[GH-ISSUE #1010] AmneziaWG is detected by DPI in Russia

bsakaguchi commented

2026-10-13 20:19:01 +00:00

Owner

Originally created by @nxstd on GitHub (Aug 25, 2024).
Original GitHub issue: https://github.com/amnezia-vpn/amnezia-client/issues/1010

Describe the bug
When trying to connect to the AmneziaWG server via the Russian mobile operator MTS, the connection is established, but packets are not received or sent.

To Reproduce
Steps to reproduce the behavior:

Configure AmneziaWG on your server using any port and any parameters.
Connect to your server via AmneziaWG using mobile Internet from MTS operator.
The connection will be established successfully, but no packets can be sent over it.

Expected behavior
Once connected to AmneziaWG, packets should be sent and received.

Log files
AmneziaVPN.log

Smartphone (please complete the following information):

Device: Poco X3 NFC
OS: Android 12
Version: 4.7.0.0

Server (please complete the following information):

OS: Ubuntu 22.04.4 LTS

Originally created by @nxstd on GitHub (Aug 25, 2024). Original GitHub issue: https://github.com/amnezia-vpn/amnezia-client/issues/1010 **Describe the bug** When trying to connect to the AmneziaWG server via the Russian mobile operator MTS, the connection is established, but packets are not received or sent. **To Reproduce** Steps to reproduce the behavior: 1. Configure AmneziaWG on your server using any port and any parameters. 2. Connect to your server via AmneziaWG using mobile Internet from MTS operator. 3. The connection will be established successfully, but no packets can be sent over it. **Expected behavior** Once connected to AmneziaWG, packets should be sent and received. **Log files** [AmneziaVPN.log](https://github.com/user-attachments/files/16738661/AmneziaVPN.log) **Smartphone (please complete the following information):** - Device: Poco X3 NFC - OS: Android 12 - Version: 4.7.0.0 **Server (please complete the following information):** - OS: Ubuntu 22.04.4 LTS

bsakaguchi commented

2026-10-13 20:19:02 +00:00

Author

Owner

@Bushroott commented on GitHub (Aug 27, 2024):

Use XRay. Anything that doesn't look like standard traffic will be blocked.

@Bushroott commented on GitHub (Aug 27, 2024): Use XRay. Anything that doesn't look like standard traffic will be blocked.

bsakaguchi commented

2026-10-13 20:19:02 +00:00

Author

Owner

@borisorlov21 commented on GitHub (Aug 28, 2024):

mobile operator MTS спб с ss работает проверил 28 авг 24г But the QR code for the program does not work🥲

@borisorlov21 commented on GitHub (Aug 28, 2024): mobile operator MTS спб с ss работает проверил 28 авг 24г But the QR code for the program does not work🥲

bsakaguchi commented

2026-10-13 20:19:03 +00:00

Author

Owner

@block888dev commented on GitHub (Aug 29, 2024):

Use XRay. Anything that doesn't look like standard traffic will be blocked.

is Xray and it's VLESS a VPN? The thing is that when a VPN used it's possible to ssh into an instance but with Xray type of connection - it's not possible. Just a bit off topic and see if you can advise

@block888dev commented on GitHub (Aug 29, 2024): > Use XRay. Anything that doesn't look like standard traffic will be blocked. is Xray and it's VLESS a VPN? The thing is that when a VPN used it's possible to ssh into an instance but with Xray type of connection - it's not possible. Just a bit off topic and see if you can advise

bsakaguchi commented

2026-10-13 20:19:03 +00:00

Author

Owner

@pokamest commented on GitHub (Aug 29, 2024):

@HIlight3R what values you are using for Jc, Jmix, Jmax ?

@pokamest commented on GitHub (Aug 29, 2024): @HIlight3R what values you are using for Jc, Jmix, Jmax ?

bsakaguchi commented

2026-10-13 20:19:03 +00:00

Author

Owner

@nxstd commented on GitHub (Aug 30, 2024):

Use XRay. Anything that doesn't look like standard traffic will be blocked.

XRay is less suitable for my needs. I need a VPN, not a proxy. Moreover, as far as I know, XRay issues one key for each device. I think it is unsafe.

