amnezia-vpn/amnezia-client

Fork 0

mirror of https://github.com/amnezia-vpn/amnezia-client.git synced 2026-10-14 21:34:26 +00:00

[GH-ISSUE #2647] App tries to send a handshake but fails #1204

New issue

Open

opened 2026-10-13 20:36:46 +00:00 by bsakaguchi · 7 comments

bsakaguchi commented

2026-10-13 20:36:46 +00:00

Owner

Originally created by @thm-unix on GitHub (May 23, 2026).
Original GitHub issue: https://github.com/amnezia-vpn/amnezia-client/issues/2647

Describe the bug
I have a self-hosted AmneziaWG 2.0 server (set up by the client itself). Several days ago the desktop client stopped working properly. When I press Connect button, it stucks on Connecting, and nothing happens. Logs show that handshakes are being sent indefinitely (there are hundreds of lines Awaiting ..., Checking for handshake...), but nothing works. The Android client, though, works fine with the same server. Amnezia Free also doesn't work for the desktop client.

To Reproduce
Steps to reproduce the behavior:

Add a self-hosted server
Press Connect

Expected behavior
The connection should establish

Log files
AmneziaVPN.log:

[DEBUG] Amnezia  : Logger::setServiceLogsEnabled(): Logs transitioned to be  enabled
[INFO] Amnezia  : Logging has enabled on AmneziaVPN version 4.8.15.4 2edd7de
[INFO] Amnezia  : Arch Linux (x86_64)
[DEBUG] Amnezia  : Logger::setServiceLogsEnabled(): Logs transitioned to be  enabled
[INFO] Amnezia  : Started AmneziaVPN version 4.8.15.4 2edd7de
[INFO] Amnezia  : Arch Linux (x86_64)
[INFO] Amnezia  : SSL backend: OpenSSL 3.0.13 30 Jan 2024
[DEBUG] Amnezia  : VpnConfigurator::getDnsForConfig "1.1.1.1" "1.0.0.1"
[DEBUG] Amnezia  : "Trying to connect to VPN, server index is 0, container is amnezia-awg2, route mode is" Settings::VpnOnlyForwardSites
[DEBUG] Amnezia  : "Site split tunneling is disabled, route mode is 0"
[DEBUG] Amnezia  : "App split tunneling is disabled, route mode is 0"
[DEBUG] Amnezia LocalSocketController : Initializing
[DEBUG] Amnezia LocalSocketController : Connecting to: /var/run/amneziavpn/daemon.socket
[DEBUG] Amnezia LocalSocketController : Daemon connected
[DEBUG] Amnezia LocalSocketController : Check status
[DEBUG] Amnezia LocalSocketController : Reading
[DEBUG] Amnezia LocalSocketController : Parse command: status
[DEBUG] Amnezia  : Logger::setServiceLogsEnabled(): Logs transitioned to be  enabled
[INFO] Amnezia  : Started AmneziaVPN version 4.8.15.4 2edd7de
[INFO] Amnezia  : Arch Linux (x86_64)
[INFO] Amnezia  : SSL backend: OpenSSL 3.0.13 30 Jan 2024

