Firewalla's VPN Server supports OpenVPN, WireGuard, and AmneziaWG protocols. This is our guide on configuring an AmneziaWG VPN. To learn more about Firewalla's VPN Server, please refer to this article: Firewalla VPN Server.
AmneziaWG is in beta.
AmneziaWG is WireGuard-based, a fast and reliable VPN protocol due to its compact codebase and high efficiency. However, WireGuard traffic packets can be easily identified and blocked. AmneziaWG solves this issue by obfuscating its traffic to disguise it as popular UDP protocols. (References: https://docs.amnezia.org/documentation/amnezia-wg/, https://github.com/amnezia-vpn/amneziawg-go)
- Like WireGuard, AmneziaWG is UDP-based (OpenVPN can run over TCP or UDP) and is rated to perform 1.5-2x faster than OpenVPN (on Firewalla Gold series)
- AmneziaWG only modifies packet headers and adds "junk" data to obfuscate traffic and bypass VPN blocking.
- Compared to WireGuard, AmneziaWG may use a bit more network bandwidth and be a bit slower due to obfuscation; AmneziaWG is likely to perform better when used in places where WireGuard is blocked.
Note:
- To use AmneziaWG as a client, see VPN Client.
- The AmneziaWG VPN Server currently does not support I1-I5 parameters.
- To support legacy AmneziaWG apps, the VPN profile created by the Firewalla app uses AmneziaWG 1.5. See how to upgrade to AmneziaWG 2.0.
To configure the Firewalla AmneziaWG Server:
- Enable AmneziaWG
- Configure Port Forwarding
- Connect to Firewalla AmneziaWG VPN Server
- VPN Device Management
- Customize Your AmneziaWG Settings
- Upgrade to AmneziaWG 2.0
1. Enable AmneziaWG
Tap the VPN Server icon on your Firewalla's main screen, then tap the AmneziaWG button to turn it on.
2. Configure Port Forwarding
Similar to OpenVPN and WireGuard, AmneziaWG requires its port to be accessible from outside your network.
- If you are using Firewalla in Router mode without double NAT or CGNAT, skip this step. Port Forwarding will be shown as complete.
- In all other cases, you will need to make some configurations:
- If you're under double NAT, you can manually set up port forwarding. Tutorial: How to set up port forwarding for VPN Server
- If you have a working IPv6 address or another WAN with a public IP address, you can change your DDNS to “IPv6 only” or use your other WAN. This is especially useful if you're under CGNAT and your ISP doesn't allow port forwarding. To do this, tap your server's Setup, then tap DDNS. You can then modify its IP Address Type and WAN Interface as needed
3. Connect to Firewalla AmneziaWG VPN Server
Step 1: Add Clients in the Firewalla App
To connect your mobile device or computer to the Firewalla VPN server, you'll first need a VPN profile.
In the Firewalla app, tap Setup -> Add a Client to create a client automatically. Tap the client, and it will show you a profile and a QR code.
Note:
- All WireGuard and AmneziaWG VPN Server clients count toward the same total client limit.
- Production Firewalla Boxes:
- Up to 25 total clients
- Firewalla Gold Pro: Up to 50 total clients
- Beta & Early Access Firewalla Boxes:
- Up to 100 total clients
- Firewalla Gold Pro: Up to 200 total clients
- Production Firewalla Boxes:
- You can remove a client by tapping 'Delete This Client' at the bottom of the client profile.
- Please do NOT use the same VPN profile on different AmneziaWG clients at the same time.
Step 2: Set Up The AmneziaWG App
To connect to the VPN server, you will need to install the AmneziaWG app on your mobile or desktop device. Here is the installation guide provided by AmneziaWG. (This app is NOT implemented by the Firewalla Team)
Alternatively, the AmneziaVPN app (https://amnezia.org/downloads) should work the same, but the screenshots in this guide use AmneziaWG and may differ.
There are two ways to use the AmneziaWG app to connect your device to the AmneziaWG VPN Server:
- Create from file, then "Open in AmneziaWG"
- Create from a QR code.