@nxstd commented on GitHub (Aug 30, 2024): > Use XRay. Anything that doesn't look like standard traffic will be blocked. XRay is less suitable for my needs. I need a VPN, not a proxy. Moreover, as far as I know, XRay issues one key for each device. I think it is unsafe.

bsakaguchi commented

2026-10-13 20:19:04 +00:00

Author

Owner

@nxstd commented on GitHub (Aug 30, 2024):

I managed to find a config that allows you to bypass MTS DPI:

MTU = 1376
Jc = 1
Jmin = 1
Jmax = 3
S1 = 0
S2 = 0
H1 = 1
H2 = 2
H3 = 3
H4 = 4

But I think this is a temporary solution, sooner or later it will be blocked. It seems to me that in the long term, the developers should work on making their protocol, which they promote as "blocking-resistant", really be so.

@nxstd commented on GitHub (Aug 30, 2024): I managed to find a config that allows you to bypass MTS DPI: ``` MTU = 1376 Jc = 1 Jmin = 1 Jmax = 3 S1 = 0 S2 = 0 H1 = 1 H2 = 2 H3 = 3 H4 = 4 ``` But I think this is a temporary solution, sooner or later it will be blocked. It seems to me that in the long term, the developers should work on making their protocol, which they promote as "blocking-resistant", really be so.

bsakaguchi commented

2026-10-13 20:19:04 +00:00

Author

Owner

@Shulyaka commented on GitHub (Oct 29, 2024):

I have found out that reducing Jc (on both server and client side) reduces the chances of triggering the MTS DPI. Probably their filters just match a certain number of consecutive junk packets at the start of the session. We can overcome this rule by actively responding to the junk packets.

@Shulyaka commented on GitHub (Oct 29, 2024): I have found out that reducing Jc (on both server and client side) reduces the chances of triggering the MTS DPI. Probably their filters just match a certain number of consecutive junk packets at the start of the session. We can overcome this rule by actively responding to the junk packets.

bsakaguchi commented

2026-10-13 20:19:04 +00:00

Author

Owner

@Shulyaka commented on GitHub (Oct 29, 2024):

@HIlight3R I think your choices of S* and H* values make the traffic look too similar to vanilla wireguard.

@Shulyaka commented on GitHub (Oct 29, 2024): @HIlight3R I think your choices of S* and H* values make the traffic look too similar to vanilla wireguard.

bsakaguchi commented

2026-10-13 20:19:04 +00:00

Author

Owner

@nxstd commented on GitHub (Oct 29, 2024):

@HIlight3R I think your choices of S* and H* values make the traffic look too similar to vanilla wireguard.

But with these values, traffic is still not detected by DPI, unlike the default values or vanilla Wireguard.

@nxstd commented on GitHub (Oct 29, 2024): > @HIlight3R I think your choices of S* and H* values make the traffic look too similar to vanilla wireguard. But with these values, traffic is still not detected by DPI, unlike the default values or vanilla Wireguard.

bsakaguchi commented

2026-10-13 20:19:05 +00:00

Author

Owner

@Shulyaka commented on GitHub (Oct 29, 2024):

To be more future-proof, you may want to consider more random values of S* and H*, while keeping Jc low enough.

@Shulyaka commented on GitHub (Oct 29, 2024): To be more future-proof, you may want to consider more random values of S* and H*, while keeping Jc low enough.

bsakaguchi commented

2026-10-13 20:19:05 +00:00

Author

Owner

@nxstd commented on GitHub (Oct 29, 2024):

To be more future-proof, you may want to consider more random values of S* and H*, while keeping Jc low enough.

Ok, thanks for the tip. Unfortunately, if I change the values, I'll have to redo all the config files for the devices. So while it works, I'll leave it as is. But I'll keep it in mind.

@nxstd commented on GitHub (Oct 29, 2024): > To be more future-proof, you may want to consider more random values of S* and H*, while keeping Jc low enough. Ok, thanks for the tip. Unfortunately, if I change the values, I'll have to redo all the config files for the devices. So while it works, I'll leave it as is. But I'll keep it in mind.

bsakaguchi commented

2026-10-13 20:19:05 +00:00

Author

Owner

@vgdh commented on GitHub (Jun 1, 2025):

It works but painfully slow.

@vgdh commented on GitHub (Jun 1, 2025): It works but painfully slow.

bsakaguchi commented

2026-10-13 20:19:05 +00:00

Author

Owner

@Chris-win11 commented on GitHub (Jul 3, 2025):

I managed to find a config that allows you to bypass MTS DPI:
MTU = 1376
Jc = 1
Jmin = 1
Jmax = 3
S1 = 0
S2 = 0
H1 = 1
H2 = 2
H3 = 3
H4 = 4
But I think this is a temporary solution, sooner or later it will be blocked. It seems to me that in the long term, the developers should work on making their protocol, which they promote as "blocking-resistant", really be so.

