MotherofallVPNs/MoaV v2.2.3

on GitHub

AmneziaWG connectivity fixes for the current client apps, restart-proof Snowflake donation metrics, and a Grafana security update. Keys, users, and certificates are untouched.

Added

• Snowflake donation metrics that survive restarts. A new snowflake-exporter parses the proxy's persistent summary log into cumulative lifetime counters plus trailing-window gauges (1h / 24h / 7d / 14d) for bytes relayed and connections served. The proxy's own -metrics counters reset to zero on every restart, so the Snowflake Grafana dashboard used to read near-zero for proxies that had relayed tens of GB; it now shows real lifetime totals and recent windows, while per-country and live-throughput panels still come straight from the proxy. (#321)

Changed

• AmneziaWG header-protection obfuscation (AWG 1.5) is now opt-in, default off, via AMNEZIAWG_HEADER_PROTECTION. The default profile keeps the junk-packet and magic-header obfuscation that disguises WireGuard while staying compatible with both the AmneziaWG and AmneziaVPN apps. Turn it on (and re-issue bundles with moav regenerate-users) only when every client uses the AmneziaWG app. (#320)
• telemt updated to 3.5.2. (#318)

Fixed

• AmneziaWG / WireGuard bundle import. An inline comment on PORT_AMNEZIAWG / PORT_WIREGUARD in .env leaked into the generated client Endpoint (<ip>:51821 # AmneziaWG ...), so the AmneziaVPN app rejected the config with ErrorCode 900. The port is now sanitized to digits only. (#319)
• AmneziaWG "connects but no traffic" in the AmneziaVPN app. The AWG 1.5 header-protection params are silently dropped by the AmneziaVPN app's .conf importer, so its handshakes no longer matched a server that required them. With header protection now opt-in, the default profile works in both apps. (#320)

Security

• Grafana updated to 13.2.0, which includes upstream security fixes. (#318)

Upgrading

• AmneziaVPN-app users connect but get no traffic? Your server was generated with header protection on. Set AMNEZIAWG_HEADER_PROTECTION=false (the new default) and run moav regenerate-users to re-issue bundles, then have users re-download theirs. Users on the dedicated AmneziaWG app are unaffected either way. One AmneziaWG interface has a single obfuscation profile, so client and server must agree.

Full Changelog: v2.2.2...v2.2.3

Quick Install

curl -fsSL https://moav.sh/install.sh | bash

This will install MoaV to /opt/moav and guide you through setup.

Documentation

moav.sh/docs — full documentation

Get started

• Quick Start — install to first user in ~10 minutes
• Client Setup — connect from phones and desktops
• DNS Configuration — records, delegations, freeing port 53

Reference

• CLI Reference — every command and flag
• Setup Guide — every option, in depth
• Monitoring — Grafana dashboards and metrics
• Troubleshooting — symptom-first fixes

Understand it

• Supported Protocols — per-protocol ports, ciphers, stealth
• Architecture — container topology and bundle flow
• Threat Model — what is and is not protected
• OPSEC Guide — operator-side hardening

Help out

• Support MoaV — run a server, contribute, translate, donate
• Translating the Docs — one page is a complete contribution

Running it with an AI agent? llms.txt is a compact
orientation for coding agents; llms-full.txt is the
whole corpus. Both ship as release assets.

Community

Telegram · X · Issues · moav.sh