AmneziaVPN-service.log

[DEBUG] Amnezia  : LocalServer new connection
[DEBUG] Amnezia DaemonLocalServer : New connection received
[DEBUG] Amnezia DaemonLocalServerConnection : Connection created
[DEBUG] Amnezia DaemonLocalServerConnection : Read Data
[DEBUG] Amnezia DaemonLocalServerConnection : Command received: status
[DEBUG] Amnezia Daemon : Status request
[DEBUG] Amnezia DaemonLocalServerConnection : Command received: activate
[DEBUG] Amnezia Daemon : Activating interface
[DEBUG] Amnezia WireguardUtilsLinux : Created wireguard interface amn0
[DEBUG] Amnezia LinuxRouteMonitor : LinuxRouteMonitor created.
[WARNING] Amnezia LinuxFirewall : ( 2 ) $  iptables -C OUTPUT -j amnvpn.anchors 2> /dev/null
[INFO] Amnezia LinuxFirewall : Tearing down cgroup and routing rules
[WARNING] Amnezia LinuxFirewall : ( 255 ) $  ip route flush table amnvpnrt
[WARNING] Amnezia LinuxFirewall : Error: argument "amnvpnrt" is wrong: table id value is invalid
[DEBUG] Amnezia LinuxFirewall : LinuxFirewall::uninstall() complete
[WARNING] Amnezia LinuxFirewall : ( 123 ) $  if ! iptables -L OUTPUT -n --line-numbers -t filter 2> /dev/null | awk 'int($1) == 1 && $2 == "amnvpn.anchors" { found=1 } END { if(found==1) { exit 0 } else { exit 1 } }' ; then iptables -I OUTPUT -j amnvpn.anchors -t filter && iptables -L OUTPUT -n --line-numbers -t filter 2> /dev/null | awk 'int($1) > 1 && $2 == "amnvpn.anchors" { print $1; exit }' | xargs iptables -t filter -D OUTPUT ; fi
[WARNING] Amnezia LinuxFirewall : iptables: Bad rule (does a matching rule exist in that chain?).
[WARNING] Amnezia LinuxFirewall : ( 123 ) $  if ! ip6tables -L OUTPUT -n --line-numbers -t filter 2> /dev/null | awk 'int($1) == 1 && $2 == "amnvpn.anchors" { found=1 } END { if(found==1) { exit 0 } else { exit 1 } }' ; then ip6tables -I OUTPUT -j amnvpn.anchors -t filter && ip6tables -L OUTPUT -n --line-numbers -t filter 2> /dev/null | awk 'int($1) > 1 && $2 == "amnvpn.anchors" { print $1; exit }' | xargs ip6tables -t filter -D OUTPUT ; fi
[WARNING] Amnezia LinuxFirewall : ip6tables: Bad rule (does a matching rule exist in that chain?).
[WARNING] Amnezia LinuxFirewall : ( 123 ) $  if ! iptables -L POSTROUTING -n --line-numbers -t nat 2> /dev/null | awk 'int($1) == 1 && $2 == "amnvpn.anchors" { found=1 } END { if(found==1) { exit 0 } else { exit 1 } }' ; then iptables -I POSTROUTING -j amnvpn.anchors -t nat && iptables -L POSTROUTING -n --line-numbers -t nat 2> /dev/null | awk 'int($1) > 1 && $2 == "amnvpn.anchors" { print $1; exit }' | xargs iptables -t nat -D POSTROUTING ; fi
[WARNING] Amnezia LinuxFirewall : iptables: Bad rule (does a matching rule exist in that chain?).
[WARNING] Amnezia LinuxFirewall : ( 123 ) $  if ! ip6tables -L POSTROUTING -n --line-numbers -t nat 2> /dev/null | awk 'int($1) == 1 && $2 == "amnvpn.anchors" { found=1 } END { if(found==1) { exit 0 } else { exit 1 } }' ; then ip6tables -I POSTROUTING -j amnvpn.anchors -t nat && ip6tables -L POSTROUTING -n --line-numbers -t nat 2> /dev/null | awk 'int($1) > 1 && $2 == "amnvpn.anchors" { print $1; exit }' | xargs ip6tables -t nat -D POSTROUTING ; fi
[WARNING] Amnezia LinuxFirewall : ip6tables: Bad rule (does a matching rule exist in that chain?).
[WARNING] Amnezia LinuxFirewall : ( 123 ) $  if ! iptables -L OUTPUT -n --line-numbers -t mangle 2> /dev/null | awk 'int($1) == 1 && $2 == "amnvpn.anchors" { found=1 } END { if(found==1) { exit 0 } else { exit 1 } }' ; then iptables -I OUTPUT -j amnvpn.anchors -t mangle && iptables -L OUTPUT -n --line-numbers -t mangle 2> /dev/null | awk 'int($1) > 1 && $2 == "amnvpn.anchors" { print $1; exit }' | xargs iptables -t mangle -D OUTPUT ; fi
[WARNING] Amnezia LinuxFirewall : iptables: Bad rule (does a matching rule exist in that chain?).
[WARNING] Amnezia LinuxFirewall : ( 123 ) $  if ! ip6tables -L OUTPUT -n --line-numbers -t mangle 2> /dev/null | awk 'int($1) == 1 && $2 == "amnvpn.anchors" { found=1 } END { if(found==1) { exit 0 } else { exit 1 } }' ; then ip6tables -I OUTPUT -j amnvpn.anchors -t mangle && ip6tables -L OUTPUT -n --line-numbers -t mangle 2> /dev/null | awk 'int($1) > 1 && $2 == "amnvpn.anchors" { print $1; exit }' | xargs ip6tables -t mangle -D OUTPUT ; fi
[WARNING] Amnezia LinuxFirewall : ip6tables: Bad rule (does a matching rule exist in that chain?).
[WARNING] Amnezia LinuxFirewall : ( 123 ) $  if ! iptables -L PREROUTING -n --line-numbers -t raw 2> /dev/null | awk 'int($1) == 1 && $2 == "amnvpn.anchors" { found=1 } END { if(found==1) { exit 0 } else { exit 1 } }' ; then iptables -I PREROUTING -j amnvpn.anchors -t raw && iptables -L PREROUTING -n --line-numbers -t raw 2> /dev/null | awk 'int($1) > 1 && $2 == "amnvpn.anchors" { print $1; exit }' | xargs iptables -t raw -D PREROUTING ; fi
[WARNING] Amnezia LinuxFirewall : iptables: Bad rule (does a matching rule exist in that chain?).
[WARNING] Amnezia LinuxFirewall : ( 123 ) $  if ! ip6tables -L PREROUTING -n --line-numbers -t raw 2> /dev/null | awk 'int($1) == 1 && $2 == "amnvpn.anchors" { found=1 } END { if(found==1) { exit 0 } else { exit 1 } }' ; then ip6tables -I PREROUTING -j amnvpn.anchors -t raw && ip6tables -L PREROUTING -n --line-numbers -t raw 2> /dev/null | awk 'int($1) > 1 && $2 == "amnvpn.anchors" { print $1; exit }' | xargs ip6tables -t raw -D PREROUTING ; fi
