AmneziaVPN review covering its open-source self-hosted options, protocols like AmneziaWG 3.1, pricing tiers, and censorship resistance features for privacy users as of October 2026.
AmneziaVPN is an open-source client released under GNU GPL 3.0 that lets users deploy and manage their own VPN servers. The GitHub repository for the client has accumulated 15.4k stars and 1.2k forks as of October 2026, reflecting strong community interest in its approach to censorship resistance.
The application supports Windows, macOS, Linux, Android, and iOS. It connects to a user-provided server over SSH and automatically installs Docker containers for multiple protocols, including OpenVPN, WireGuard, AmneziaWG, and XRay variants. This design targets users in restricted regions such as Russia, Iran, Myanmar, and China who require control over their infrastructure rather than relying on third-party providers.
Privacy-conscious individuals often seek alternatives to commercial VPN services because self-hosted setups avoid handing traffic data to external companies. AmneziaVPN positions itself for exactly this audience by emphasizing user-controlled servers and open-source code that has undergone security audits in 2022, 2024, and 2025.
AmneziaVPN supports eight protocols: OpenVPN, OpenVPN over Cloak, WireGuard, AmneziaWG, IKEv2, XRay Reality/VLESS, and Shadowsocks. AmneziaWG 3.1 builds on earlier iterations by adding signature packet mimicry for protocols such as DNS and QUIC, raising the bar against deep packet inspection without the handshake patterns that flag standard WireGuard. XRay Reality further conceals traffic by presenting as ordinary TLS sessions to outside observers.
Obfuscation strength varies by choice. Cloak-wrapped OpenVPN and AmneziaWG 3.1 provide the strongest resistance to active probing and DPI in high-censorship networks, while plain WireGuard or IKEv2 remain detectable once signatures are known. Shadowsocks and XRay add another layer for environments that block common VPN ports outright. Users must weigh throughput against concealment: heavier obfuscation increases CPU load and can reduce effective speeds on lower-end hardware.
Split tunneling behaves differently across platforms. Android and desktop clients allow both IP and application rules, letting traffic for specific apps bypass the tunnel. iOS, macOS, and Linux versions restrict rules to IP addresses only. A kill switch blocks all outbound traffic if the tunnel drops, preventing leaks on every supported platform. These controls trade flexibility for protection, and the platform-specific limits require users to verify rules match their threat model before relying on them.
Amnezia offers four distinct tiers as of October 2026, each with clear cost and capability differences. The comparison below uses official site figures for monthly pricing, speed caps, device limits, and protocol availability.
| Tier | Monthly Cost | Speed Limit | Device Support | Protocol Access |
|---|---|---|---|---|
| Free | 0 USD | 8 Mbps | App on Windows, macOS, Linux, Android, iOS | AmneziaWG 3.1 only |
| Premium | From 3.3 USD (2-year plan 80 USD) | Up to 200 Mbps | Up to 7 devices; Android TV and router support | AmneziaWG 3.1 + XRay |
| Self-hosted | 0 USD (user pays VPS, e.g. 5.25 USD Start plan) | VPS-dependent (up to 100 Mbps on entry VPS) | Unlimited via own server | All 8 protocols including OpenVPN over Cloak, WireGuard, IKEv2, Shadowsocks, VLESS |
| Business | 8 USD per user (min. 20 users) | Not specified | 4 locations included | Not specified beyond managed options |
Self-hosted becomes the only viable option when users need the full eight protocols, custom server locations outside Premium’s 20 countries, or complete avoidance of any managed-service logging. The Free tier suffices only for basic access to a handful of social sites at very low speeds, while Premium adds speed and extra protocols at a recurring fee. Business targets teams that require centralized billing and multiple fixed locations but carries the highest per-user cost and minimum commitment.
The Amnezia client connects directly to a user-supplied VPS over SSH, then provisions Docker containers for the selected protocols.
Platform differences appear mainly in split-tunneling granularity and container management overhead; Linux servers require the least post-install tuning while mobile clients handle container updates through the app.
Self-hosted Amnezia deployments still expose users to several privacy weak points. VPS providers frequently require KYC verification, directly linking payment details and identity to the server IP address that will appear in Monero transaction flows.
Clearnet nodes introduce additional risks. If the VPS or any intermediate hop operates on the clearnet without proper obfuscation, an observer can correlate the originating IP with wallet activity even when the VPN tunnel is active.
Traffic correlation remains a fundamental limit. No VPN, including Amnezia’s AmneziaWG or XRay options, prevents an adversary who controls both entry and exit points from matching packet timing and volume patterns.
Practical steps for Monero users include paying for VPS with XMR when the provider accepts it, enabling the kill switch on every device, and testing split-tunneling rules to ensure only wallet traffic routes through the tunnel. Route node connections over Tor where feasible and avoid managed Premium tiers that require account creation.
The client supports protocols such as AmneziaWG 3.1, XRay Reality and Cloak-obfuscated OpenVPN, which the project positions for high-censorship environments including Iran, Russia, Myanmar and China.
7ASecurity conducted security audits in 2022, 2024 and 2025; the project site states the client passed each review, though full reports are not linked.
Amnezia Premium claims up to 200 Mbps on its managed servers with unlimited traffic, while the free tier is capped at 8 Mbps and limited to basic site access.
Premium supports up to seven simultaneous devices; self-hosted instances have no hard limit beyond the VPS resources you supply.
You can import existing server credentials or redeploy the same protocols on a new VPS via the open-source client; split-tunneling and kill-switch rules must be recreated manually.
