WireGuard Easy 15.5 Adds AmneziaWG 3.1 Support and Security Fixes

1. WireGuard Easy 15.5 Release Overview

WireGuard Easy, often referred to as wg-easy, is an open-source application that simplifies the deployment and administration of WireGuard VPN servers through a browser-based interface. It helps administrators create peers, manage client configurations, and retrieve configuration files or QR codes without manually editing every WireGuard configuration.

Version 15.5.0 is a maintenance, security, and compatibility release rather than a complete redesign. Its headline changes are AmneziaWG 3.1 support, Node.js security updates, and a change to the API response that prevents private keys from being returned in client-detail data.

The release also contains dependency maintenance, translation updates, VoidAuth OpenID Connect documentation, and smaller fixes. The complete change history is available in the official v15.5.0 release notes.

2. AmneziaWG 3.1 Support

One of the most visible changes in WireGuard Easy 15.5 is its support for AmneziaWG 3.1. AmneziaWG is a modified WireGuard implementation that adds traffic-obfuscation mechanisms intended to make VPN traffic harder to identify through deep packet inspection (DPI).

Standard WireGuard is designed to be lightweight and efficient, but its traffic characteristics can be identifiable to some network inspection systems. AmneziaWG adds mechanisms such as modified packet headers, randomized handshake sizes, and traffic-shaping or obfuscation options. These changes are intended to make traffic analysis and protocol identification more difficult.

WireGuard Easy 15.5 updates the underlying AmneziaWG components, including amneziawg-go, to improve compatibility with version 3.1.

Enabling AmneziaWG

The project documentation describes the EXPERIMENTAL_AWG environment variable for enabling experimental AmneziaWG support. The following is an illustrative Docker Compose environment setting, not a complete replacement for your existing deployment file:

services:
  wg-easy:
    image: ghcr.io/wg-easy/wg-easy:15
    environment:
      - EXPERIMENTAL_AWG=true

Before applying this setting, confirm the current v15 documentation, install and verify the required host kernel module, and review the container’s required capabilities and device access. Configuration details can change between releases.

Check client compatibility

Both sides of a VPN tunnel must support the protocol features configured for that connection. If you enable AmneziaWG 3.1-specific parameters, make sure the client application supports them. Older clients may not understand newer parameters and may fail to establish a tunnel.

Use an AmneziaWG-compatible client and test with a non-critical peer before migrating all users. The WireGuard Easy AmneziaWG documentation explains activation requirements, parameter compatibility, and client options.

3. Security Improvements in WireGuard Easy 15.5

For administrators, the security changes may be more important than the new protocol support. A VPN management interface controls access to private networks, so weaknesses in the application, API, or deployment configuration can have consequences beyond the web dashboard itself.

Node.js runtime updated

The developers updated Node.js to address known vulnerabilities in the runtime used by the application. Keeping the application runtime and its dependencies current is an important part of maintaining a self-hosted service.

Updating the container image is not a substitute for securing the host, restricting dashboard access, and monitoring the service. Administrators should continue to apply host operating-system and container-runtime security updates as well.

Private keys removed from client-detail API responses

Another important change is that the client-details API no longer includes private keys in its responses. Private keys are sensitive credentials: exposing them through an API response can increase the consequences of a compromised account, overly broad API access, accidental logging, or an insecure integration.

Removing private keys from this response reduces unnecessary exposure. It does not mean that every API endpoint, integration, or client credential is automatically secure. Administrators should review scripts and integrations that consume the client-details API and confirm that they do not depend on the old response structure.

4. New Administration Features

Configurable WireGuard interface name

WireGuard Easy 15.5 allows administrators to customize the WireGuard network interface name instead of relying on a predefined name. This can help deployments that follow interface naming standards or operate multiple network interfaces and VPN instances.

When changing interface names, check firewall rules, routing configuration, monitoring, and host scripts that reference the old interface. A naming change can affect operational tooling even if the VPN peers themselves are configured correctly.

Trusted proxy configuration

The release adds trusted proxy configuration for deployments running WireGuard Easy behind a reverse proxy. This is relevant when Nginx, Traefik, Caddy, or another proxy sits in front of the application.

Proxy trust must be configured carefully. Trust only the proxy addresses that you control, and do not blindly trust forwarded client headers from arbitrary sources. Incorrect trust settings can cause the application to interpret spoofed forwarding information as genuine client information.

