AmneziaWG — DPI and TSPU bypass

What is AmneziaWG

AmneziaWG starts with the WireGuard protocol model and adds a layer of traffic disguise. The goal is to preserve WireGuard’s simplicity while removing the patterns DPI tools key on.

It keeps the same peer-to-peer tunnel concept and minimal surface area, but wraps the handshake and data in obfuscation so flows do not look like a VPN to basic and intermediate DPI.

Tunari offers AmneziaWG as a protocol option alongside WireGuard, VLESS+Reality, OpenVPN, and IKEv2, letting you match the protocol to your network conditions.

Why plain WireGuard gets blocked by DPI/TSPU in Russia

Russia’s TSPU systems use deep packet inspection to fingerprint protocols. Plain WireGuard runs over UDP and has a recognizable handshake sequence and consistent keepalive behavior, which makes it easier to detect.

Once identified, ISPs can throttle, inject resets, or block these flows. In our tests and user reports, this leads to timeouts or unstable sessions for standard WireGuard on many Russian networks.

How AmneziaWG disguises handshakes and packets

AmneziaWG alters the initial exchange so it no longer matches WireGuard’s fixed handshake bytes and lengths. The handshake is encrypted and length-randomized, and it may be padded or fragmented to defeat static signatures.

Data packets can be padded to variable sizes and timing can be jittered to break size/frequency fingerprints. It can also bind to arbitrary ports to blend with allowed traffic. In our tests (по нашим тестам), this has helped it pass Russian DPI/TSPU more reliably than plain WireGuard, but no method can be guaranteed 100%.

When to use AmneziaWG vs WireGuard and VLESS+Reality

Use WireGuard by default when your network allows it; it is simple and, in our tests, very fast and efficient on clean routes.

Switch to AmneziaWG on mobile carriers, campus Wi‑Fi, hotels, and Russian ISPs that block or shape UDP or WireGuard fingerprints. Tunari also operates nodes tuned for Russian routes, including MSS/MTU clamping and paths on niche ASNs to reduce exposure to common DPI blocks.

On the hardest networks that only permit mainstream HTTPS/TLS, choose VLESS+Reality. It disguises VPN traffic as ordinary TLS to defeat DPI. In our tests, this is the most effective option when UDP is fully filtered or TLS whitelisting is in place.

How Tunari implements AmneziaWG

Security and privacy: AES-256 encryption, a strict no-logs policy by design (not independently audited yet), and a Kill Switch that blocks traffic if the tunnel drops.

Infrastructure: servers in France, Poland, and Canada, with more locations coming. Some nodes are optimized for Russian traffic patterns.

Apps and devices: iOS and Android apps are available on the stores, and Windows has an installer. macOS is in alpha. Standard EU/global subscriptions support up to 10 devices simultaneously.

Getting started: 7-day free trial with no credit card and a 30-day money-back guarantee. EU pricing from about $5.99 per month on annual plans or $9.99 monthly; in Russia, 399 ₽/mo or 239 ₽/mo on annual plans. We accept cards, SBP via Severpay, and USDT. Support is available via Telegram bot @TunariVPNBot and email support@tunarivpn.com. Company: TunariVPN Sp. z o.o., Warsaw, Poland (EU GDPR).