AmneziaWG vs WireGuard: what's the difference and why it matters

WireGuard: a brief history

WireGuard appeared in 2016 as a project by Jason A. Donenfeld and quickly became one of the most discussed VPN protocols in the world. Its main idea is minimalism. Unlike OpenVPN, which has about 600,000 lines of code, the WireGuard core contains only about 4,000. This makes the protocol lightweight, fast and easier to audit.

In 2020, WireGuard was included in the Linux kernel (version 5.6), which became a historic event: for the first time, a VPN protocol became part of the operating system rather than an external module. Today WireGuard is available on all major platforms — Windows, macOS, Linux, iOS, Android — and is considered the benchmark of speed and modern design.

Main advantages of WireGuard:

• Speed. Minimal overhead thanks to a simple cryptographic stack: Noise Protocol Framework, Curve25519, ChaCha20, Poly1305, BLAKE2s.
• Simplicity. Configuration is just a few lines in a text file. No bulky certificates or chains of trust.
• Performance. Easier on the battery of mobile devices, lower latency, more stable connection.
• Security. Modern cryptography "out of the box", with no possibility of insecure configuration.

Sounds perfect. But there is one "but".

What is DPI and why it matters

DPI (Deep Packet Inspection) is a technology for deep analysis of network packets. In short: an ISP or a government surveillance system looks inside every packet passing through the network and tries to determine which protocol you are using.

In Russia, DPI is used by Roskomnadzor as part of the TSPU system (Technical Means for Counteracting Threats) and earlier solutions — "Zablokiruy Burzhuya", "Merkuriy" and others. As of 2026, these systems are deployed at all major ISPs and operate with high efficiency.

What DPI can do:

• Determine the protocol type by signature — a unique set of bytes in the packet header.
• Analyze traffic patterns — packet sizes, sending intervals, flow direction.
• Block connections matching known VPN protocols in real time.

So even if your VPN traffic is encrypted, DPI can still figure out that it is a VPN — and block it.

How WireGuard gets blocked

Even though WireGuard encrypts the contents of packets, its header remains recognizable. The protocol has a clear signature — a fixed set of bytes at the start of every UDP packet:

1. Static header. The first 4 bytes of WireGuard's UDP payload always contain the value 0x01000000 (protocol version). It is like a label on an envelope: "I am WireGuard".
2. Packet sizes. WireGuard generates a characteristic sequence of packet sizes when establishing a connection — Handshake Initiation (148 bytes), Response (60 bytes), Cookie Reply (48 bytes). DPI analyzes this "sequence".
3. Traffic behavior. After the connection is established, WireGuard sends packets with regular periodicity (keep-alive) and characteristic sizes, which distinguishes it from regular UDP traffic.

ISPs in Russia learned to recognize WireGuard by 2023, and by 2025 blocks became widespread. It looks like this: you launch WireGuard, the connection is established for the first seconds, but after 3–10 seconds traffic drops. DPI detected the signature and sent an RST packet or simply started dropping packets.

Popular workarounds — changing the port, tunneling through TLS, using obfs plugins — do not last long. DPI systems learn new patterns, and within a week or two the old method stops working again. This is an endless arms race in which DPI always has the advantage — it analyzes your traffic centrally, while you configure the client locally.

WireGuard "out of the box" is not suitable for bypassing blocks in Russia. The protocol was designed for an open internet, not for an environment with aggressive filtering.

AmneziaWG: what it is and how it works

AmneziaWG is a fork of WireGuard developed by the AmneziaVPN project team. The key goal is to make the protocol invisible to DPI without losing WireGuard's speed and security.

The idea is simple: add an obfuscated layer to standard WireGuard that masks traffic as regular HTTPS or another "allowed" type. DPI sees a packet but cannot determine that it is a VPN.

AmneziaWG works over the same UDP transport and uses the same cryptography (Noise Protocol, Curve25519, ChaCha20), but modifies the packet structure and protocol behavior. To the user it looks just like regular WireGuard — same speed, same ping, but the connection does not drop.