[WARNING] Amnezia LinuxFirewall : ip6tables: Bad rule (does a matching rule exist in that chain?).
[INFO] Amnezia LinuxFirewall : Should be setting up cgroup in /sys/fs/cgroup/net_cls/amnvpnexclusions/ for traffic splitting
[WARNING] Amnezia LinuxFirewall : ( 1 ) $  if [ ! -d /sys/fs/cgroup/net_cls/amnvpnexclusions/ ] ; then mkdir /sys/fs/cgroup/net_cls/amnvpnexclusions/ ; sleep 0.1 ; echo 0x567 > /sys/fs/cgroup/net_cls/amnvpnexclusions//net_cls.classid ; fi
[WARNING] Amnezia LinuxFirewall : mkdir: cannot create directory ‘/sys/fs/cgroup/net_cls/amnvpnexclusions/’: No such file or directory
/bin/bash: line 1: /sys/fs/cgroup/net_cls/amnvpnexclusions//net_cls.classid: No such file or directory
[WARNING] Amnezia LinuxFirewall : ( 255 ) $  if ! ip rule list | grep -q 0x3211 ; then ip rule add from all fwmark 0x3211 lookup amnvpnrt pri 100 ; fi
[WARNING] Amnezia LinuxFirewall : Error: argument "amnvpnrt" is wrong: invalid table ID
[INFO] Amnezia LinuxFirewall : 000.allowLoopback(IPv4): OFF -> ON
[INFO] Amnezia LinuxFirewall : 000.allowLoopback(IPv6): OFF -> ON
[INFO] Amnezia LinuxFirewall : 100.blockAll(IPv4): OFF -> ON
[INFO] Amnezia LinuxFirewall : 100.blockAll(IPv6): OFF -> ON
[INFO] Amnezia LinuxFirewall : 110.allowNets(IPv4): OFF -> ON
[INFO] Amnezia LinuxFirewall : 120.blockNets(IPv4): OFF
[INFO] Amnezia LinuxFirewall : 200.allowVPN(IPv4): OFF -> ON
[INFO] Amnezia LinuxFirewall : 250.blockIPv6(IPv6): OFF -> ON
[INFO] Amnezia LinuxFirewall : 290.allowDHCP(IPv4): OFF -> ON
[INFO] Amnezia LinuxFirewall : 290.allowDHCP(IPv6): OFF -> ON
[INFO] Amnezia LinuxFirewall : 300.allowLAN(IPv4): OFF -> ON
[INFO] Amnezia LinuxFirewall : 300.allowLAN(IPv6): OFF -> ON
[INFO] Amnezia LinuxFirewall : 310.blockDNS(IPv4): OFF -> ON
[INFO] Amnezia LinuxFirewall : 320.allowDNS(IPv4): OFF -> ON
[WARNING] Amnezia LinuxFirewall : ( 2 ) $  if iptables -C amnvpn.a.400.allowPIA -j amnvpn.400.allowPIA -t filter 2> /dev/null ; then echo '400.allowPIA(IPv4): ON' ; else echo '400.allowPIA(IPv4): OFF -> ON' ; iptables -A amnvpn.a.400.allowPIA -j amnvpn.400.allowPIA -t filter; fi
[INFO] Amnezia LinuxFirewall : 400.allowPIA(IPv4): OFF -> ON
[WARNING] Amnezia LinuxFirewall : iptables v1.8.13 (nf_tables): Chain 'amnvpn.400.allowPIA' does not exist
Try `iptables -h' or 'iptables --help' for more information.
[WARNING] Amnezia LinuxFirewall : ( 2 ) $  if ip6tables -C amnvpn.a.400.allowPIA -j amnvpn.400.allowPIA -t filter 2> /dev/null ; then echo '400.allowPIA(IPv6): ON' ; else echo '400.allowPIA(IPv6): OFF -> ON' ; ip6tables -A amnvpn.a.400.allowPIA -j amnvpn.400.allowPIA -t filter; fi
[INFO] Amnezia LinuxFirewall : 400.allowPIA(IPv6): OFF -> ON
[WARNING] Amnezia LinuxFirewall : ip6tables v1.8.13 (nf_tables): Chain 'amnvpn.400.allowPIA' does not exist
Try `ip6tables -h' or 'ip6tables --help' for more information.
[DEBUG] Amnezia LinuxRouteMonitor : Adding exclusion route for [REDACTED_FOR_PRIVACY]
[DEBUG] Amnezia  : Gateway  192.168.50.1  for interface  enp1s0
[DEBUG] Amnezia WireguardUtilsLinux : Configuring peer [REDACTED_FOR_PRIVACY] via [REDACTED_FOR_PRIVACY]
[DEBUG] Amnezia LinuxRouteMonitor : Adding exclusion route for [REDACTED_FOR_PRIVACY]
[DEBUG] Amnezia  : Gateway  192.168.50.1  for interface  enp1s0
[DEBUG] Amnezia LinuxRouteMonitor : Adding exclusion route for /999999
[WARNING] Amnezia LinuxRouteMonitor : Invalid destination prefix
[DEBUG] Amnezia DnsUtilsLinux : Adding DNS resolver 1.1.1.1 via amn0
[DEBUG] Amnezia DnsUtilsLinux : Adding DNS resolver 1.0.0.1 via amn0
[DEBUG] Amnezia LinuxRouteMonitor : Adding route to 0.0.0.0/1
[DEBUG] Amnezia LinuxRouteMonitor : Adding route to 128.0.0.0/1
[DEBUG] Amnezia LinuxRouteMonitor : Adding route to ::/1
[DEBUG] Amnezia LinuxRouteMonitor : Adding route to 8000::/1
[DEBUG] Amnezia Daemon : Connection status: 1
[ERROR] Amnezia DnsUtilsLinux : Error received from the DBus service
[ERROR] Amnezia DnsUtilsLinux : Error received from the DBus service
[ERROR] Amnezia DnsUtilsLinux : Error retrieving the DNS  domains from the DBus service
[DEBUG] Amnezia Daemon : Checking for handshake...
[DEBUG] Amnezia Daemon : awaiting [REDACTED_FOR_PRIVACY]
[DEBUG] Amnezia Daemon : Checking for handshake...
[DEBUG] Amnezia Daemon : awaiting [REDACTED_FOR_PRIVACY]
[DEBUG] Amnezia Daemon : Checking for handshake...
[DEBUG] Amnezia Daemon : awaiting [REDACTED_FOR_PRIVACY]
[DEBUG] Amnezia Daemon : Checking for handshake...
[DEBUG] Amnezia Daemon : awaiting [REDACTED_FOR_PRIVACY]
[DEBUG] Amnezia Daemon : Checking for handshake...
[DEBUG] Amnezia Daemon : awaiting [REDACTED_FOR_PRIVACY]
[DEBUG] Amnezia Daemon : Checking for handshake...
[DEBUG] Amnezia Daemon : awaiting [REDACTED_FOR_PRIVACY]
[DEBUG] Amnezia Daemon : Checking for handshake...
[DEBUG] Amnezia Daemon : awaiting [REDACTED_FOR_PRIVACY]
[DEBUG] Amnezia Daemon : Checking for handshake...
[DEBUG] Amnezia Daemon : awaiting [REDACTED_FOR_PRIVACY]
[DEBUG] Amnezia Daemon : Checking for handshake...
[DEBUG] Amnezia Daemon : awaiting [REDACTED_FOR_PRIVACY]
[DEBUG] Amnezia Daemon : Checking for handshake...
[DEBUG] Amnezia Daemon : awaiting [REDACTED_FOR_PRIVACY]
[DEBUG] Amnezia Daemon : Checking for handshake...

