WireGuard Easy, the open-source web interface that has made self-hosted VPN deployment accessible to administrators without deep networking expertise, has released version 15.5. The update combines a meaningful protocol upgrade with a set of security and configuration refinements that, taken together, respond to two persistent pressures facing VPN operators: censorship resistance and server-side hardening.
Obfuscation Gets an Upgrade
The headline addition is support for AmneziaWG 3.1, a variant of the WireGuard protocol engineered specifically to resist deep packet inspection, the technique network operators and censorship regimes use to identify and block VPN traffic by examining its structural patterns rather than its encrypted contents. Standard WireGuard, despite its cryptographic strength, produces recognizable packet signatures that can be detected and throttled or blocked even without decrypting the traffic. AmneziaWG addresses this by introducing randomized packet characteristics that disguise VPN traffic as ordinary network noise, a tactic that has become increasingly relevant as governments and institutions refine their filtering infrastructure. By updating the underlying amneziawg-go components, WireGuard Easy 15.5 ensures compatibility with this newer protocol revision, giving self-hosted VPN operators a path toward similar resistance without migrating to a different platform entirely.
Closing Security Gaps
Security updates in this release are narrow but consequential. Node.js, the runtime underpinning the application, has been updated to patch known vulnerabilities, a routine but essential maintenance step for any internet-facing service. More notably, the developers altered the client details API so it no longer returns private keys in its responses. Private keys are the cryptographic foundation of a WireGuard tunnel's security; their exposure through an API endpoint, even an authenticated one, represents unnecessary risk. Removing them from API output reduces the attack surface without affecting the tool's core functionality, reflecting a broader principle in secure software design: sensitive material should never travel further than operationally necessary.
Flexibility for Real-World Deployments
Administrators managing more complex network topologies gain a practical improvement: the WireGuard interface name is now configurable rather than fixed. This matters for deployments running multiple network interfaces, custom naming schemes, or integration with existing infrastructure where a hardcoded interface name could cause conflicts. Alongside this, the release adds support for trusted proxy configuration, a feature relevant to anyone running WireGuard Easy behind a reverse proxy - an increasingly common setup for services exposed through load balancers or centralized ingress controllers. The accompanying documentation now also covers rate limiting, guidance aimed squarely at operators who expose their installation to the public internet and need protection against abuse or brute-force attempts.
Better Visibility, Fewer Edge-Case Bugs
Monitoring also improves in this release. Prometheus metrics now expose peer endpoint information, giving administrators finer-grained visibility into who is connecting and from where - useful for both performance tuning and anomaly detection. A smaller but meaningful fix ensures IPv6 addresses used as client endpoints are properly enclosed in brackets, preventing malformed configuration entries that could otherwise break connectivity for IPv6 clients, an increasingly common scenario as IPv6 adoption continues to spread.
The release rounds out with Swedish and Azerbaijani translations, refinements to existing language support, documentation for integrating VoidAuth via OpenID Connect, and a batch of dependency updates. None of these are transformative individually, but collectively they signal a project maintaining discipline around both security hygiene and usability - two priorities that self-hosted privacy tools can rarely afford to neglect.