How to install AmneziaWG 3.1 on your own VPS (Ubuntu and Debian)

Description and use

The installer automates kernel module compilation, system tuning, firewall setup, and client profile generation, enabling a 15‑25 minute deployment of AmneziaWG 3.1 on a clean VPS.

Problem

Deploy a self‑hosted AmneziaWG 3.1 VPN server on a VPS without Docker or a web panel, ensuring kernel module support and proper firewall configuration.

Outcome

The installer automates kernel module compilation, system tuning, firewall setup, and client profile generation, enabling a 15‑25 minute deployment of AmneziaWG 3.1 on a clean VPS.

Workflow

• 1. Ensure VPS meets prerequisites: x86_64 VM, Ubuntu 24.04/26.04 or Debian 13, kernel 6.7+, 512 MB RAM, 2 GB disk, root SSH access, emergency console.
• 2. Log in as root and download the installer script: wget -O install_amneziawg_en.sh https://github.com/bivlked/amneziawg-installer/releases/latest/download/install_amneziawg_en.sh chmod +x install_amneziawg_en.sh 3. Run the installer: sudo bash ./install_amneziawg_en.sh (add --ssh-port if SSH uses a non‑standard port).
• 4. Answer prompts: VPN port, subnet, IPv6, routing mode, client isolation, server name. Accept defaults unless customization needed.
• 5. When prompted "Reboot now? [y/N]", answer y. Reboot, log back in, rerun the same command. Repeat for "Enable UFW? [y/N]" on the third run.
• 6. After second reboot, the script sets up firewall, starts the service, and creates two client profiles (my_phone, my_laptop).
• 7. Retrieve client files from /root/awg/ and transfer to local machine via scp. Use appropriate app (Android, iOS, Windows, Linux) to import the profile.
• 8. Verify operation: on server run sudo awg show awg0 to see recent handshake; on client confirm public IP matches server address.
• 9. Optional: add more clients with sudo bash /root/awg/manage_amneziawg.sh add <client_name> or regenerate profiles after I1 changes.

Evidence

one bash script, the kernel module, no Docker and no web panel

Source

It takes 15 to 25 minutes, mostly apt and building the kernel module

Source

The installer stops there [when using containers]

Source

If SSH listens on a non-standard port, add --ssh-port=YOUR_PORT so the firewall doesn't lock you out

Source

Two prompts trip people up: "Reboot now? [y/N]" and "Enable UFW? [y/N]"

Source