Amnezia VPN Client is an open-source, GPL-3.0 licensed VPN client for Windows, macOS, Linux, Android, and iOS that connects to a VPN and also deploys a self-hosted VPN server onto hardware the user already controls.

What it is

Amnezia VPN Client is a cross-platform desktop and mobile application written in C++ and built on Qt. It sits in the self-hosted VPN tooling ecosystem, working directly with the server-side software it manages: OpenVPN, WireGuard, and IKEv2, plus the Xray-core, Cloak, Shadowsocks, and AmneziaWG protocols used for traffic obfuscation. Its supporting stack includes OpenSSL for cryptography and LibSsh for reaching the server over SSH, with Conan handling dependency management. The registry topics — vpn-client, vpn-server, openvpn, wireguard, ikev2, shadowsocks, cloak, and gfw — describe both halves of that job.

The concrete problem it solves is provisioning. Setting up a self-hosted VPN normally means acquiring a server, opening a shell, installing and configuring the VPN daemon, generating keys, writing client profiles, and repeating that work whenever something breaks. Amnezia replaces that manual sequence with a guided flow: the user enters the server's IP address, SSH login, and password, and the client installs VPN docker containers on the server and connects. A second problem is censorship. Because plain OpenVPN and WireGuard traffic is easy to identify and block, the project ships obfuscated transports — OpenVPN over the Cloak plugin, OpenVPN over Shadowsocks, AmneziaWG, and XRay — and publishes a mirror link for its website and documentation because the primary domain is blocked in some regions.

Key capabilities

• Automatic server deployment over SSH: enter the IP address, SSH login, and password, and the client installs VPN docker containers on your server and connects to the result.
• Classic VPN protocols: OpenVPN, WireGuard, and IKEv2.
• Traffic masking protocols: OpenVPN over Cloak, Shadowsocks (OpenVPN over Shadowsocks), AmneziaWG, and XRay.
• Split tunneling, with the ability to add individual sites to the client so only those use the VPN, plus per-app split tunneling on Android and Desktop.
• Builds for Windows, macOS, Linux, Android, and iOS.
• AmneziaWG protocol configuration support on Keenetic beta firmware.
• Translation files maintained through the GitHub Actions workflow.

Who uses it and how

• Users in censored networks: the project runs separate Telegram support channels in English, Farsi, Myanmar, and Russian, and the gfw topic points directly at firewall-circumvention use.
• Self-hosters who already rent a server and hold SSH credentials, but who do not want to hand-build an OpenVPN or WireGuard installation.
• Android and Desktop users who need per-app split tunneling so that only selected applications travel through the tunnel.
• Keenetic router owners running the beta firmware, who use the client to manage AmneziaWG configuration on the device.
• Anyone wanting the server and the client under their own control rather than a third-party VPN subscription.

Getting started

Installers for Windows, macOS, Linux, Android, and iOS are published on the project's GitHub releases page and at amnezia.org; a Google Storage mirror is provided for the website and documentation when the main domain is unreachable. After installing, enter the server's IP address, SSH login, and password, and the client performs the server-side installation itself.

How it compares

The facts name no paid products this replaces, but the components it wraps — OpenVPN, WireGuard, IKEv2, Cloak, Shadowsocks, XRay — are server daemons and protocol implementations that assume an already-configured endpoint, whereas Amnezia supplies the client, the obfuscation options, and the deployment step in one application. Where a plain OpenVPN or WireGuard client needs a profile built elsewhere, this project generates that setup from SSH credentials.

When to use it — and when not to

A self-hoster must still supply and operate a server with SSH access, since the client installs docker containers there and the tunnel depends on that machine staying reachable and maintained. Users who want no server administration at all should look elsewhere, and those needing per-app split tunneling outside Android and Desktop will not find it here. The repository also carries 1,126 open issues, and the project sells a paid Premium subscription alongside the GPL-3.0 client, so the open-source build should be evaluated on its own merits.

git submodule update --init --recursive

# Build executables for the host platform
deploy/build.sh

# Or just
deploy/build.sh

# Build executables and installers for the host platform
deploy/build.sh --installer all

# Build Android APK and AAB
deploy/build.sh -t android --aab

# Call for help
deploy/build.sh -h

:: Build executables for Windows
deploy/build.bat

:: Build executables with IFW installer for Windows
deploy/build.bat --installer ifw

:: Build executables with IFW and WIX installer for Windows
deploy/build.bat --installer ifw --installer wix

:: Or just
deploy/build.bat --installer all