Depending on which method you select, you'll need to access either the VPN client profile or QR code from the Firewalla App. Here is an example of the AmneziaWG app on iOS:
If you're setting up your personal device as the client, you can also quickly open the profile with the AmneziaWG app to simplify the process. Here is an example on iOS:
4. VPN Device Management
The AmneziaWG VPN Server creates a local network on Firewalla. All the devices will join the network once connected to the VPN. Each VPN device corresponds to a VPN client you created in the VPN server setup.
On the Devices list, tap the AmneziaWG network or a VPN device. You can view network flows and basic info, receive alarms, and apply rules or features to the entire VPN network or to any VPN device individually, just like any local device. You can learn more about device management here.
VPN Device Isolation
Device Isolation is supported on VPN devices (even if you don't have a Firewalla AP7 or Switch).
When a device is connected to your network via AmneziaWG VPN, you can enable Device Isolation to block it from communicating with any other devices.
5. Customize Your AmneziaWG Settings
5.1 On-Demand Activation
If you want to ensure a device (such as your kids’ phone) always connects to your Firewalla VPN server, you can turn on On-Demand Activation in the AmneziaWG app. This will automatically turn on your VPN connection when your device connects to cellular data and/or Wi-Fi.
5.2 On-Demand Activation Exceptions
You can also add an exception. While you're editing your AmneziaWG configuration, enable the cellular and Wi-Fi options under On-Demand Activation. Then, tap SSIDs. Tap Except these SSIDs, then enter the name of your home network.
(iOS or Mac only; for other OSs, you will need to use a separate 3rd-party app)
5.3 Adjust MTU (Advanced)
Some ISPs require a different MTU value to establish VPN connections. If you hit this issue, go to the VPN Servers page > tap Setup under AmneziaWG > tap any client > tap MTU in the advanced settings.
Note that after updating your VPN profile, you'll need to download the new profile and re-import it to your VPN client app and re-establish the connection.
Please use caution when changing this setting. Most clients do not require specifying an MTU value.
6. Upgrade to AmneziaWG 2.0
To get AmneziaWG 2.0, you will need App 1.69 and Box 1.983 or later.
Important Note:
- Upgrading to AmneziaWG 2.0 cannot be undone. You cannot downgrade to version 1.0.
- After upgrading to 2.0, all previously imported AmneziaWG VPN profiles with version 1.0 will stop working.
- You must re-import all AmneziaWG VPN profiles to client devices after upgrading to version 2.0.
Go to VPN Server > AmneziaWG > tap Upgrade to 2.0 on the AmneziaWG 2.0 banner.
Comments
7 comments
What version of Amnezia is Firewalla currently running? 2.0?
Hi CWest, we implement AmneziaWG extensions on top of WireGuard, which is compatible with the parameters used by the AmneziaWG 2.0 configuration.
Does that mean we can set S3 and S4 and ranges for the H parameters?
The AmneziaWG app does now allow on-demand activation as presented, on Android, only iOS. Same problem with the official Wireguard app. I recommend using the WG Tunnel app instead, which works for both Wireguard and Amnezia WG.
this VPN worked for the purpose I needed to bypass the VPN restrictions. thanks for adding this and it was a nice added feature. :)
I was wondering if there is any ETA for adding this for VPN client or FW to FW connection to leverage the Amnezia ?
I've only had very limited success at evading VPN block. I tested it by connecting to my company's guest wifi which blocks VPN. I was able to get some limited traffic on my Facebook app but that's about it. Could not access any website, could not reach my Firewalla. So some systems I think block traffic not specifically because it's VPN but because it's encrypted and it can't be filtered so it just stops it, and Amnezia doesn't bypass that setup.
Thanks for the detailed guide. The explanation of how AmneziaWG obfuscates WireGuard traffic while maintaining good performance was really helpful. It would be great to see future benchmarks comparing latency, throughput, and packet overhead against standard WireGuard in different network conditions.
Please sign in to leave a comment.