Rate-limiting documentation

The project documentation now includes guidance on configuring rate limiting. Rate limiting can help reduce repeated login attempts and abusive request patterns, especially when a management interface is reachable from untrusted networks.

Rate limiting should be implemented with a clear understanding of the proxy and application topology. Choose limits that reduce abuse without locking out legitimate administrators or breaking expected API traffic.

5. Prometheus and IPv6 Improvements

Peer endpoint information in Prometheus metrics

WireGuard Easy 15.5 extends Prometheus metrics with peer endpoint information. This gives administrators additional context when monitoring VPN connections and investigating connectivity patterns.

Endpoint metadata can be operationally useful, but monitoring systems should be treated as sensitive infrastructure. Restrict access to Prometheus and its dashboards, apply appropriate retention policies, and consider whether endpoint information is sensitive in your environment.

IPv6 endpoint formatting fix

The release also fixes how IPv6 addresses used as client endpoints are represented in generated configurations. IPv6 addresses are enclosed in brackets where required, preventing malformed endpoint entries.

Translations and documentation

The project added Swedish and Azerbaijani translations, improved several existing translations, and added documentation for integrating VoidAuth through OpenID Connect. Dependency updates and smaller maintenance changes are also included.

6. How to Upgrade WireGuard Easy Safely

WireGuard Easy version 15 uses the container-based deployment approach. The following workflow is intended for administrators already running the application with Docker Compose. Your Compose file, volume names, container name, and backup path may differ, so adapt the commands to your deployment rather than copying them unchanged.

Step 1: Inspect the current container

docker inspect wg-easy --format '{{.Config.Image}}'
docker logs --tail=100 wg-easy

If your container has a different name, replace wg-easy with the actual name used by your deployment.

Step 2: Back up persistent data

Back up the host directory or named volume that stores your WireGuard Easy configuration. The example below uses a placeholder path. Replace it with the actual host path from your Compose file:

sudo tar czf wg-easy-backup-$(date +%F).tar.gz \
  /path/to/your/wg-easy-data

Protect the backup because it may contain VPN configuration and other sensitive material. Store it somewhere with restricted permissions and verify that it can be read.

Step 3: Review your Compose configuration

Check the image tag, persistent volumes, environment variables, network settings, capabilities, and reverse-proxy configuration. If you use AmneziaWG, verify the host kernel module and the documented v15 activation requirements. Do not introduce new environment variables or remove existing settings without checking their purpose.

Step 4: Pull and recreate the container

From the directory containing your Docker Compose file, run:

docker compose pull
docker compose up -d

Use the image tag recommended by the project documentation for your deployment. Avoid changing unrelated configuration during the same maintenance window; separating changes makes troubleshooting easier.

Step 5: Verify the service

docker compose ps
docker logs --tail=100 wg-easy

Sign in to the dashboard, confirm that existing peers are present, and test a client connection. If you use a reverse proxy, verify access through the proxy as well as the expected client IP handling.

7. Post-Upgrade Security Checklist

A VPN management panel is a high-value service because it controls remote access to private networks. Use the release as an opportunity to review the complete deployment rather than focusing only on the container version.

8. Should You Upgrade to WireGuard Easy 15.5?

For administrators already running WireGuard Easy v15, the security fixes make this release worth reviewing promptly. The removal of private keys from client-detail API responses is especially relevant for deployments that use API integrations, scripts, or centralized monitoring.

Upgrade planning is especially relevant if you:

• Run WireGuard Easy on a publicly reachable server.
• Use a reverse proxy and need trusted proxy configuration.
• Want to evaluate AmneziaWG 3.1 compatibility.
• Use Prometheus and want peer endpoint information in metrics.
• Need configurable interface naming for your network design.

Test carefully before production if you:

• Maintain scripts that parse the client-details API response.
• Use custom container settings or a non-standard deployment.
• Plan to enable AmneziaWG with clients that may not support version 3.1.
• Depend on reverse-proxy headers or firewall rules tied to interface names.
• Do not have a recent, verified backup and recovery procedure.

Upgrade decisions should account for the exposure of your management interface, the role of the VPN in your network, and the compatibility of your clients and integrations. A tested backup and a short maintenance window are preferable to an unplanned service interruption.