DEV Community

Ivan Bondarev
Ivan Bondarev

Posted on

amneziawg-installer v5.34.0: full tunnel by default, and a signing key you can check outside GitHub

#vpn #selfhosted #security #linux

Two things in this post. The first is the public key that signs my installer releases, published here on purpose, away from the GitHub repository. The second is v5.34.0, which changes what a fresh install hands to clients by default.

Why the signing key is on dev.to

Since v5.29.0 every release of amneziawg-installer ships detached minisign signatures for the six scripts, plus KEYS.txt with the public key. The private key stays offline on my machine and never reaches GitHub Actions; the release workflow only verifies, and it refuses to publish a release whose signatures do not check out.

That protects the download on its way to you. It does not protect you from a compromise of the GitHub account itself: whoever can replace the script can replace KEYS.txt next to it, and a check against a key taken from the same place will pass. A signature starts to mean something when the key comes from somewhere else, or when you saved it earlier.

So here it is, outside the repository. A copy here only helps if whoever takes over the GitHub account cannot also edit this post, so save the key somewhere of your own:

untrusted comment: minisign public key 3E598A1C01907E17
RWQXfpABHIpZPttqrwYrQNHRTk/iLIz4cVh9KkRwAElHP+CoW/NPEysN
Enter fullscreen mode Exit fullscreen mode

Key ID 3E598A1C01907E17. The same ID is printed in SECURITY.md and in the README, and the full key is KEYS.txt in the repository. If any of them ever disagrees with this post, do not run the script.

Verifying a release with the key from this post 

sudo apt install minisign

TAG=v5.34.0
BASE="https://github.com/bivlked/amneziawg-installer/releases/download/$TAG"
curl -LO "$BASE/install_amneziawg_en.sh"
curl -LO "$BASE/install_amneziawg_en.sh.minisig"

minisign -Vm install_amneziawg_en.sh \
  -P RWQXfpABHIpZPttqrwYrQNHRTk/iLIz4cVh9KkRwAElHP+CoW/NPEysN
Enter fullscreen mode Exit fullscreen mode

Note the -P: the key is passed on the command line, so KEYS.txt from the repository is not involved at all.

Expected output:

Signature and comment signature verified
Trusted comment: amneziawg-installer v5.34.0 install_amneziawg_en.sh
Enter fullscreen mode Exit fullscreen mode

Read the second line, not only the first. The trusted comment is signed along with the file, so it cannot be edited, but minisign does not compare it with what you expected: an older script with its own older signature verifies just as well and simply prints an older tag. Accept the download only if that line says exactly amneziawg-installer v5.34.0 install_amneziawg_en.sh; otherwise stop.

A changed byte gives Signature verification failed and a non-zero exit code. Releases before v5.29.0 have no signatures, so there is nothing to check there.

v5.34.0: the default is now the full tunnel

A fresh install used to give clients a list of 34 IPv4 subnets ("Amnezia List + DNS"): all public IPv4, minus private and a few reserved ranges. Starting with v5.34.0 the default is AllowedIPs = 0.0.0.0/0, ::/0.

Why the change:

  • The Amnezia app shows its own split-tunneling page only when it sees 0.0.0.0/0 among the client routes. Given a subnet list, it decides that the server already splits traffic, says the server does not support split tunneling, and hides the toggle.
  • On Linux, awg-quick turns on its fwmark handling only for a /0 route. A list-shaped IPv4 config has none, and on my test bench that ended in a routing loop: packets to the server itself went back into the tunnel.
  • The Amnezia app's own server template emits the same 0.0.0.0/0, ::/0 pair, which is the form its split-tunneling page recognises.

The cost, plainly: the default profile no longer keeps private networks out of the tunnel, so whether your LAN stays reachable while the VPN is on depends on the client, not on the config. If you need home devices over IPv4, install with --route-amnezia to keep the previous mode. That mode does not bring back LAN access over IPv6: it also sends ::/0 into the tunnel.

A running server keeps its mode. The new default applies to new installs only; a reinstall takes the mode saved in the server settings, and existing client profiles do not change by themselves. To move a running server to another mode, rerun the installer with --force and the mode you want (without --force it refuses to touch a configured server), then reissue the profiles:

sudo bash ./install_amneziawg_en.sh --force --route-all      # or --route-amnezia
sudo bash /root/awg/manage_amneziawg.sh regen --reset-routes
Enter fullscreen mode Exit fullscreen mode

--reset-routes replaces every client's own route list with the server-wide mode, including lists you edited by hand. The regenerated profiles have to be imported on the devices again.

The release also tidies up the routing menu and its edge cases: every mode now names both its benefit and its price, an unrecognised answer no longer falls back to the default silently, and a reinstall no longer changes the mode of a working server.

Full notes: v5.34.0 on GitHub.

Install

The installer is meant for a clean Ubuntu or Debian VPS (Ubuntu 24.04 or Debian 13 for a new server, Ubuntu 26.04 works too). If you verified the script above, run that same file instead of downloading it again:

sudo bash ./install_amneziawg_en.sh
Enter fullscreen mode Exit fullscreen mode

Without verification, the quick path from the README is:

wget -O install_amneziawg_en.sh https://github.com/bivlked/amneziawg-installer/releases/latest/download/install_amneziawg_en.sh
chmod +x install_amneziawg_en.sh
sudo bash ./install_amneziawg_en.sh
Enter fullscreen mode Exit fullscreen mode

About 20 minutes and two reboots; after each reboot, run the same command again and it picks up where it stopped.

Links:

Questions or problems? Open an issue on GitHub or leave a comment here.

Top comments (0)