AmneziaWG Windows Client

Windows assigns a unique GUID to every AmneziaWG adapter. The application makes this GUID deterministic based on the tunnel's configuration.

Why this matters: Because the GUID is deterministic, Windows can consistently apply firewall policies (such as categorizing the connection as "Public" or "Private") to the tunnel.

Warning: If you change the AmneziaWG configuration, the GUID will change. This will cause Windows to treat the connection as a new network, potentially resetting firewall categorization or applied policies.

When an interface has exactly one peer and that peer includes an AllowedIP of /0 (or ::/0 for IPv6), AmneziaWG activates a kill-switch via firewall rules to prevent traffic leaks.

The kill-switch permits only the following:

• Packets from the tunnel service itself (to allow AmneziaWG traffic).
• Packets to port 53 only if they are directed to the DNS servers specified in your configuration (this prevents Windows from using other multihomed DNS servers).
• Loopback packets.
• Packets traveling through the AmneziaWG tunnel.
• DHCP for IPv4/IPv6 and NDP for IPv6.

All other packets are blocked.

AmneziaWG for Windows uses two distinct service models that can be used together or separately:

1. Tunnel Service: A dedicated Windows service created for each individual tunnel. It handles the actual network interface and connection logic. It is identified by the service name AmneziaWGTunnel$myconfname.
2. Manager Service: A single Windows service named AmneziaWGManager responsible for the system tray UI and responding to UI requests (adding, removing, starting, or stopping tunnels). It also manages the secure configuration store.

Commands will log errors and status to stderr or stdout if stderr is unavailable.

The AmneziaWG network adapter is dynamic: it is created when a tunnel starts and destroyed when the tunnel stops.

Implications for developers: If you need to apply additional filters, address families, or protocols to the adapter, you cannot rely on a static interface. You must bind these components programmatically. This can be achieved through:

• Automatic NDIS layer binding.
• Using configuration files that allow for script execution (note: this may involve executing scripts with elevated privileges).

The AmneziaWG tunnel service manages routing by deduplicating all AllowedIPs from every peer and adding them as routes to the AmneziaWG interface.

MTU Management: If no MTU is explicitly specified in your configuration, the service automatically calculates the MTU for the AmneziaWG interface. It identifies the system's default route interface (the one with a /0 CIDR) and sets the AmneziaWG MTU to be 80 less than the MTU of that default interface.

Packet Transmission: The service monitors the routing table to find the outgoing route that does not loop back to itself. It uses IP_PKTINFO/IPV6_PKTINFO to send packets, tracking the incoming interface and source address to ensure replies are always sent back through the correct path.

To sign the binaries, create a sign.bat file in the repository root with your signing provider and timestamp server details. Then, run the standard build commands from a shell where signtool.exe is available in the PATH (e.g., the Visual Studio 2017 command prompt).

set SigningProvider=/sha1 8BC932FDFF15B892E8364C49B383210810E4709D
set TimestampServer=http://timestamp.entrust.net/rfc3161ts2

Enterprise administrators can bypass the wireguard-installer.exe and deploy AmneziaWG using MSI files directly via Group Policy Objects (GPO).

To perform a silent installation that does not launch the UI after installation, use the DO_NOT_LAUNCH MSI property.

MSI Property: DO_NOT_LAUNCH

AmneziaWG for Windows is a fully-featured client that utilizes Wintun. It is the official and recommended method for using AmneziaWG on the Windows platform.

To install the client, use the official WireGuard installer which automatically selects the correct architecture, verifies signatures and hashes, and performs the installation.

https://download.wireguard.com/windows-client/wireguard-installer.exe

To build the installer package, navigate to the installer directory and run the build script. This script handles dependency downloading and verification.

C:\Projects\amneziawg-windows-client> cd installer
C:\Projects\amneziawg-windows-client\installer> build

Once the build is complete, you can run the application by executing the appropriate binary for your architecture. Running the executable installs the manager service and launches the UI.

• For 64-bit: amd64\amneziawg.exe
• For 32-bit: x86\amneziawg.exe

Alternatively, you can use the quickinstall.bat script to create a custom installer.

C:\Projects\amneziawg-windows-client> amd64\amneziawg.exe

If you want to route all traffic through the tunnel but want to avoid the restrictive firewalling/kill-switch semantics (and allow standard Windows DNS/routing behavior), do not use /0 CIDR notation. Instead, use the following specific routes in your configuration:

For IPv4:

• Use 0.0.0.0/1 and 128.0.0.0/1 instead of 0.0.0.0/0.

For IPv6:

• Use ::/1 and 8000::/1 instead of ::/0.

This configuration achieves nearly the same routing effect as a default route but prevents the activation of the AmneziaWG kill-switch. In the application UI, this can be toggled via a checkbox in the editor.

# Example of non-restrictive default routing
AllowedIPs = 0.0.0.0/1, 128.0.0.0/1, ::/1, 8000::/1