wgctrl

awgctrl-go

A Go library for controlling WireGuard and AmneziaWG devices on Linux.

Fork of WireGuard/wgctrl-go extended with complete AmneziaWG v2 support — reading and writing all AWG obfuscation parameters via netlink, parameter validation, auto-generation, and userspace daemon support.

What's new compared to wgctrl-go

Platform support

Requirements

• Go 1.26 or later
• Linux kernel with AmneziaWG module (modprobe amneziawg), or amneziawg-go userspace daemon
• Root privileges or CAP_NET_ADMIN capability

This library works with any AmneziaWG v2 kernel module, including the upstream module. For production use we recommend the patched fork which validates AWG parameters before applying them (upstream can crash on a rejected configuration), serves plain WireGuard, AWG 1.0 and AWG 2.0 clients on one interface, fixes netlink dumps with many peers and builds on Linux up to 7.2 and RHEL 10. Only this module reports the detected peer type (Peer.AWGPeerFlagsKnown, FixedHeaders, NoS4).

AWG kernel and userspace support is Linux-only. Other platforms (FreeBSD, OpenBSD, Windows) support standard WireGuard only.

Installation

go get github.com/advanced-wg/awgctrl-go

Quick start

Read a device

client, err := wgctrl.New()
if err != nil {
    log.Fatal(err)
}
defer client.Close()

device, err := client.Device(context.Background(), "awg0")
if err != nil {
    log.Fatal(err)
}

fmt.Printf("Interface: %s  IsAmnezia: %v\n", device.Name, device.IsAmnezia)
for _, peer := range device.Peers {
    fmt.Printf("Peer: %s  AWG: %v  RX: %d  TX: %d\n",
        peer.PublicKey, peer.AdvancedSecurity,
        peer.ReceiveBytes, peer.TransmitBytes)
}

Enable AWG obfuscation

The simplest approach — all parameters are generated automatically:

cfg := &wgtypes.Config{}
cfg.GenerateAmneziaParams()

if err := cfg.Validate(); err != nil {
    log.Fatal(err)
}

client.ConfigureDevice(context.Background(), "awg0", *cfg)

Add a peer with AWG

pubKey, _ := wgtypes.ParseKey("base64encodedpublickey=")
_, allowedIP, _ := net.ParseCIDR("10.0.0.2/32")

cfg := wgtypes.Config{
    Peers: []wgtypes.PeerConfig{
        {
            PublicKey:        pubKey,
            AllowedIPs:       []net.IPNet{*allowedIP},
            AdvancedSecurity: true,
        },
    },
}

client.ConfigureDevice(context.Background(), "awg0", cfg)

Documentation

• AWG Parameter Reference — Jc, Jmin, Jmax, S1–S4, H1–H4, I1–I5 with limits, rules and examples
• Peer Advanced Security — how the kernel determines per-peer AWG status
• Examples — practical usage examples
• pkg.go.dev — full API reference

License

MIT — Copyright (C) 2018-2022 Matt Layher, 2025 Advanced-WG, V. Bantserov. See LICENSE.md.