Firewalla's VPN Server supports OpenVPN, WireGuard, and AmneziaWG protocols. This is our guide on configuring an AmneziaWG VPN. To learn more about Firewalla's VPN Server, please refer to this article: Firewalla VPN Server.
This feature is in beta and requires Box 1.982 or later.
AmneziaWG is WireGuard-based, a fast and reliable VPN protocol due to its compact codebase and high efficiency. However, WireGuard traffic packets can be easily identified and blocked. AmneziaWG solves this issue by obfuscating its traffic to be disguised as popular UDP protocols. (References: https://docs.amnezia.org/documentation/amnezia-wg/, https://github.com/amnezia-vpn/amneziawg-go)
- Like WireGuard, AmneziaWG is UDP-based (OpenVPN can run over TCP or UDP) and is rated to perform 1.5-2x faster than OpenVPN (on Firewalla Gold series)
- AmneziaWG only modifies packet headers and adds "junk" data to obfuscate traffic and bypass VPN blocking.
- Compared to WireGuard, AmneziaWG may use a bit more network bandwidth and be a bit slower due to obfuscation; AmneziaWG is likely to perform better when used in places where WireGuard is blocked.
Please Note:
- Editing the AmneziaWG VPN Network and MTU will be supported in future updates.
- AmneziaWG is only available for VPN Server. VPN Client will be supported in future updates.
- The AmneziaWG VPN Server currently does not support I1-I5 parameters.
- In order to support legacy AmneziaWG apps, the VPN profile created by the Firewalla app still uses AmneziaWG 1.5. See Upgrade to AmneziaWG 2.0.
To configure the Firewalla AmneziaWG Server:
- Enable AmneziaWG
- Configure Port Forwarding
- Connect to Firewalla AmneziaWG VPN Server
- VPN Device Management
- Customize Your AmneziaWG Settings
- Upgrade to AmneziaWG 2.0
1. Enable AmneziaWG
Tap the VPN Server icon on your Firewalla's main screen, then tap the AmneziaWG button to turn it on.
2. Configure Port Forwarding
Similar to OpenVPN and WireGuard, AmneziaWG requires its port to be accessible from outside your network.
- If you are using Firewalla in Router mode without double NAT or CGNAT, skip this step. Port Forwarding will be shown as complete.
- In all other cases, you will need to make some configurations:
- If you're under double NAT, you can manually set up port forwarding. Tutorial: How to set up port forwarding for VPN Server
- If you have a working IPv6 address or another WAN with a public IP address, you can change your DDNS to “IPv6 only” or use your other WAN. This is especially useful if you're under CGNAT and your ISP doesn't allow port forwarding. To do this, tap your server's Setup, then tap DDNS. You can then modify its IP Address Type and WAN Interface as needed
3. Connect to Firewalla AmneziaWG VPN Server
Step 1: Add Clients in the Firewalla App
To connect your mobile device or computer to the Firewalla VPN server, you'll first need a VPN profile.
On the Firewalla app, tap Setup -> Add a Client, and a client will be created automatically. Tap the client, and it will show you a profile and a QR code.
Note:
- All WireGuard and AmneziaWG VPN Server clients count toward the same total client limit.
- Production Firewalla Boxes:
- Up to 25 total clients
- Firewalla Gold Pro: Up to 50 total clients
- Beta & Early Access Firewalla Boxes:
- Up to 100 total clients
- Firewalla Gold Pro: Up to 200 total clients
- Production Firewalla Boxes:
- You can remove a client by tapping 'Delete This Client' at the bottom of the client profile.
- Please do NOT use the same VPN profile on different AmneziaWG clients at the same time.
Step 2: Set Up The AmneziaWG App
To connect to the VPN server, you will need to install the AmneziaWG app on your mobile or desktop device. Here is the installation guide provided by AmneziaWG. (This app is NOT implemented by the Firewalla Team)
There are two ways to use the AmneziaWG app to connect your device to the AmneziaWG VPN Server:
- Create from file, then "open in AmneziaWG"
- Create from QR code.
Depending on which method you select, you'll need to access either the VPN client profile or QR code from the Firewalla App. Here is an example of the AmneziaWG app on iOS:
If you're setting up your personal device as the client, you can also quickly open the profile with the AmneziaWG app to simplify the process. Here is an example on iOS:
4. VPN Device Management
The AmneziaWG VPN Server creates a local network on Firewalla. All the devices will join the network once connected to the VPN. Each VPN device corresponds to a VPN client you created in the VPN server setup.
On the Devices list, tap the AmneziaWG network or a VPN device. You can view network flows and basic info, receive alarms, and apply rules or features to the entire VPN network or to any VPN device individually, just like any local device. You can learn more about device management here.
5. Customize Your AmneziaWG Settings
5.1 On-Demand Activation
If you want to ensure a device (such as your kids’ phone) always connects to your Firewalla VPN server, you can turn On-Demand Activation in the AmneziaWG app. This will automatically turn on your VPN connection when your device connects to cellular data and/or Wi-Fi.
5.2 On-Demand Activation Exceptions
You can also add an exception. While you're editing your AmneziaWG configuration, enable the cellular and Wi-Fi options under On-Demand Activation. Then, tap SSIDs. Tap Except these SSIDs, then enter the name of your home network.
(iOS or Mac only; for other OSs, you will need to use a separate 3rd-party app)
5.3 Adjust MTU (Advanced)
If your LTE provider requires a smaller MTU value, you can optionally adjust the MTU value per client profile in the AmneziaWG app. Note: Please use caution when changing this setting. Most clients do not require specifying an MTU value.
6. Upgrade to AmneziaWG 2.0
To get AmneziaWG 2.0, you will need App 1.69 and Box 1.983 or later.
Important Note:
- Upgrading to AmneziaWG 2.0 cannot be undone. You cannot downgrade to version 1.0.
- After upgrading to 2.0, all previously imported AmneziaWG VPN profiles with version 1.0 will stop working.
- You must re-import all AmneziaWG VPN profiles to client devices after upgrading to version 2.0.
Go to VPN Server > AmneziaWG > tap Upgrade to 2.0 on the AmneziaWG 2.0 banner.
Comments
7 comments
What version of Amnezia is Firewalla currently running? 2.0?
Hi CWest, we implement AmneziaWG extensions on top of WireGuard, which is compatible with the parameters used by the AmneziaWG 2.0 configuration.
Does that mean we can set S3 and S4 and ranges for the H parameters?
The AmneziaWG app does now allow on-demand activation as presented, on Android, only iOS. Same problem with the official Wireguard app. I recommend using the WG Tunnel app instead, which works for both Wireguard and Amnezia WG.
this VPN worked for the purpose I needed to bypass the VPN restrictions. thanks for adding this and it was a nice added feature. :)
I was wondering if there is any ETA for adding this for VPN client or FW to FW connection to leverage the Amnezia ?
I've only had very limited success at evading VPN block. I tested it by connecting to my company's guest wifi which blocks VPN. I was able to get some limited traffic on my Facebook app but that's about it. Could not access any website, could not reach my Firewalla. So some systems I think block traffic not specifically because it's VPN but because it's encrypted and it can't be filtered so it just stops it, and Amnezia doesn't bypass that setup.
Thanks for the detailed guide. The explanation of how AmneziaWG obfuscates WireGuard traffic while maintaining good performance was really helpful. It would be great to see future benchmarks comparing latency, throughput, and packet overhead against standard WireGuard in different network conditions.
Please sign in to leave a comment.