AmneziaWG Architect

A browser-based configuration generator for AmneziaWG — a WireGuard fork that adds transport-layer obfuscation to defeat deep packet inspection (DPI). The tool runs entirely client-side (Vue 3 + TypeScript + Vite), no backend, no analytics, works offline.

AmneziaWG keeps WireGuard's cryptographic core (Curve25519, ChaCha20-Poly1305, BLAKE2s) but wraps packets to look like something else on the wire. Standard WireGuard has a recognizable handshake pattern that DPI systems can fingerprint and block. AmneziaWG defeats this by adding:

• Junk packets (Jc/Jmin/Jmax) — random noise packets injected into the stream
• Header manipulation (H1–H4) — custom values that change the packet signature
• Size randomization (S1–S4) — variable padding so packets don't have WireGuard's characteristic sizes
• Protocol signatures (I1–I5) — CPS (Connection Pattern Signatures) that make traffic look like a known protocol

The Architect tool generates these parameters across 9 protocol mimicry profiles: QUIC Initial, QUIC 0-RTT, TLS 1.3, DTLS, SIP, HTTP/3, Noise_IK, and browser fingerprints (Chrome, Firefox, Safari packet patterns). You pick a profile, it outputs the parameter set you paste into your AmneziaWG config.

There's also a MergeKeys tool that decodes existing vpn:// AmneziaWG keys (base64 + zlib), patches in new obfuscation parameters, and re-encodes. Useful when you already have a working key and just want to update the obfuscation layer without regenerating everything.

Three protocol versions are supported:

• AWG 1.0 — basic H1–H4, S1–S2, junk packets
• AWG 1.5 — adds client-side I1–I5 signatures
• AWG 2.0 — full bidirectional sync, dynamic H-ranges, S3–S4, server+client I1–I5

The tool includes a feedback loop: if a generated config doesn't connect, you report the result and it auto-strengthens the parameters.

This is a different approach to censorship circumvention than the Xray-based stack (3x-ui, xray-tutorial, russia-v2ray-rules-dat). Xray uses application-layer proxy protocols (VLESS, VMess, Trojan) that look like HTTPS. AmneziaWG operates at the transport layer, disguising WireGuard's UDP packets. Both aim to evade DPI but from different angles — AmneziaWG is simpler to set up (it's still just WireGuard under the hood) while the Xray stack offers more flexible routing and multi-protocol support. mihomo can use WireGuard as one of its proxy protocols, though it uses standard WireGuard, not AmneziaWG.

Repo: https://github.com/Vadim-Khristenko/AmneziaWG-Architect — 95 stars, MIT license.