Only these low values are not triggering or quite hi maybe also are ok? Or i'am wrong?

@Chris-win11 commented on GitHub (Jul 3, 2025): > I managed to find a config that allows you to bypass MTS DPI: > > ``` > MTU = 1376 > Jc = 1 > Jmin = 1 > Jmax = 3 > S1 = 0 > S2 = 0 > H1 = 1 > H2 = 2 > H3 = 3 > H4 = 4 > ``` > > But I think this is a temporary solution, sooner or later it will be blocked. It seems to me that in the long term, the developers should work on making their protocol, which they promote as "blocking-resistant", really be so. Only these low values are not triggering or quite hi maybe also are ok? Or i'am wrong?

bsakaguchi commented

2026-10-13 20:19:06 +00:00

Author

Owner

@nxstd commented on GitHub (Aug 9, 2025):

I managed to find a config that allows you to bypass MTS DPI:
MTU = 1376
Jc = 1
Jmin = 1
Jmax = 3
S1 = 0
S2 = 0
H1 = 1
H2 = 2
H3 = 3
H4 = 4
But I think this is a temporary solution, sooner or later it will be blocked. It seems to me that in the long term, the developers should work on making their protocol, which they promote as "blocking-resistant", really be so.
Only these low values are not triggering or quite hi maybe also are ok? Or i'am wrong?

I think high values are more likely to trigger DPI systems. The more we try to hide the use of VPN by various junk packets, the easier it is to detect. As I understand it, it is enough to simply make the AWG signature not so similar to vanilla Wireguard.

@nxstd commented on GitHub (Aug 9, 2025): > > I managed to find a config that allows you to bypass MTS DPI: > > > > ``` > > MTU = 1376 > > Jc = 1 > > Jmin = 1 > > Jmax = 3 > > S1 = 0 > > S2 = 0 > > H1 = 1 > > H2 = 2 > > H3 = 3 > > H4 = 4 > > ``` > > > > But I think this is a temporary solution, sooner or later it will be blocked. It seems to me that in the long term, the developers should work on making their protocol, which they promote as "blocking-resistant", really be so. > > Only these low values are not triggering or quite hi maybe also are ok? Or i'am wrong? I think high values are more likely to trigger DPI systems. The more we try to hide the use of VPN by various junk packets, the easier it is to detect. As I understand it, it is enough to simply make the AWG signature not so similar to vanilla Wireguard.

bsakaguchi commented

2026-10-13 20:19:06 +00:00

Author

Owner

@Shulyaka commented on GitHub (Aug 9, 2025):

My current understanding is that some providers has started to block all unrecognized traffic, use AWG 1.5 to disguise the traffic as something that DPI would pass through as legitimate traffic.

@Shulyaka commented on GitHub (Aug 9, 2025): My current understanding is that some providers has started to block all unrecognized traffic, use AWG 1.5 to disguise the traffic as something that DPI would pass through as legitimate traffic.

bsakaguchi commented

2026-10-13 20:19:06 +00:00

Author

Owner

@ciokan commented on GitHub (Sep 5, 2025):

My current understanding is that some providers has started to block all unrecognized traffic, use AWG 1.5 to disguise the traffic as something that DPI would pass through as legitimate traffic.

Some report success with Trojan proxies because they work on port 443 (https) and appear to go unnoticed.

@ciokan commented on GitHub (Sep 5, 2025): > My current understanding is that some providers has started to block all unrecognized traffic, use AWG 1.5 to disguise the traffic as something that DPI would pass through as legitimate traffic. Some report success with [Trojan proxies](https://www.anonymous-proxies.net/products/trojan-proxy/) because they work on port 443 (https) and appear to go unnoticed.

bsakaguchi commented

2026-10-13 20:19:07 +00:00

Author

Owner

@s-s-s commented on GitHub (Apr 7, 2026):

DNS = 1.1.1.1
MTU = 1280
Jc = 6
Jmin = 83
Jmax = 527
S1 = 44
S2 = 15
S3 = 40
S4 = 17
H1 = 100000-800000
H2 = 1000000-8000000
H3 = 10000000-80000000
H4 = 100000000-800000000
I1 =

