[GH-ISSUE #207] AmneziaWG 3.0 support in the kernel module and tools — roadmap? #118

New issue

Open

opened 2026-10-13 21:06:44 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-13 21:06:44 +00:00

Owner

Originally created by @MMrrTT on GitHub (Aug 3, 2026).
Original GitHub issue: https://github.com/amnezia-vpn/amneziawg-linux-kernel-module/issues/207

AmneziaWG 3.0 was announced together with AmneziaVPN 5.0.0.5 in June 2026. However, the latest tags in amneziawg-linux-kernel-module (1.0.20260611) and amneziawg-tools (v1.0.20260618) predate that announcement, and I could not find any changelog entry mentioning 3.0 parameters.

Is 3.0 support planned for the native kernel module and awg/awg-quick, and is there an estimated timeline?

Context: I run a self-hosted server installation with the DKMS module and hand-written configs for several peers, without the AmneziaVPN client managing the host. Currently on 2.0 with custom S/H/I parameters, working well. If 3.0 is only available through the client-managed containerized deployment, self-hosted setups are effectively cut off from it.

Originally created by @MMrrTT on GitHub (Aug 3, 2026). Original GitHub issue: https://github.com/amnezia-vpn/amneziawg-linux-kernel-module/issues/207 AmneziaWG 3.0 was announced together with AmneziaVPN 5.0.0.5 in June 2026. However, the latest tags in amneziawg-linux-kernel-module (1.0.20260611) and amneziawg-tools (v1.0.20260618) predate that announcement, and I could not find any changelog entry mentioning 3.0 parameters. Is 3.0 support planned for the native kernel module and awg/awg-quick, and is there an estimated timeline? Context: I run a self-hosted server installation with the DKMS module and hand-written configs for several peers, without the AmneziaVPN client managing the host. Currently on 2.0 with custom S/H/I parameters, working well. If 3.0 is only available through the client-managed containerized deployment, self-hosted setups are effectively cut off from it.

bsakaguchi commented

2026-10-13 21:06:44 +00:00

Author

Owner

@bivlked commented on GitHub (Aug 4, 2026):

3.0 is already in both repos, it is just hard to see from the tag list. Module: v3.0.20260731-04 (c78a89e, 31 Jul). Tools: v3.0.20260730 (d09ecc3, 30 Jul). Both are in the PPA - I queried the Launchpad API today and focal, jammy and noble all publish amneziawg-dkms built from c78a89e, dated 1 Aug. Nothing for questing.

Part of the confusion is that the tag you quote, v1.0.20260611, is not a 1.x tag in the protocol sense. src/device.h at that tag already contains struct magic_header headers[4], which is the 2.0 ranged-header work. So tag names and protocol numbers have not been in step, at least across those two.

Package versions do not help either. On my test box:

$ dpkg -l | grep amnezia
amneziawg-dkms   1.0.0-0~202608010147+c78a89e~ubuntu24.04.1
amneziawg-tools  1.0.20210914-0~202607302224+d09ecc3~ubuntu24.04.1

The leading part is packaging, the commit suffix is what you actually got. These two tell you plainly:

$ awg --version
amneziawg-tools v3.0.20260730 - https://amnezia.org
$ modinfo amneziawg | grep ^version
version:  3.0.20260731-04

One more thing that makes it hard to see: the API returns no GitHub Releases for this repo at all, only tags. amneziawg-tools does publish them.

I could not find a changelog either, but the config surface diffs cleanly. Between tools v1.0.20260618-2 and v3.0.20260730, seven keys were added and none removed:

HeaderProtectionKey, ContentPaddingAddition, RekeyAfterTime, RekeyTimeout, RejectAfterTime, KeepaliveTimeout, MaxHandshakeAttempts

Self-hosted is not cut off. awg-quick passes every key it does not consume itself straight to awg setconf, so it needs no special handling for the new ones. I brought an interface up through awg-quick today with all seven set, and awg showconf read them all back.

Four things that cost me time:

HeaderProtectionKey is a base64 key like any other, not hex.
It has to be identical on both ends. On fresh interfaces I tried server-only, client-only, and two different keys: no handshake in any of the three, 100% loss. Same key on both sides works.
It also wants S1-S4 >= 12. The code applies the same check to all four, I only exercised S1: 12 is accepted, 11 is not. The kernel text reads "must be more then 12" while the test is < 12, so 12 itself is fine. When it rejects, awg prints only Unable to modify interface: Invalid argument - the reason goes through net_dbg_ratelimited, so you see nothing until dynamic debug is on: echo "module amneziawg +p" > /sys/kernel/debug/dynamic_debug/control.
None of these device parameters can be unset with awg setconf. I set Jc, S4, H1, I1, ContentPaddingAddition and RekeyAfterTime, then applied a config containing only PrivateKey and ListenPort, and all six were still there afterwards. HeaderProtectionKey behaves the same. So trying things out is somewhat one-way: getting back to a clean interface means deleting and recreating it.

