How to enable client-to-client with AmneziaWG2.0 protocol on my own VPS? (Ru/Eng)

[1MPERATOR-1]

I have a VPS server with AmneziaVPN and AWG2.0 protocol on it. My idea is to open internal ports for users in this VPS connection, like in a local network. Attention: I'm using AmneziaVPN for just more then two days and still trying to sort out in it

Because I havent seen any guides or discussion about this, I want to ask people that uses AmneziaVPN on their VPS with AWG2.0.

Before you answer, I cannot use any other protocols such as OpenVPN, OpenVPN+something else, etc.
Russian answers are welcome

[bivlked]

Hey @1MPERATOR-1,

Client-to-client over AmneziaWG works the same way as plain WireGuard — once a few server-side bits are in place, peers can reach each other directly without any extra protocol on top.

What the server needs

1. IP forwarding enabled in the kernel:

   sudo sysctl net.ipv4.ip_forward
   # should print: net.ipv4.ip_forward = 1
   

   If it prints 0, set it: echo "net.ipv4.ip_forward=1" | sudo tee /etc/sysctl.d/99-awg-forward.conf && sudo sysctl --system

2. FORWARD chain accepts traffic between peers on the AWG interface. Easiest check:

   sudo iptables -L FORWARD -v | grep -i wg
   

   You want either an explicit ACCEPT rule for wg0 (or whatever the AWG interface is named), or a default policy of ACCEPT. If a PostUp line in your awg0.conf already does iptables -I FORWARD -i %i -j ACCEPT, this is covered.

3. Server-side peer block (/etc/amnezia/amneziawg/awg0.conf or wherever AmneziaVPN keeps its server config) lists each client with their tunnel IP, e.g.:

   [Peer]
   PublicKey = ...
   AllowedIPs = 10.9.9.2/32
   

   /32 is correct here — it tells the kernel "route this client's tunnel IP to this peer". Don't change it to /24.

What the clients need

4. In each client .conf, the [Peer] block (the server peer) should include the whole tunnel subnet in AllowedIPs:

   [Peer]
   PublicKey = <server_pubkey>
   AllowedIPs = 10.9.9.0/24
   Endpoint = <server_ip>:<port>
   

   0.0.0.0/0 works too (it's a superset), but 10.9.9.0/24 is enough if you only want intra-VPN traffic, not full-tunnel.

After that, peers can ping each other and reach exposed ports directly: 10.9.9.3 from 10.9.9.2 etc.

Heads-up if AmneziaVPN deployed your server via Docker

If the server was set up through the Amnezia desktop app (which spins up a Docker container with amneziawg-go userspace), the iptables rules live inside that container's namespace, not on the host. You may need docker exec into the container to inspect/adjust FORWARD rules, and on the host sysctl net.ipv4.ip_forward=1 is still required.

---

RU краткая сводка

Client-to-client в AmneziaWG = стандартный WireGuard:

1. На сервере: net.ipv4.ip_forward=1 + iptables -I FORWARD -i wg0 -j ACCEPT (часто уже в PostUp)
2. В серверном конфиге у каждого клиента: AllowedIPs = 10.9.9.X/32 — оставить как есть, не менять на /24
3. В клиентском .conf: в [Peer] (сервер) поставить AllowedIPs = 10.9.9.0/24 (или 0.0.0.0/0, оно тоже включает подсеть)
4. После этого клиенты пингуют друг друга по 10.9.9.X и видят открытые порты

Если сервер ставился через приложение AmneziaVPN (Docker с userspace amneziawg-go), правила iptables — внутри контейнера, заходить через docker exec.

---

One side note — for headless server setups (no desktop app, just CLI on a clean VPS), I maintain amneziawg-installer which sets all of the above out of the box (forwarding, FORWARD ACCEPT, peer blocks via manage add). Disclosure: I'm the author. Mentioning only in case you ever rebuild the server from scratch — for the existing setup the steps above are what you need.

[morjik777]

А где AmnesiaWG хранит .conf клиентские? На Linux и Windows.