Desktop:

Arch Linux rolling

Server:

Debian 12

Originally created by @thm-unix on GitHub (May 23, 2026). Original GitHub issue: https://github.com/amnezia-vpn/amnezia-client/issues/2647 **Describe the bug** I have a self-hosted AmneziaWG 2.0 server (set up by the client itself). Several days ago the desktop client stopped working properly. When I press Connect button, it stucks on Connecting, and nothing happens. Logs show that handshakes are being sent indefinitely (there are hundreds of lines `Awaiting ...`, `Checking for handshake...`), but nothing works. The Android client, though, works fine with the same server. Amnezia Free also doesn't work for the desktop client. **To Reproduce** Steps to reproduce the behavior: 1. Add a self-hosted server 2. Press Connect **Expected behavior** The connection should establish **Log files** AmneziaVPN.log: ``` [DEBUG] Amnezia : Logger::setServiceLogsEnabled(): Logs transitioned to be enabled [INFO] Amnezia : Logging has enabled on AmneziaVPN version 4.8.15.4 2edd7de [INFO] Amnezia : Arch Linux (x86_64) [DEBUG] Amnezia : Logger::setServiceLogsEnabled(): Logs transitioned to be enabled [INFO] Amnezia : Started AmneziaVPN version 4.8.15.4 2edd7de [INFO] Amnezia : Arch Linux (x86_64) [INFO] Amnezia : SSL backend: OpenSSL 3.0.13 30 Jan 2024 [DEBUG] Amnezia : VpnConfigurator::getDnsForConfig "1.1.1.1" "1.0.0.1" [DEBUG] Amnezia : "Trying to connect to VPN, server index is 0, container is amnezia-awg2, route mode is" Settings::VpnOnlyForwardSites [DEBUG] Amnezia : "Site split tunneling is disabled, route mode is 0" [DEBUG] Amnezia : "App split tunneling is disabled, route mode is 0" [DEBUG] Amnezia LocalSocketController : Initializing [DEBUG] Amnezia LocalSocketController : Connecting to: /var/run/amneziavpn/daemon.socket [DEBUG] Amnezia LocalSocketController : Daemon connected [DEBUG] Amnezia LocalSocketController : Check status [DEBUG] Amnezia LocalSocketController : Reading [DEBUG] Amnezia LocalSocketController : Parse command: status [DEBUG] Amnezia : Logger::setServiceLogsEnabled(): Logs transitioned to be enabled [INFO] Amnezia : Started AmneziaVPN version 4.8.15.4 2edd7de [INFO] Amnezia : Arch Linux (x86_64) [INFO] Amnezia : SSL backend: OpenSSL 3.0.13 30 Jan 2024 ``` AmneziaVPN-service.log ``` [DEBUG] Amnezia : LocalServer new connection [DEBUG] Amnezia DaemonLocalServer : New connection received [DEBUG] Amnezia DaemonLocalServerConnection : Connection created [DEBUG] Amnezia DaemonLocalServerConnection : Read Data [DEBUG] Amnezia DaemonLocalServerConnection : Command received: status [DEBUG] Amnezia Daemon : Status request [DEBUG] Amnezia DaemonLocalServerConnection : Command received: activate [DEBUG] Amnezia Daemon : Activating interface [DEBUG] Amnezia WireguardUtilsLinux : Created wireguard interface amn0 [DEBUG] Amnezia LinuxRouteMonitor : LinuxRouteMonitor created. [WARNING] Amnezia LinuxFirewall : ( 2 ) $ iptables -C OUTPUT -j amnvpn.anchors 2> /dev/null [INFO] Amnezia LinuxFirewall : Tearing down cgroup and routing rules [WARNING] Amnezia LinuxFirewall : ( 255 ) $ ip route flush table amnvpnrt [WARNING] Amnezia LinuxFirewall : Error: argument "amnvpnrt" is wrong: table id value is invalid [DEBUG] Amnezia LinuxFirewall : LinuxFirewall::uninstall() complete [WARNING] Amnezia LinuxFirewall : ( 123 ) $ if ! iptables -L OUTPUT -n --line-numbers -t filter 2> /dev/null | awk 'int($1) == 1 && $2 == "amnvpn.anchors" { found=1 } END { if(found==1) { exit 0 } else { exit 1 } }' ; then iptables -I OUTPUT -j amnvpn.anchors -t filter && iptables -L OUTPUT -n --line-numbers -t filter 2> /dev/null | awk 'int($1) > 1 && $2 == "amnvpn.anchors" { print $1; exit }' | xargs iptables -t filter -D OUTPUT ; fi [WARNING] Amnezia LinuxFirewall : iptables: Bad rule (does a matching rule exist in that chain?). [WARNING] Amnezia LinuxFirewall : ( 123 ) $ if ! ip6tables -L OUTPUT -n --line-numbers -t filter 2> /dev/null | awk 'int($1) == 1 && $2 == "amnvpn.anchors" { found=1 } END { if(found==1) { exit 0 } else { exit 1 } }' ; then ip6tables -I OUTPUT -j amnvpn.anchors -t filter && ip6tables -L OUTPUT -n --line-numbers -t filter 2> /dev/null | awk 'int($1) > 1 && $2 == "amnvpn.anchors" { print $1; exit }' | xargs ip6tables -t filter -D