's: no home-grown crypto, only proven algorithms.
Performance is almost identical too. The core is the same and the obfuscation overhead is minimal, so under normal conditions the speed difference is unnoticeable. For how WireGuard compares to other protocols, see our VPN protocols compared article.
Why plain WireGuard gets blocked but AmneziaWG does not
WireGuard's weakness is its own elegance. The protocol was designed for simplicity and speed, not stealth. It has distinctive markers that let DPI identify it almost instantly:
- Fixed header. The first byte of a packet carries the message type (handshake initiation, response, data) in a predictable form. DPI simply reads this signature.
- Recognizable handshake. WireGuard's handshake has a constant length and structure, easy to spot from the size of the first packets.
- Flow behavior. Characteristic packet sizes and timings reveal the protocol even without reading the contents.
AmneziaWG attacks exactly these markers. Crucially, obfuscation operates at the transport layer and leaves the payload untouched, so internally it remains WireGuard-compatible traffic. From the outside, DPI sees a random sequence of UDP packets with no recognizable structure. This is achieved through three mechanisms.
Junk packets (Jc, Jmin, Jmax)
Before the connection is established and at the start of the session, the client sends a series of "junk" packets of random length (the Jc parameter sets how many, Jmin and Jmax the size range). These packets carry no meaning but blur the characteristic profile of session start, so DPI cannot latch onto the usual handshake size and timing.
Magic header randomization (H1-H4)
Instead of fixed message-type values, AmneziaWG substitutes random "magic headers" from a configured range for four packet types. The signature DPI uses to recognize WireGuard simply disappears, it is unique per user and keeps changing.
Signature (I-) packets and AWG 2.0
Parameters I1-I5 let the client send up to five decoy packets that mimic the start of another protocol, for example disguising the flow as an ordinary QUIC session. Version AWG 2.0 went further: instead of static values it uses dynamic header ranges and adds random padding bytes to all message types, not just the handshake. As a result, not only the moment of connection but the entire data stream is masked.
May 2026: what is actually happening with blocking
Context matters, because it explains why this choice became urgent now. Pressure on VPNs grew throughout 2025: Roskomnadzor learned to suppress unidentified UDP traffic, prompting the Amnezia team to release AWG 1.0 β 1.5 β 2.0 in succession. By early 2026 hundreds of VPN services were restricted, and blocking of VLESS and other protocols was added in several regions.
In May 2026 the pressure escalated to ASN- and subnet-level blocking: instead of individual connections, entire address ranges are cut off, and in some places both plain WireGuard and VLESS Reality were affected. Against this backdrop, obfuscated AmneziaWG proves the most resilient option, precisely because its traffic gives away no signature. This does not mean WireGuard is "dead": where there is no blocking, it remains faster and simpler. It is about choosing for the specific situation. For the mechanics of blocking, see why VPNs don't work in Russia.
Comparison: AmneziaWG vs WireGuard
| Criterion | WireGuard | AmneziaWG (AWG 2.0) |
|---|---|---|
| Speed | Maximum | Practically the same (minimal overhead) |
| Detectability by DPI | High, recognized by signature | Low, looks like random UDP |
| Cryptography | Noise, Curve25519, ChaCha20-Poly1305 | The same, unchanged |
| Resistance to 2026 blocking | Under pressure, throttled in places | High, most reliable right now |
| Router support | Built-in (Keenetic, MikroTik, OpenWRT) | Limited, usually needs a client app |
| Ease of setup | Very simple | Simple via the AmneziaVPN app |
| When to choose | No blocking, need max speed or a router | WireGuard is blocked or unstable |
When to choose which protocol
A simple rule: start with WireGuard, switch to AmneziaWG when you hit problems.
- Choose WireGuard if your ISP has no aggressive blocking and the connection is stable, or if you need a VPN directly on your router. Native WireGuard support on Keenetic, MikroTik and OpenWRT is a big convenience: set it up once and every device on the network is protected. More on that in our router VPN guide.
- Choose AmneziaWG if plain WireGuard has stopped connecting, keeps dropping or runs unstably; if you are in a region with aggressive DPI; or if you simply want to play it safe and go straight for the most resilient option.
How to set up AmneziaWG (AWG 2.0)
Unlike plain WireGuard, which installs almost everywhere as-is, AmneziaWG needs a compatible client that understands the obfuscation parameters. The easiest path is the official AmneziaVPN app, available for Windows, Android and iOS.
- Get an AWG 2.0 configuration from your VPN service. At Fiery you can obtain one in the Telegram bot @fiery_VPN_bot or the mini-app.
- Install the AmneziaVPN app on your device from the official store.
- Import the configuration (via link, file or QR code), all obfuscation parameters are pulled in automatically.
- Connect. If the connection is stable, there is nothing else to configure.
Parameters like Jc, Jmin/Jmax and the magic headers are set by the provider on the server side; you do not need to touch them manually, just import the ready-made profile.
FAQ
Is AmneziaWG slower than WireGuard?
In practice the difference is unnoticeable. The protocols share the same core, and obfuscation adds only a small amount of overhead traffic. In most scenarios AmneziaWG matches WireGuard's speed, and the gain in stability under blocking more than makes up for it.
Is AmneziaWG as secure as WireGuard?
Yes. AmneziaWG does not change WireGuard's cryptography, it uses the same Noise_IK, Curve25519 and ChaCha20-Poly1305. Obfuscation only affects how packet headers look, not the encryption itself.
Can I run AmneziaWG on a router?
Router support is still limited and depends on the firmware. Plain WireGuard works on Keenetic, MikroTik and OpenWRT out of the box, while for AmneziaWG it is usually more convenient to use the AmneziaVPN app on the device. If a router without blocking is what you need, choose WireGuard.
Why did my WireGuard suddenly stop working?
Most likely your carrier or Roskomnadzor started detecting and throttling WireGuard traffic by signature, or blocked the server's subnet. The most reliable fix in 2026 is to switch to obfuscated AmneziaWG.
What is the difference between AWG 1.5 and AWG 2.0?
AWG 2.0 uses dynamic header ranges instead of static values and adds random padding to all message types, not just the handshake. This masks not only the moment of connection but the entire data stream, improving resistance to modern DPI.
Don't want to fiddle with parameters by hand? At Fiery VPN, AmneziaWG ("AWG 2.0") is already configured and ready to go: import the profile into the AmneziaVPN app and connect. WireGuard and VLESS Reality are supported too, with payment by MIR cards, SBP and crypto, and a no-logs policy. Get access at vpn.fiery.host or via the Telegram bot @fiery_VPN_bot.