This works for me on MTS

Delete the current value of parameter I1 and insert the following:
`<b 0xc70000000108ce1bf31eec7d93360000449e227e4596ed7f75c4d35ce31880b4133107c822c6355b51f0d7c1bba96d5c210a48aca01885fed0871cfc37d59137d73b506dc013bb4a13c060ca5b04b7ae215af71e37d6e8ff1db235f9fe0c25cb8b492471054a7c8d0d6077d430d07f6e87a8699287f6e69f54263c7334a8e144a29851429bf2e350e519445172d36953e96085110ce1fb641e5efad42c0feb4711ece959b72cc4d6f3c1e83251adb572b921534f6ac4b10927167f41fe50040a75acef62f45bded67c0b45b9d655ce374589cad6f568b8475b2e8921ff98628f86ff2eb5bcce6f3ddb7dc89e37c5b5e78ddc8d93a58896e530b5f9f1448ab3b7a1d1f24a63bf981634f6183a21af310ffa52e9ddf5521561760288669de01a5f2f1a4f922e68d0592026bbe4329b654d4f5d6ace4f6a23b8560b720a5350691c0037b10acfac9726add44e7d3e880ee6f3b0d6429ff33655c297fee786bb5ac032e48d2062cd45e305e6d8d8b82bfbf0fdbc5ec09943d1ad02b0b5868ac4b24bb10255196be883562c35a713002014016b8cc5224768b3d330016cf8ed9300fe6bf39b4b19b3667cddc6e7c7ebe4437a58862606a2a66bd4184b09ab9d2cd3d3faed4d2ab71dd821422a9540c4c5fa2a9b2e6693d411a22854a8e541ed930796521f03a54254074bc4c5bca152a1723260e7d70a24d49720acc544b41359cfc252385bda7de7d05878ac0ea0343c77715e145160e6562161dfe2024846dfda3ce99068817a2418e66e4f37dea40a21251c8a034f83145071d93baadf050ca0f95dc9ce2338fb082d64fbc8faba905cec66e65c0e1f9b003c32c943381282d4ab09bef9b6813ff3ff5118623d2617867e25f0601df583c3ac51bc6303f79e68d8f8de4b8363ec9c7728b3ec5fcd5274edfca2a42f2727aa223c557afb33f5bea4f64aeb252c0150ed734d4d8eccb257824e8e090f65029a3a042a51e5cc8767408ae07d55da8507e4d009ae72c47ddb138df3cab6cc023df2532f88fb5a4c4bd917fafde0f3134be09231c389c70bc55cb95a779615e8e0a76a2b4d943aabfde0e394c985c0cb0376930f92c5b6998ef49ff4a13652b787503f55c4e3d8eebd6e1bc6db3a6d405d8405bd7a8db7cefc64d16e0d105a468f3d33d29e5744a24c4ac43ce0eb1bf6b559aed520b91108cda2de6e2c4f14bc4f4dc58712580e07d217c8cca1aaf7ac04bab3e7b1008b966f1ed4fba3fd93a0a9d3a27127e7aa587fbcc60d548300146bdc126982a58ff5342fc41a43f83a3d2722a26645bc961894e339b953e78ab395ff2fb854247ad06d446cc2944a1aefb90573115dc198f5c1efbc22bc6d7a74e41e666a643d5f85f57fde81b87ceff95353d22ae8bab11684180dd142642894d8dc34e402f802c2fd4a73508ca99124e428d67437c871dd96e506ffc39c0fc401f666b437adca41fd563cbcfd0fa22fbbf8112979c4e677fb533d981745cceed0fe96da6cc0593c430bbb71bcbf924f70b4547b0bb4d41c94a09a9ef1147935a5c75bb2f721fbd24ea6a9f5c9331187490ffa6d4e34e6bb30c2c54a0344724f01088fb2751a486f425362741664efb287bce66c4a544c96fa8b124d3c6b9eaca170c0b530799a6e878a57f402eb0016cf2689d55c76b2a91285e2273763f3afc5bc9398273f5338a06d>`