OUTPUT ; fi [WARNING] Amnezia LinuxFirewall : ip6tables: Bad rule (does a matching rule exist in that chain?). [WARNING] Amnezia LinuxFirewall : ( 123 ) $ if ! iptables -L POSTROUTING -n --line-numbers -t nat 2> /dev/null | awk 'int($1) == 1 && $2 == "amnvpn.anchors" { found=1 } END { if(found==1) { exit 0 } else { exit 1 } }' ; then iptables -I POSTROUTING -j amnvpn.anchors -t nat && iptables -L POSTROUTING -n --line-numbers -t nat 2> /dev/null | awk 'int($1) > 1 && $2 == "amnvpn.anchors" { print $1; exit }' | xargs iptables -t nat -D POSTROUTING ; fi [WARNING] Amnezia LinuxFirewall : iptables: Bad rule (does a matching rule exist in that chain?). [WARNING] Amnezia LinuxFirewall : ( 123 ) $ if ! ip6tables -L POSTROUTING -n --line-numbers -t nat 2> /dev/null | awk 'int($1) == 1 && $2 == "amnvpn.anchors" { found=1 } END { if(found==1) { exit 0 } else { exit 1 } }' ; then ip6tables -I POSTROUTING -j amnvpn.anchors -t nat && ip6tables -L POSTROUTING -n --line-numbers -t nat 2> /dev/null | awk 'int($1) > 1 && $2 == "amnvpn.anchors" { print $1; exit }' | xargs ip6tables -t nat -D POSTROUTING ; fi [WARNING] Amnezia LinuxFirewall : ip6tables: Bad rule (does a matching rule exist in that chain?). [WARNING] Amnezia LinuxFirewall : ( 123 ) $ if ! iptables -L OUTPUT -n --line-numbers -t mangle 2> /dev/null | awk 'int($1) == 1 && $2 == "amnvpn.anchors" { found=1 } END { if(found==1) { exit 0 } else { exit 1 } }' ; then iptables -I OUTPUT -j amnvpn.anchors -t mangle && iptables -L OUTPUT -n --line-numbers -t mangle 2> /dev/null | awk 'int($1) > 1 && $2 == "amnvpn.anchors" { print $1; exit }' | xargs iptables -t mangle -D OUTPUT ; fi [WARNING] Amnezia LinuxFirewall : iptables: Bad rule (does a matching rule exist in that chain?). [WARNING] Amnezia LinuxFirewall : ( 123 ) $ if ! ip6tables -L OUTPUT -n --line-numbers -t mangle 2> /dev/null | awk 'int($1) == 1 && $2 == "amnvpn.anchors" { found=1 } END { if(found==1) { exit 0 } else { exit 1 } }' ; then ip6tables -I OUTPUT -j amnvpn.anchors -t mangle && ip6tables -L OUTPUT -n --line-numbers -t mangle 2> /dev/null | awk 'int($1) > 1 && $2 == "amnvpn.anchors" { print $1; exit }' | xargs ip6tables -t mangle -D OUTPUT ; fi [WARNING] Amnezia LinuxFirewall : ip6tables: Bad rule (does a matching rule exist in that chain?). [WARNING] Amnezia LinuxFirewall : ( 123 ) $ if ! iptables -L PREROUTING -n --line-numbers -t raw 2> /dev/null | awk 'int($1) == 1 && $2 == "amnvpn.anchors" { found=1 } END { if(found==1) { exit 0 } else { exit 1 } }' ; then iptables -I PREROUTING -j amnvpn.anchors -t raw && iptables -L PREROUTING -n --line-numbers -t raw 2> /dev/null | awk 'int($1) > 1 && $2 == "amnvpn.anchors" { print $1; exit }' | xargs iptables -t raw -D PREROUTING ; fi [WARNING] Amnezia LinuxFirewall : iptables: Bad rule (does a matching rule exist in that chain?). [WARNING] Amnezia LinuxFirewall : ( 123 ) $ if ! ip6tables -L PREROUTING -n --line-numbers -t raw 2> /dev/null | awk 'int($1) == 1 && $2 == "amnvpn.anchors" { found=1 } END { if(found==1) { exit 0 } else { exit 1 } }' ; then ip6tables -I PREROUTING -j amnvpn.anchors -t raw && ip6tables -L PREROUTING -n --line-numbers -t raw 2> /dev/null | awk 'int($1) > 1 && $2 == "amnvpn.anchors" { print $1; exit }' | xargs ip6tables -t raw -D PREROUTING ; fi [WARNING] Amnezia LinuxFirewall : ip6tables: Bad rule (does a matching rule exist in that chain?). [INFO] Amnezia LinuxFirewall : Should be setting up cgroup in /sys/fs/cgroup/net_cls/amnvpnexclusions/ for traffic splitting [WARNING] Amnezia LinuxFirewall : ( 1 ) $ if [ ! -d /sys/fs/cgroup/net_cls/amnvpnexclusions/ ] ; then mkdir /sys/fs/cgroup/net_cls/amnvpnexclusions/ ; sleep 0.1 ; echo 0x567 > /sys/fs/cgroup/net_cls/amnvpnexclusions//net_cls.classid ; fi [WARNING] Amnezia LinuxFirewall : mkdir: cannot create directory ‘/sys/fs/cgroup/net_cls/amnvpnexclusions/’: No such file or directory /bin/bash: line 1: /sys/fs/cgroup/net_cls/amnvpnexclusions//net_cls.classid: No such file or directory [WARNING] Amnezia LinuxFirewall : ( 255 ) $ if ! ip rule list | grep -q 0x3211 ; then ip rule add from all fwmark 0x3211 lookup amnvpnrt pri 100 ; fi [WARNING] Amnezia LinuxFirewall : Error: argument "amnvpnrt" is wrong: invalid table ID [INFO] Amnezia LinuxFirewall : 000.allowLoopback(IPv4): OFF -> ON [INFO] Amnezia LinuxFirewall : 000.allowLoopback(IPv6): OFF -> ON [INFO] Amnezia LinuxFirewall : 100.blockAll(IPv4): OFF -> ON [INFO] Amnezia LinuxFirewall : 100.blockAll(IPv6): OFF -> ON [INFO] Amnezia LinuxFirewall : 110.allowNets(IPv4): OFF -> ON [INFO] Amnezia LinuxFirewall : 120.blockNets(IPv4): OFF [INFO] Amnezia LinuxFirewall : 200.allowVPN(IPv4): OFF -> ON [INFO] Amnezia LinuxFirewall : 250.blockIPv6(IPv6): OFF -> ON [INFO] Amnezia LinuxFirewall : 290.allowDHCP(IPv4): OFF -> ON [INFO] Amnezia LinuxFirewall : 290.allowDHCP(IPv6): OFF -> ON [INFO] Amnezia LinuxFirewall : 300.allowLAN(IPv4): OFF -> ON [INFO] Amnezia LinuxFirewall : 300.allowLAN(IPv6): OFF -> ON [INFO] Amnezia LinuxFirewall : 310.blockDNS(IPv4): OFF -> ON [INFO] Amnezia LinuxFirewall : 320.allowDNS(IPv4): OFF -> ON [WARNING] Amnezia LinuxFirewall : ( 2 ) $ if iptables -C amnvpn.a.400.allowPIA -j amnvpn.400.allowPIA -t filter 2> /dev/null ; then echo '400.allowPIA(IPv4): ON' ; else echo '400.allowPIA(IPv4): OFF -> ON' ; iptables -A amnvpn.a.400.allowPIA -j amnvpn.400.allowPIA -t filter; fi [INFO] Amnezia LinuxFirewall : 400.allowPIA(IPv4): OFF -> ON [WARNING] Amnezia LinuxFirewall : iptables v1.8.13 (nf_tables): Chain 'amnvpn.400.allowPIA' does not exist Try `iptables -h' or 'iptables --help' for more information. [WARNING] Amnezia LinuxFirewall : ( 2 ) $ if ip6tables -C amnvpn.a.400.allowPIA -j amnvpn.400.allowPIA -t filter 2> /dev/null ; then echo '400.allowPIA(IPv6): ON' ; else echo '400.allowPIA(IPv6): OFF -> ON' ; ip6tables -A amnvpn.a.400.allowPIA -j amnvpn.400.allowPIA -t filter; fi [INFO] Amnezia LinuxFirewall : 400.allowPIA(IPv6): OFF -> ON [WARNING] Amnezia LinuxFirewall : ip6tables v1.8.13 (nf_tables): Chain 'amnvpn.400.allowPIA' does not exist Try `ip6tables -h' or 'ip6tables --help' for more information. [DEBUG] Amnezia LinuxRouteMonitor : Adding exclusion route for [REDACTED_FOR_PRIVACY] [DEBUG] Amnezia : Gateway 192.168.50.1 for interface enp1s0 [DEBUG] Amnezia WireguardUtilsLinux : Configuring peer [REDACTED_FOR_PRIVACY] via [REDACTED_FOR_PRIVACY] [DEBUG] Amnezia LinuxRouteMonitor : Adding exclusion route for [REDACTED_FOR_PRIVACY] [DEBUG] Amnezia : Gateway 192.168.50.1 for interface enp1s0 [DEBUG] Amnezia LinuxRouteMonitor : Adding exclusion route for /999999 [WARNING] Amnezia LinuxRouteMonitor : Invalid destination prefix [DEBUG] Amnezia DnsUtilsLinux : Adding DNS resolver 1.1.1.1 via amn0 [DEBUG] Amnezia DnsUtilsLinux : Adding DNS resolver 1.0.0.1 via amn0 [DEBUG] Amnezia LinuxRouteMonitor : Adding route to 0.0.0.0/1 [DEBUG] Amnezia LinuxRouteMonitor : Adding route to 128.0.0.0/1 [DEBUG] Amnezia LinuxRouteMonitor : Adding route to ::/1 [DEBUG] Amnezia LinuxRouteMonitor : Adding route to 8000::/1 [DEBUG] Amnezia Daemon : Connection status: 1 [ERROR] Amnezia DnsUtilsLinux : Error received from the DBus service [ERROR] Amnezia DnsUtilsLinux : Error received from the DBus service [ERROR] Amnezia DnsUtilsLinux : Error retrieving the DNS domains from the DBus service [DEBUG] Amnezia Daemon : Checking for handshake... [DEBUG] Amnezia Daemon : awaiting [REDACTED_FOR_PRIVACY] [DEBUG] Amnezia Daemon : Checking for handshake... [DEBUG] Amnezia Daemon : awaiting [REDACTED_FOR_PRIVACY] [DEBUG] Amnezia Daemon : Checking for handshake... [DEBUG] Amnezia Daemon : awaiting [REDACTED_FOR_PRIVACY] [DEBUG] Amnezia Daemon : Checking for handshake... [DEBUG] Amnezia Daemon : awaiting [REDACTED_FOR_PRIVACY] [DEBUG] Amnezia Daemon : Checking for handshake... [DEBUG] Amnezia Daemon : awaiting [REDACTED_FOR_PRIVACY] [DEBUG] Amnezia Daemon : Checking for handshake... [DEBUG] Amnezia Daemon : awaiting [REDACTED_FOR_PRIVACY] [DEBUG] Amnezia Daemon : Checking for handshake... [DEBUG] Amnezia Daemon : awaiting [REDACTED_FOR_PRIVACY] [DEBUG] Amnezia Daemon : Checking for handshake... [DEBUG] Amnezia Daemon : awaiting [REDACTED_FOR_PRIVACY] [DEBUG] Amnezia Daemon : Checking for handshake... [DEBUG] Amnezia Daemon : awaiting [REDACTED_FOR_PRIVACY] [DEBUG] Amnezia Daemon : Checking for handshake... [DEBUG] Amnezia Daemon : awaiting [REDACTED_FOR_PRIVACY] [DEBUG] Amnezia Daemon : Checking for handshake... ``` **Desktop:** - Arch Linux rolling **Server:** - Debian 12

