I found a self-hosted VPN that works in countries where W…

Obfuscation is the name of the game

WireGuard is so easy that even the less technical members of your family can use it, but what if you live in a country where VPN traffic is blocked? Where everyday websites are erased from DNS records, and social media is held in an iron grip. That's the situation in Russia today, and in other authoritarian countries around the world, and it makes using a VPN risky. If those VPNs work at all, because the same DNS blocking that makes Facebook, Twitter, and more unreachable, also blocks the known commercial VPN endpoints.

Self-hosting a VPN server is one option, but you still have the risk of discovery because VPN traffic has known signatures, and you can bet the governments are scanning for them. But the VPN companies are fighting back. Tools like AmneziaVPN enable easy self-hosting on servers the user controls. With protocols that obfuscate the traffic, and return "safe" sites like google.com when pinged, including valid TLS certificates.

It's really cool, and serves a vital role in keeping people safe online while accessing vital information. It's also worth noting that AmneziaVPN has been security audited as recently as January 2025. While the auditors found a few risks categorized as critical and high, the platform has resolved all identified issues. The results of that audit are publicly available, as are the full source code for the Amnezia client, AmneziaWG-Go protocol, the Android, iOS, and Windows clients, and the server code.

Building this out in the open like this makes everyone safer, and you can do your own audit if you have the necessary coding skills. Amnezia runs its servers as RAM-only, so all data is wiped on reboot. They also say they don't store or collect activity history, IP addresses, session data, and other metrics, which is good. The last thing you want is for your internet history to show things the government doesn't want you to see.

But even with that, it's still beneficial to self-host on hardware you have more control over, or on a VPS in another country entirely. And Amnezia makes that so, so easy to self-host. The site practically pushes you towards this end, which is refreshing since every other VPN tries to steer you towards the premium options. I downloaded the app to check it out, and ran into one of the most interesting server setups I've ever used.

While most remote access and VPN tools have you download a package to your server and install it, the app does all that for you. You do have to put in the public IP address of your server, and the admin credentials, then the app SSH'es in, installs everything, and you're running within minutes. It's a refreshing change from how difficult VPN servers can be to set up, and very close to the speed of getting Tailscale or its ilk installed.

Except, of course, those services will be blocked in the regions you'd want to use Amnezia in. While there are a ton of protocols to choose from, only two are actually trying to avoid detection. That's OpenVPN over Cloack, which pretends to be web traffic and does a good job resisting deep packet inspection as a result, and AmneziaWG, a fork of WireGuard-Go that's been tweaked to remove the identifiable network behaviors that get WireGuard blocked by oppressive regimes.

So, one of the ways ISPs and governments know you're using a VPN is through deep packet inspection during the TLS handshake, before any data is encrypted. Most VPNs fail this test, as they're not set up to fool the checks, but not Amnezia. That's thanks to XRay, which listens on port 443 for authorized connection requests. If it gets an authorized one it connects as normal, but if it gets scanned by anyone else, it redirects that packet to a legit website, like google.com or any other easily available site in your region that you chose.

The beauty of this is that it also returns an authentic TLS certificate because it's issued by the site the packet was redirected to, making the censorship software think your VPN server is Google instead. If you're in a region with heavy censorship, AmneziaVPN can help you get the free exchange of information that the rest of the world has with their internet providers. It's pretty neat even if you're not in those regions, and is a viable self-hosted WireGuard alternative for everyone else.

Summary

This report covers the latest developments in android. The information presented highlights key changes and updates that are relevant to those following this topic.

---