Main differences from WireGuard:

• The static header signature is removed — the first bytes of the packet no longer contain a fixed value.
• Obfuscated header parameters (Jc, Jmin, Jmax, S1–S4, H1–H4) are added, which "litter" the packets.
• The handshake behavior is disguised as regular traffic.
• Keep-alive packets have variable sizes, which makes pattern analysis harder.

Obfuscated header parameters

AmneziaWG adds a set of parameters that create the obfuscating effect. Let's look at each one simply.

Jc (Junk packets count)

The number of "junk" packets added to the Handshake sequence. These packets carry no payload but create noise that confuses DPI. The higher the Jc, the more noise, but also the more traffic is required to establish the connection.

Jmin and Jmax (Junk packet minimum/maximum size)

The minimum and maximum size of junk packets. Instead of a fixed size (as in WireGuard), junk packets have a random size from the range [Jmin, Jmax]. This breaks the size analysis that DPI uses.

S1–S4 (Init packet junk size)

The sizes of "junk" bytes added to the Init packet (the first Handshake packet). Each of the four parameters defines the size of a separate block of junk in different parts of the packet. The result — the Init packet has a variable length and does not match the known WireGuard signature.

H1–H4 (Init packet header junk size)

The sizes of junk bytes inserted directly into the packet headers. These are critically important parameters: they are what change the header structure, making the packet unrecognizable to DPI.

It is important to understand: all these parameters must match on the client and server. If one side has Jc=5 and the other Jc=3, the connection will not be established. It is like a password — both sides must know the obfuscation "key".

Comparison of WireGuard and AmneziaWG

Parameter	WireGuard	AmneziaWG
Speed	Excellent — minimal overhead	Excellent — on par with WireGuard, obfuscation adds < 1% overhead
Latency	Minimal	Minimal — junk packets do not affect ping
Encryption	Noise Protocol, Curve25519, ChaCha20-Poly1305	The same — an identical cryptographic stack
Obfuscation	None — the signature is recognized by DPI	Built-in — Jc, Jmin, Jmax, S1–S4, H1–H4
Bypassing blocks	Does not work in Russia since 2023	Works reliably, traffic is not recognized by DPI
Compatibility	Standard — supported by all OSes and clients	Compatible with WireGuard at the encryption level; an AmneziaWG client is required
Open-source	Yes — GPLv2 license	Yes — GPLv2 license, code available on GitHub
Traffic overhead	0%	~0.5–1% (junk packets)
Installation	Simple — config file	Simple — a similar config plus obfuscation parameters
Mobile devices	Lightweight, saves battery	The same — additional packets have a minimal impact on power consumption

When to use WireGuard and when AmneziaWG

The answer depends on where you are and what exactly you need.

WireGuard is suitable if:

• You are in a country without DPI blocks on VPNs (most EU countries, Canada, USA, Japan).
• You need maximum compatibility — you want to use built-in clients and standard configs.
• You are setting up a site-to-site VPN between offices with no risk of blocking.
• Every fraction of a percent of performance matters to you (server environments, containers).

AmneziaWG is suitable if:

• You are in Russia or another country with active DPI blocks on VPNs.
• Standard WireGuard drops for you 3–10 seconds after connecting.
• You need stability — you do not want to look for new ways to bypass blocks every day.
• You use mobile internet from carriers that aggressively filter traffic.
• You work remotely from Russia and stable access to corporate resources abroad is critical for you.
• You travel across regions with different levels of blocking and want one reliable protocol for all cases.