bsakaguchi commented

2026-10-13 20:36:47 +00:00

Author

Owner

@kairzhanable commented on GitHub (May 23, 2026):

Same problem here, using latest version of mac os amnezia client (4.8.15.4) + self-hosted awg 2.0. Logs show same numerous attempts to handshake

@kairzhanable commented on GitHub (May 23, 2026): Same problem here, using latest version of mac os amnezia client (4.8.15.4) + self-hosted awg 2.0. Logs show same numerous attempts to handshake

bsakaguchi commented

2026-10-13 20:36:47 +00:00

Author

Owner

@tsvs commented on GitHub (May 23, 2026):

same thing on ubuntu 25.10

@tsvs commented on GitHub (May 23, 2026): same thing on ubuntu 25.10

bsakaguchi commented

2026-10-13 20:36:48 +00:00

Author

Owner

@yupic commented on GitHub (May 23, 2026):

В последние дни в РФ усилили блокировки, так что у меня Amnezia Premium не подключается по AWG 1.5, а через VLESS каждый запрос теперь занимает больше времени.
Возможно, это как-то повлияло.

@yupic commented on GitHub (May 23, 2026): В последние дни в РФ усилили блокировки, так что у меня Amnezia Premium не подключается по AWG 1.5, а через VLESS каждый запрос теперь занимает больше времени. Возможно, это как-то повлияло.

bsakaguchi commented

2026-10-13 20:36:48 +00:00

Author

Owner

@madcorever commented on GitHub (May 24, 2026):

I can confirm this bug on three different Linux distributions (Gentoo, Ubuntu 26.04 live, BazziteOS) with AmneziaVPN 4.8.15.4, across multiple network interfaces (Wi-Fi RTL8852BE and USB tethering) — so this is not hardware- or distro-specific.

Root cause (Linux)

The GUI daemon (AmneziaVPN-service) fails to deliver obfuscation parameters to wireguard-go via its Unix socket IPC channel. The following error appears consistently in the service logs during every connection attempt:

[ERROR] Amnezia WireguardUtilsLinux : QLocalSocket::waitForConnected() failed:
QLocalSocket::connectToServer: Invalid name

As a result, wireguard-go starts and creates the amn0 interface, routes are configured — but the AmneziaWG obfuscation parameters (Jc, Jmin, Jmax, S1, S2, H1–H4) are never applied. The client then sends a standard unobfuscated WireGuard handshake, which the AmneziaWG server silently ignores. The daemon loops on handshake checks until timeout.

Working workaround

Using awg-quick directly bypasses the GUI/daemon IPC entirely and delivers the config in one step via awg setconf. All obfuscation parameters are applied correctly and the handshake succeeds.

