VPN for Linux: AmneziaWG in 4 steps, systemd autostart, and plain WireGuard

A VPN for Linux from NvoVPN is not a separate app but the standard AmneziaWG tools: a configuration file from your account and a few commands in the terminal. It takes about five minutes. This guide covers Ubuntu, Debian, Fedora, Arch and any distribution with systemd; at the end are autostart at boot, a plain WireGuard variant for networks where VPNs are not throttled, and a rundown of common errors. If you are in Russia, there is a separate block below.

1. 1

   Download a configuration file from your account

   Open your account → "Connection" → the "Manual" tab. Choose a server (the recommended one is marked), name the device — "Linux laptop", say — and click "Create". Download the .conf file: it already has the keys, the server address, and the AmneziaWG obfuscation parameters.

2. 2

   Install AmneziaWG

   AmneziaWG is WireGuard with traffic obfuscation. The package is called amneziawg-tools and installs on top of the regular wireguard-tools. Open a terminal and, on Ubuntu or Debian, run:

   sudo apt update && sudo apt install -y wireguard-tools
   # then amneziawg-tools as described by the project:
   # https://github.com/amnezia-vpn/amneziawg-tools

   For other distributions, see the install section in the amneziawg-tools repository on GitHub — it has options for Fedora, Arch and building from source. Afterwards, the command awg --version should work.

3. 3

   Bring the tunnel up

   Put the downloaded file into the AmneziaWG folder and bring the tunnel up with awg-quick:

   sudo mkdir -p /etc/amnezia/amneziawg
   sudo cp ~/Downloads/nvovpn.conf /etc/amnezia/amneziawg/awg0.conf
   sudo chmod 600 /etc/amnezia/amneziawg/awg0.conf
   sudo awg-quick up awg0

   The file name sets the interface name: awg0.conf → awg0. To disconnect the tunnel: sudo awg-quick down awg0.

4. 4

   Check that the VPN is working

   Open the "What is my IP" page: it should show the NvoVPN server's address, not your provider's. In the terminal, curl ifconfig.me shows the same thing, and sudo awg show shows the handshake and traffic counters.

What you need

• Administrator rights (sudo) on your machine — the commands below run under it.
• An NvoVPN account with an active plan or trial — a configuration is only created while access is active. No account? Sign up: you only need an email address.
• A configuration file from your account — you got it in step 1.

Autostart at boot

sudo systemctl enable --now awg-quick@awg0

Now the tunnel comes up with the system. Status: systemctl status awg-quick@awg0; stop it with sudo systemctl stop awg-quick@awg0.

Plain WireGuard instead of AmneziaWG

If your network does not block VPNs, the standard wireguard-tools is enough: next to the AmneziaWG configuration in your account there is a plain WireGuard variant of the same device. Put it in /etc/wireguard/wg0.conf and bring it up with wg-quick up wg0. But keep in mind: unobfuscated WireGuard is recognized by its first handshake packets, and where it is throttled, the connection simply never completes — then go back to AmneziaWG. For the difference between them, see "AmneziaWG vs WireGuard: what is the difference".

If it does not work

• "Handshake did not complete". The first packet went out, no reply came back. Check that your machine's clock is correct, that the file was copied in full, and that the interface is up only once (awg show). If the network throttles UDP, try another server from your account.
• The tunnel is up, but sites will not open. Usually DNS: the DNS = line in the config needs the resolvconf or systemd-resolved package. Install openresolv, or temporarily add a DNS server to /etc/resolv.conf.
• You need stealth mode. For networks that throttle AmneziaWG too, there is VLESS/Reality: take the subscription link from your account → "Stealth mode" and import it into Hiddify for Linux. How stealth mode works is in "Why VPNs stop working and how stealth mode works".
• Anything else is in "What to do if the VPN will not connect".

FAQ

Why is there no Linux app? A separate app is not needed here: AmneziaWG on Linux is a standard package, and connecting is the same few commands as above. The configuration file from your account does the rest.

Does this work on a Raspberry Pi or a server? Yes, the setup is the same — AmneziaWG has ARM builds. On a server, do not forget the routing rules if it needs to stay reachable from outside on its own address.

Can a Linux machine share the VPN with the whole home network? Yes, with NAT and IP forwarding, but it is simpler to put the configuration straight onto a router that supports AmneziaWG — see "How to set up a VPN on a router", or message support and we will help with your model.

How many devices can I connect? Up to five at once on one subscription — a separate configuration from your account for each device.

How do I turn off the VPN? With the command sudo awg-quick down awg0. If you turned on autostart, use sudo systemctl stop awg-quick@awg0.

Related guides: How to set up a VPN on a router · AmneziaWG vs WireGuard: what is the difference · What to do if the VPN will not connect