Chute Devs

Hello everyone.

WireGuard is the protocol we reach for when we want simplicity and speed. But it has a well-known weakness: its traffic is recognizable. The handshake has a fixed size, the message types are fixed values, and deep packet inspection can fingerprint it in a handful of bytes. On networks that actively block VPNs, plain WireGuard is often the first thing to get filtered.

AmneziaWG is the answer for that situation. It is WireGuard with a camouflage layer — the same tunnel, the same crypto, but dressed so it no longer looks like WireGuard on the wire.

What the Obfuscation Does

AmneziaWG wraps WireGuard’s traffic in random noise. Before each real packet, it can inject junk packets of randomized sizes. The leading bytes of the handshake and each message type are replaced with custom values you control. To an observer, the stream is just a sequence of differently-sized, opaque UDP datagrams — nothing about it says “WireGuard.”

Concretely, the config lets you tune:

• jc, jmin, jmax — how many junk packets to send, and the size range they fall in
• s1–s4 — extra bytes prepended to the init, response, cookie and transport packets
• h1–h4 — custom values replacing the message-type header bytes

An AmneziaWG section looks like a WireGuard section with these knobs added:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

[AmneziaWG awg0]
private-key = base64_private_key
peer-public-key = base64_peer_public_key
self-ip = 10.0.0.2
server = example.com
port = 51820
jc = 4
jmin = 40
jmax = 70
s1 = 15
s2 = 68
h1 = 123456
h2 = 67543
h3 = 32345
h4 = 123123

[Proxy]
AWG = amneziawg, section-name=awg0

The critical detail: both ends must agree on the obfuscation parameters, or the peer can’t decode your traffic. That means an AmneziaWG server — not a stock WireGuard one. Amnezia’s own apps and AmneziaWG self-host servers produce these parameters, and Chute reads them.

In the App

On iOS, we added a dedicated AmneziaWG policy editor, so you can enter an AmneziaWG config — including the obfuscation fields — the same way you’d enter any other policy, no hand-editing a config file.

What This Means

Plain WireGuard remains the right default when you control both ends and the network is friendly. AmneziaWG is for the other case: a network that would otherwise block WireGuard outright. It’s the same WireGuard speed you’re used to, with a disguise layered on top.

AmneziaWG is available on iOS and macOS now, in the same [AmneziaWG] config shape documented in the Chute Manual.

Thanks.

Chute Devs