[GH-ISSUE #2089] Client Config Generation Uses Internal VPN IP instead of Public IP when Connected via VPN #918

New issue

Open

opened 2026-10-13 20:31:03 +00:00 by bsakaguchi · 2 comments

bsakaguchi commented

2026-10-13 20:31:03 +00:00

Owner

Originally created by @ch9ch9n on GitHub (Dec 22, 2025).
Original GitHub issue: https://github.com/amnezia-vpn/amnezia-client/issues/2089

Description
When generating a new client configuration (AmneziaWG/WireGuard) while connected to the server through the VPN itself (e.g., administrator is managing the server via the Amnezia VPN tunnel), the generated client config/key incorrecty uses the Internal VPN Gateway IP (e.g., 172.29.172.1) as the server endpoint, instead of the server's Public Static IP.

This results in broken configuration files that cannot connect from the outside world, as they try to connect to a private local IP address.

Steps to Reproduce

Connect to the Amnezia VPN server using the Amnezia Client (Administrator).
While connected via VPN, go to "Share" or "Add new device/user".
Generate a config for a new device (AmneziaWG or WireGuard).
Inspect the generated config (or decode the vpn:// link).
Observe the Endpoint or IP field.

Expected Behavior
The generated configuration should always use the Server's Public IP address (which is known to the server instance), regardless of the administrator's current connection method.

Actual Behavior
The generated configuration uses the Internal VPN Gateway IP (e.g., 172.29.172.1) as the Endpoint.
Example broken link payload: ...&ip=172.29.172.1&...

Why we generate keys via VPN
For security reasons, we have hardened our server by moving SSH to a non-standard port and restricting access to it only from the VPN subnet. The administrator cannot connect to the server panel/SSH without being connected to the VPN first. Therefore, all management actions, including key generation, are performed through the tunnel.

Workaround
We have to manually scripts to decode the base64 vpn:// key, zlib-decompress it, replace the internal IP with the Public IP, and re-encode it.

Originally created by @ch9ch9n on GitHub (Dec 22, 2025). Original GitHub issue: https://github.com/amnezia-vpn/amnezia-client/issues/2089 **Description** When generating a new client configuration (AmneziaWG/WireGuard) while connected to the server **through the VPN itself** (e.g., administrator is managing the server via the Amnezia VPN tunnel), the generated client config/key incorrecty uses the **Internal VPN Gateway IP** (e.g., `172.29.172.1`) as the server endpoint, instead of the server's **Public Static IP**. This results in broken configuration files that cannot connect from the outside world, as they try to connect to a private local IP address. **Steps to Reproduce** 1. Connect to the Amnezia VPN server using the Amnezia Client (Administrator). 2. While connected via VPN, go to "Share" or "Add new device/user". 3. Generate a config for a new device (AmneziaWG or WireGuard). 4. Inspect the generated config (or decode the `vpn://` link). 5. Observe the `Endpoint` or `IP` field. **Expected Behavior** The generated configuration should **always** use the Server's Public IP address (which is known to the server instance), regardless of the administrator's current connection method. **Actual Behavior** The generated configuration uses the Internal VPN Gateway IP (e.g., `172.29.172.1`) as the Endpoint. Example broken link payload: `...&ip=172.29.172.1&...` **Why we generate keys via VPN** For security reasons, we have hardened our server by moving SSH to a non-standard port and restricting access to it **only** from the VPN subnet. The administrator cannot connect to the server panel/SSH without being connected to the VPN first. Therefore, all management actions, including key generation, are performed through the tunnel. **Workaround** We have to manually scripts to decode the base64 `vpn://` key, zlib-decompress it, replace the internal IP with the Public IP, and re-encode it.

bsakaguchi commented

2026-10-13 20:31:04 +00:00

Author

Owner

@Ko496-glitch commented on GitHub (Dec 29, 2025):

hey @ch9ch9n can i work on this issue ?

@Ko496-glitch commented on GitHub (Dec 29, 2025): hey @ch9ch9n can i work on this issue ?

bsakaguchi commented

2026-10-13 20:31:04 +00:00

Author

Owner

@ch9ch9n commented on GitHub (Dec 31, 2025):

hey @Ko496-glitch its not my repo, but i think no problems, if you want.

@ch9ch9n commented on GitHub (Dec 31, 2025): hey @Ko496-glitch its not my repo, but i think no problems, if you want.

No labels

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

amnezia-vpn/amnezia-client#918

No description provided.

Rows
Columns