Installation

Download and build port as:

# git clone https://github.com/vgrebenschikov/amneziawg-tools
# cd amneziawg-tools
# make install

It will install:

$ pkg list amneziawg-tools
/usr/local/bin/awg
/usr/local/bin/awg-quick
/usr/local/etc/rc.d/wireguard-amnezia
/usr/local/share/bash-completion/completions/awg
/usr/local/share/bash-completion/completions/awg-quick
/usr/local/share/licenses/amneziawg-tools-1.0.20241018_2/GPLv2
/usr/local/share/licenses/amneziawg-tools-1.0.20241018_2/LICENSE
/usr/local/share/licenses/amneziawg-tools-1.0.20241018_2/catalog.mk
/usr/local/share/man/man8/awg-quick.8.gz
/usr/local/share/man/man8/awg.8.gz

Using Kernel AmneziaWG module

Install net/wireguard-amnezia-kmod

Unload original if_wg as and load updated from /boot/modules/if_wg.ko

# kldunload if_wg
# kldload /boot/modules/if_wg.ko

To make it automatically load from /boot/modules - add to /boot/loader.conf:

if_wg_name="/boot/modules/if_wg.ko"
if_wg_load="YES"

Configuration

Generally - same way as you will configure normal net/wireguard-tools:

# cd /usr/local/etc/wireguard
# cat > wg0.conf
[Interface]
PrivateKey = ...our.private.key.here...
ListenPort = 12345
Address = 192.168.1.1/24
Description = Test Wireguard

Jc = 7
Jmin = 150
Jmax = 1000
S1 = 117
S2 = 321
H1 = 2008066467
H2 = 2351746464
H3 = 3053333659
H4 = 1789444460

[Peer]
PublicKey = ...peer.public.key.here...
AllowedIPs = 192.168.1.2/32
^D

Then start:

# awg-quick up wg0
[#] ifconfig wg create name wg0 description Test Wireguard
[#] awg setconf wg0 /dev/stdin
[#] ifconfig wg0 inet 192.168.1.1/24 alias
[#] ifconfig wg0 mtu 1420
[#] ifconfig wg0 up
[#] route -q -n add -inet 192.168.11.0/24 -interface wg0
[+] Backgrounding route monitor

# awg show
interface: wg0
  public key: CI...
  private key: (hidden)
  listening port: 12345
  jc: 7
  jmin: 150
  jmax: 1000
  s1: 117
  s2: 321
  h1: 2008066467
  h2: 2351746464
  h3: 3053333659
  h4: 1789444460

peer: kue...
  allowed ips: 192.168.1.2/32

To setup autostart (wireguard-amnezia rc.d script will load module):

# sysrc wireguard_amnezia_enable=YES wireguard_amnezia_interfaces="wg0"

Amnezia Wireguard config options

Jc

Number of junk packets before handshake.

1–128 (recomended 3–10)

Jmin

Minimum size of junk packets.

Jmin: < Jmax (recomended ~ 50)

Jmax

Maximum size of junk packets.

Jmax: ≤ 1280 (recomended ~ 1000)

S1

Size of handshake initiation packet prepend junk. Should be the same on both ends.

0–1280 (recomended 15–150), S1 != S2

S2

Size of handshake response packet prepend junk. Should be the same on both ends.

0–1280 (recomended 15–150), S1 != S2

H1-H4

Custom identifiers for initiation/response/cookie/data packets. Should be the same on both ends.

The unique value in range of 5 - 4,294,967,295 (0x5 - 0xFFFFFFFF), H1 != H2 != H3 != H4

Additional config options

Description

[Interface]
...
Description = Some Text

Will setup interface description visible in ifconfig and SNMP.

UserLand

Enforce to use amnezia-go instead of kernel driver, you can use port net/amnezia-wireguard-go to install it.

[Interface]
...
UserLand = true
...

Routes

List of routes for the peer to be installed into FIB - that option provides a way to have AllowedIPs list wider then routes installed. Empty list is allowed.

That is useful if routing protocol will work over the link. But remember that internal wireguard routing will happen according to AllowedIPs anyway.

...

[Peer]
PublicKey = ...peer.public.key.here...
AllowedIPs = 0.0.0.0/0
Routes = 192.168.1.2/32