Why Plan B uses AmneziaWG specifically

Plan B is a VPN service for Russian-speaking users who want stable access to the internet without blocks. We bet on AmneziaWG for several reasons:

1. Reliable bypassing of blocks. AmneziaWG does not just mask traffic — it changes the very structure of the protocol. DPI cannot tell it apart from ordinary UDP noise, even using machine learning. This is not a hack or a workaround, but an architectural solution.
2. Cascade RU→EU architecture. Plan B uses a cascade connection: traffic goes through a Russian server and is then forwarded to the EU. This means DPI sees a connection to a Russian IP (which looks like regular traffic), while the real VPN tunnel is hidden.
3. Performance on par with WireGuard. Obfuscated headers add less than 1% to the packet size. You will not notice any difference in speed between WireGuard and AmneziaWG — neither when downloading files, nor on video calls, nor when streaming.
4. Open-source and transparency. AmneziaWG is an open project. Anyone can review the code and verify that there are no backdoors. We do not trust on word alone — we verify the code.

We are not saying that WireGuard is a bad protocol. It is excellent engineering. But it was created for a world without censorship. AmneziaWG is WireGuard adapted to the reality we live in.

Compatibility with various telecom operators deserves special attention. In Russia, dozens of major ISPs and mobile operators operate, each using its own DPI settings and different equipment versions. Some block WireGuard aggressively, others more softly, and others occasionally. AmneziaWG shows stable operation across all major operators: Rostelecom, MTS, Beeline, Megafon, Tele2 and regional providers. This is confirmed by numerous user tests and independent reviews.

How to set up AmneziaWG

Setting up AmneziaWG is no harder than regular WireGuard. If you have ever configured WireGuard, the process will look familiar. Here is the general procedure:

1. Install the AmneziaWG client. On Android and iOS — from the App Store / Google Play (the AmneziaVPN app). On Windows, macOS, Linux — from the GitHub releases of the AmneziaVPN project, or use custom clients that support obfuscation parameters.
2. Get a configuration file. Services based on AmneziaWG (including Plan B) provide a config — a text file with keys and obfuscation parameters. The file contains an [Interface] section with your private key and a [Peer] section with the server's public key, address and obfuscation parameters.
3. Import the config. Open the client, click "Add tunnel", paste the config or load the file. Some clients also support QR codes for quick setup on mobile devices.
4. Connect. Press the Connect button. If everything is configured correctly, the connection will be established in 1–2 seconds and will be stable.

The obfuscation parameters (Jc, S1–S4, H1–H4) are already contained in the configuration file and are configured automatically. You do not need to understand them manually — that is the task of the server and the provider. The client simply applies the values from the config.

Frequently asked questions

Is AmneziaWG secure?

Yes. AmneziaWG uses the same cryptographic stack as WireGuard: the Noise Protocol Framework with Curve25519, ChaCha20-Poly1305, BLAKE2s. The modification concerns only the transport layer (header obfuscation), not data encryption.

Will obfuscation slow down the connection?

Imperceptibly. Junk packets add less than 1% to the total traffic volume. At real speeds (even 100 Mbps) the difference is just a few kilobits — you will not feel it.

Can AmneziaWG be used together with WireGuard?

Yes. These are two different protocols on the same transport (UDP). You can run both simultaneously — WireGuard for resources where there are no blocks, and AmneziaWG for everything else.

If a VPN provider uses AmneziaWG, does that mean it is a "front"?

No. AmneziaWG is a tool. Like any tool, it can be used honestly or dishonestly. Plan B is an open service with a transparent policy: no activity logs, no data sales. We use AmneziaWG not to hide our own work, but to protect yours.

Conclusion

WireGuard is an outstanding VPN protocol created for a world without censorship. In Russia and a number of other countries, it has become useless due to DPI blocks. AmneziaWG is not a "hack" or a "workaround", but an evolution of WireGuard: the same level of speed and security, complemented by an obfuscated transport layer.

If you are in Russia and want a stable VPN, choose solutions based on AmneziaWG. Plan B uses exactly this protocol, and that is why our users do not face connection drops, do not look for "working servers" every day and can count on stable access to any resources — regardless of what blocks Roskomnadzor introduces.