Step 1 — Build and install amneziawg-tools:

git clone https://github.com/amnezia-vpn/amneziawg-tools
cd amneziawg-tools/src
make
sudo make install

Step 2 — Place your exported config:

sudo cp your_amnezia_config.conf /etc/amnezia/amneziawg/amn0.conf

Step 3 — Bring up the tunnel using the wireguard-go binary bundled with AmneziaVPN:

sudo WG_QUICK_USERSPACE_IMPLEMENTATION=/opt/AmneziaVPN/client/bin/wireguard-go awg-quick up amn0

Step 4 — Verify:

sudo awg show amn0

Expected output confirms all obfuscation params are applied and latest handshake is recent:

interface: amn0
  jc: 4
  jmin: 10
  jmax: 50
  s1: 77
  s2: 55
  h1: ...
  ...
peer: ...
  latest handshake: X seconds ago
  transfer: X KiB received, X KiB sent

Notes

The kernel module amneziawg was not available on any of the tested distros — the userspace fallback via wireguard-go (bundled in the installer) works fine.
The Arch Linux log posted earlier in this thread does not show the QLocalSocket: Invalid name error, so there may be a separate compatibility issue with AWG server 2.0 affecting some users independently of this IPC bug.
To bring the tunnel down: sudo awg-quick down amn0

Hope this helps others until the GUI client is fixed.

@madcorever commented on GitHub (May 24, 2026): I can confirm this bug on **three different Linux distributions** (Gentoo, Ubuntu 26.04 live, BazziteOS) with AmneziaVPN **4.8.15.4**, across multiple network interfaces (Wi-Fi RTL8852BE and USB tethering) — so this is not hardware- or distro-specific. --- ### Root cause (Linux) The GUI daemon (`AmneziaVPN-service`) fails to deliver obfuscation parameters to `wireguard-go` via its Unix socket IPC channel. The following error appears consistently in the service logs during every connection attempt: ``` [ERROR] Amnezia WireguardUtilsLinux : QLocalSocket::waitForConnected() failed: QLocalSocket::connectToServer: Invalid name ``` As a result, `wireguard-go` starts and creates the `amn0` interface, routes are configured — but the AmneziaWG obfuscation parameters (`Jc`, `Jmin`, `Jmax`, `S1`, `S2`, `H1`–`H4`) are **never applied**. The client then sends a standard unobfuscated WireGuard handshake, which the AmneziaWG server silently ignores. The daemon loops on handshake checks until timeout. --- ### Working workaround Using `awg-quick` directly bypasses the GUI/daemon IPC entirely and delivers the config in one step via `awg setconf`. All obfuscation parameters are applied correctly and the handshake succeeds. **Step 1 — Build and install `amneziawg-tools`:** ```bash git clone https://github.com/amnezia-vpn/amneziawg-tools cd amneziawg-tools/src make sudo make install ``` **Step 2 — Place your exported config:** ```bash sudo cp your_amnezia_config.conf /etc/amnezia/amneziawg/amn0.conf ``` **Step 3 — Bring up the tunnel using the `wireguard-go` binary bundled with AmneziaVPN:** ```bash sudo WG_QUICK_USERSPACE_IMPLEMENTATION=/opt/AmneziaVPN/client/bin/wireguard-go awg-quick up amn0 ``` **Step 4 — Verify:** ```bash sudo awg show amn0 ``` Expected output confirms all obfuscation params are applied and `latest handshake` is recent: ``` interface: amn0 jc: 4 jmin: 10 jmax: 50 s1: 77 s2: 55 h1: ... ... peer: ... latest handshake: X seconds ago transfer: X KiB received, X KiB sent ``` --- ### Notes - The kernel module `amneziawg` was not available on any of the tested distros — the userspace fallback via `wireguard-go` (bundled in the installer) works fine. - The Arch Linux log posted earlier in this thread does **not** show the `QLocalSocket: Invalid name` error, so there may be a separate compatibility issue with AWG server 2.0 affecting some users independently of this IPC bug. - To bring the tunnel down: `sudo awg-quick down amn0` Hope this helps others until the GUI client is fixed.

bsakaguchi commented

2026-10-13 20:36:49 +00:00

Author

Owner

@KlevVid1 commented on GitHub (May 24, 2026):

У меня с телефона подключается, а с компа нет.

@KlevVid1 commented on GitHub (May 24, 2026): У меня с телефона подключается, а с компа нет.

bsakaguchi commented

2026-10-13 20:36:49 +00:00

Author

Owner

@thm-unix commented on GitHub (May 24, 2026):

@madcorever , even though my log has no socket msgs, indeed, this fixed the issue. Thank you so much!

P.S. to export the config, you have to open the AmneziaVPN app and create a new user with the AmneziaWG native format selected. The config it gives you can also contain empty I2-I5 options (which will not be recognized correctly by the amneziawg-go/wireguard-go binary). In order to fix that, you should set those to 0.

P.P.S. if you get a /etc/resolv.conf error, make sure it's writable (I had it set to immutable to prevent NM from changing the file via chattr +i)

@thm-unix commented on GitHub (May 24, 2026): @madcorever , even though my log has no socket msgs, indeed, this fixed the issue. Thank you so much! P.S. to export the config, you have to open the AmneziaVPN app and create a new user with the AmneziaWG native format selected. The config it gives you can also contain empty I2-I5 options (which will not be recognized correctly by the amneziawg-go/wireguard-go binary). In order to fix that, you should set those to 0. P.P.S. if you get a /etc/resolv.conf error, make sure it's writable (I had it set to immutable to prevent NM from changing the file via chattr +i)

bsakaguchi commented

2026-10-13 20:36:49 +00:00

Author

Owner

@Nick0las-kipt commented on GitHub (May 25, 2026):

Observe similar issue on MAC OS 26.

@Nick0las-kipt commented on GitHub (May 25, 2026): Observe similar issue on MAC OS 26.

bsakaguchi referenced this issue

2026-10-13 21:20:25 +00:00

[PR #1204] [MERGED] Chore/bump version #2275