One caveat about the other end of the link. amneziawg-android 3.0.1 is still marked prerelease and the newest amneziawg-windows-client release is 2.0.2, so anything that has to match on both sides is for now only usable between hosts you control.

Unrelated to 3.0, but since you mention custom S parameters: with a non-zero S4 the handshake rate goes up sharply, and that is not new in 3.0. See #186.

@bivlked commented on GitHub (Aug 4, 2026): 3.0 is already in both repos, it is just hard to see from the tag list. Module: `v3.0.20260731-04` (`c78a89e`, 31 Jul). Tools: `v3.0.20260730` (`d09ecc3`, 30 Jul). Both are in the PPA - I queried the Launchpad API today and `focal`, `jammy` and `noble` all publish `amneziawg-dkms` built from `c78a89e`, dated 1 Aug. Nothing for `questing`. Part of the confusion is that the tag you quote, `v1.0.20260611`, is not a 1.x tag in the protocol sense. `src/device.h` at that tag already contains `struct magic_header headers[4]`, which is the 2.0 ranged-header work. So tag names and protocol numbers have not been in step, at least across those two. Package versions do not help either. On my test box: ``` $ dpkg -l | grep amnezia amneziawg-dkms 1.0.0-0~202608010147+c78a89e~ubuntu24.04.1 amneziawg-tools 1.0.20210914-0~202607302224+d09ecc3~ubuntu24.04.1 ``` The leading part is packaging, the commit suffix is what you actually got. These two tell you plainly: ``` $ awg --version amneziawg-tools v3.0.20260730 - https://amnezia.org $ modinfo amneziawg | grep ^version version: 3.0.20260731-04 ``` One more thing that makes it hard to see: the API returns no GitHub Releases for this repo at all, only tags. amneziawg-tools does publish them. I could not find a changelog either, but the config surface diffs cleanly. Between tools `v1.0.20260618-2` and `v3.0.20260730`, seven keys were added and none removed: `HeaderProtectionKey`, `ContentPaddingAddition`, `RekeyAfterTime`, `RekeyTimeout`, `RejectAfterTime`, `KeepaliveTimeout`, `MaxHandshakeAttempts` Self-hosted is not cut off. `awg-quick` passes every key it does not consume itself straight to `awg setconf`, so it needs no special handling for the new ones. I brought an interface up through `awg-quick` today with all seven set, and `awg showconf` read them all back. Four things that cost me time: - `HeaderProtectionKey` is a base64 key like any other, not hex. - It has to be identical on both ends. On fresh interfaces I tried server-only, client-only, and two different keys: no handshake in any of the three, 100% loss. Same key on both sides works. - It also wants `S1`-`S4` >= 12. The code applies the same check to all four, I only exercised `S1`: 12 is accepted, 11 is not. The kernel text reads "must be more then 12" while the test is `< 12`, so 12 itself is fine. When it rejects, `awg` prints only `Unable to modify interface: Invalid argument` - the reason goes through `net_dbg_ratelimited`, so you see nothing until dynamic debug is on: `echo "module amneziawg +p" > /sys/kernel/debug/dynamic_debug/control`. - None of these device parameters can be unset with `awg setconf`. I set `Jc`, `S4`, `H1`, `I1`, `ContentPaddingAddition` and `RekeyAfterTime`, then applied a config containing only `PrivateKey` and `ListenPort`, and all six were still there afterwards. `HeaderProtectionKey` behaves the same. So trying things out is somewhat one-way: getting back to a clean interface means deleting and recreating it. One caveat about the other end of the link. `amneziawg-android` 3.0.1 is still marked prerelease and the newest `amneziawg-windows-client` release is 2.0.2, so anything that has to match on both sides is for now only usable between hosts you control. Unrelated to 3.0, but since you mention custom S parameters: with a non-zero `S4` the handshake rate goes up sharply, and that is not new in 3.0. See #186.

No labels

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

amnezia-vpn/amneziawg-linux-kernel-module#118

No description provided.

Rows
Columns