@s-s-s commented on GitHub (Apr 7, 2026): ``` DNS = 1.1.1.1 MTU = 1280 Jc = 6 Jmin = 83 Jmax = 527 S1 = 44 S2 = 15 S3 = 40 S4 = 17 H1 = 100000-800000 H2 = 1000000-8000000 H3 = 10000000-80000000 H4 = 100000000-800000000 I1 = ``` This works for me on MTS ``` Delete the current value of parameter I1 and insert the following: `<b 0xc70000000108ce1bf31eec7d93360000449e227e4596ed7f75c4d35ce31880b4133107c822c6355b51f0d7c1bba96d5c210a48aca01885fed0871cfc37d59137d73b506dc013bb4a13c060ca5b04b7ae215af71e37d6e8ff1db235f9fe0c25cb8b492471054a7c8d0d6077d430d07f6e87a8699287f6e69f54263c7334a8e144a29851429bf2e350e519445172d36953e96085110ce1fb641e5efad42c0feb4711ece959b72cc4d6f3c1e83251adb572b921534f6ac4b10927167f41fe50040a75acef62f45bded67c0b45b9d655ce374589cad6f568b8475b2e8921ff98628f86ff2eb5bcce6f3ddb7dc89e37c5b5e78ddc8d93a58896e530b5f9f1448ab3b7a1d1f24a63bf981634f6183a21af310ffa52e9ddf5521561760288669de01a5f2f1a4f922e68d0592026bbe4329b654d4f5d6ace4f6a23b8560b720a5350691c0037b10acfac9726add44e7d3e880ee6f3b0d6429ff33655c297fee786bb5ac032e48d2062cd45e305e6d8d8b82bfbf0fdbc5ec09943d1ad02b0b5868ac4b24bb10255196be883562c35a713002014016b8cc5224768b3d330016cf8ed9300fe6bf39b4b19b3667cddc6e7c7ebe4437a58862606a2a66bd4184b09ab9d2cd3d3faed4d2ab71dd821422a9540c4c5fa2a9b2e6693d411a22854a8e541ed930796521f03a54254074bc4c5bca152a1723260e7d70a24d49720acc544b41359cfc252385bda7de7d05878ac0ea0343c77715e145160e6562161dfe2024846dfda3ce99068817a2418e66e4f37dea40a21251c8a034f83145071d93baadf050ca0f95dc9ce2338fb082d64fbc8faba905cec66e65c0e1f9b003c32c943381282d4ab09bef9b6813ff3ff5118623d2617867e25f0601df583c3ac51bc6303f79e68d8f8de4b8363ec9c7728b3ec5fcd5274edfca2a42f2727aa223c557afb33f5bea4f64aeb252c0150ed734d4d8eccb257824e8e090f65029a3a042a51e5cc8767408ae07d55da8507e4d009ae72c47ddb138df3cab6cc023df2532f88fb5a4c4bd917fafde0f3134be09231c389c70bc55cb95a779615e8e0a76a2b4d943aabfde0e394c985c0cb0376930f92c5b6998ef49ff4a13652b787503f55c4e3d8eebd6e1bc6db3a6d405d8405bd7a8db7cefc64d16e0d105a468f3d33d29e5744a24c4ac43ce0eb1bf6b559aed520b91108cda2de6e2c4f14bc4f4dc58712580e07d217c8cca1aaf7ac04bab3e7b1008b966f1ed4fba3fd93a0a9d3a27127e7aa587fbcc60d548300146bdc126982a58ff5342fc41a43f83a3d2722a26645bc961894e339b953e78ab395ff2fb854247ad06d446cc2944a1aefb90573115dc198f5c1efbc22bc6d7a74e41e666a643d5f85f57fde81b87ceff95353d22ae8bab11684180dd142642894d8dc34e402f802c2fd4a73508ca99124e428d67437c871dd96e506ffc39c0fc401f666b437adca41fd563cbcfd0fa22fbbf8112979c4e677fb533d981745cceed0fe96da6cc0593c430bbb71bcbf924f70b4547b0bb4d41c94a09a9ef1147935a5c75bb2f721fbd24ea6a9f5c9331187490ffa6d4e34e6bb30c2c54a0344724f01088fb2751a486f425362741664efb287bce66c4a544c96fa8b124d3c6b9eaca170c0b530799a6e878a57f402eb0016cf2689d55c76b2a91285e2273763f3afc5bc9398273f5338a06d>` ```

bsakaguchi referenced this issue

2026-10-13 20:47:43 +00:00

[PR #327] [MERGED] Update Android icons #1751

bsakaguchi referenced this issue

2026-10-13 20:47:50 +00:00

[PR #339] [MERGED] Release 3.1.0.1 #1761

Rows
Columns

[GH-ISSUE #1010] AmneziaWG is detected by DPI in Russia #327