Skip to main content

WG Tunnel

An advanced, open-source client for WireGuard and AmneziaWG.

What Makes WG Tunnel Different

Immediate protection

Most WireGuard clients resolve peer endpoints before bringing the tunnel up. You leak while it resolves, and if resolution never succeeds, the tunnel never comes up at all. WG Tunnel locks down traffic first, then resolves in the background, retrying until it succeeds. You can even toggle a tunnel on with no network connection at all, and it comes up immediately, connecting the moment you're online.

Learn how this works →
Most WireGuard clients

Resolve endpoints first, leaking while they wait → never comes up if resolution fails.

WG Tunnel

Locks down traffic first, no leaks → resolves endpoints in the background, retrying indefinitely.

Features

Auto-Tunneling

Tunnels automatically turn on, off, or switch based on your network conditions, fully customizable per network.

Kill Switch

A system-wide, tunnel-independent kill switch that blocks all traffic outside the tunnel, on both Android and desktop.

AmneziaWG Support

First class support for AmneziaWG 2.0 through 3.1 alongside standard WireGuard, for robust protection on restrictive networks.

Fully Native, Everywhere

Android and desktop are both genuinely native apps with native performance. Desktop compiles to native executables, running the tunnel as a background service.

Split & Encrypted DNS

Resolve DNS through the tunnel via plain DNS, DoT, or DoH, and optionally split resolution by domain suffix.

Local Proxy Mode

Expose any tunnel over a local SOCKS5 or HTTP proxy for individual apps or other devices to use.

Dynamic DNS Recovery

When a tunnel fails, checks whether your server's dynamic DNS hostname now resolves to a new IP and updates the peer endpoint automatically, without dropping the tunnel or requiring a restart.

IPv6 Restore

Prefers IPv6 endpoints when available, falling back to IPv4 automatically if the network doesn't support it, and proactively upgrading back to IPv6 once it does, all without dropping the tunnel.

Seamless Recovery

Recovers from handshake failures or network changes by bouncing the connection alone, never tearing down the tunnel interface or kill switch, so you stay protected the whole time.