AmneziaWG — DPI and TSPU bypass (Windows and Android)

What is AmneziaWG

AmneziaWG — available in the Windows and Android apps — starts with the WireGuard protocol model and adds a layer of traffic disguise. The goal is to preserve WireGuard’s simplicity while removing the patterns DPI tools key on.

It keeps the same peer-to-peer tunnel concept and minimal surface area, but wraps the handshake and data in obfuscation so flows do not look like a VPN to basic and intermediate DPI.

In the Tunari apps for Windows and Android, AmneziaWG is offered as a protocol option alongside WireGuard, VLESS+Reality, OpenVPN and IKEv2, letting you match the protocol to your network conditions. On iOS, Tunari connects via WireGuard.

Why plain WireGuard gets blocked by DPI/TSPU in Russia

Russia’s TSPU systems use deep packet inspection to fingerprint protocols — which is why the Windows and Android apps offer AmneziaWG and VLESS+Reality. Plain WireGuard runs over UDP and has a recognizable handshake sequence and consistent keepalive behavior, which makes it easier to detect.

Once identified, ISPs can throttle, inject resets, or block these flows. In our tests and user reports, this leads to timeouts or unstable sessions for standard WireGuard on many Russian networks.

How AmneziaWG disguises handshakes and packets

In the Windows and Android apps, AmneziaWG alters the initial exchange so it no longer matches WireGuard’s fixed handshake bytes and lengths. The handshake is encrypted and length-randomized, and it may be padded or fragmented to defeat static signatures.

Data packets can be padded to variable sizes and timing can be jittered to break size/frequency fingerprints. It can also bind to arbitrary ports to blend with allowed traffic. In our tests (по нашим тестам), this has helped the Windows and Android apps pass Russian DPI/TSPU more reliably than plain WireGuard, but no method can be guaranteed 100%.

When to use AmneziaWG vs WireGuard and VLESS+Reality

Use WireGuard by default when your network allows it; it is simple and, in our tests, very fast and efficient on clean routes.

In the Windows and Android apps, switch to AmneziaWG on mobile carriers, campus Wi‑Fi, hotels, and Russian ISPs that block or shape UDP or WireGuard fingerprints. Tunari also operates nodes tuned for Russian routes, including MSS/MTU clamping and paths on niche ASNs to reduce exposure to common DPI blocks.

On the hardest networks that only permit mainstream HTTPS/TLS, choose VLESS+Reality — also a Windows and Android option. It disguises VPN traffic as ordinary TLS to defeat DPI. In our tests, this is the most effective option when UDP is fully filtered or TLS whitelisting is in place.

Connection, privacy and access

On iPhone, Tunari uses WireGuard with ChaCha20-Poly1305. The current iPhone app shows connection status and has no Kill Switch setting; full traffic blocking during interruptions is not guaranteed.

Tunari stores account and device identifiers, server and protocol details, session identifiers, public WireGuard keys, timestamps, traffic counters, connection results and errors, app version, IP address and country. It also records first-connection and trial events for its own service analytics. Read the Privacy Policy at /en/privacy-policy.

Available locations, supported apps, device limits, prices and any trial eligibility are shown on the download and pricing pages or in your account. Check the terms shown for your chosen platform and payment method; access to every website or network is not guaranteed.