Key takeaways
Define a testable question
“Is AWG fast?” has no fixed setup. Ask how downstream, upstream, and latency change on one device when switching among baseline, WireGuard, and AWG 3.0. Run a separate scenario for loss and another for a network where one profile cannot handshake.
Do not merge availability with throughput. A protocol that fails to connect receives connection failed, not zero Mbps. Zero corrupts the average and hides the fault class.
Set criteria before testing: at least seven repetitions, median throughput, p95 latency, transfer duration, and an allowed background-load range.
Document the test bed
Record device, OS, CPU, access type, carrier, broad region, time, and client version. For AWG 3.0, list AmneziaVPN 4.8.12.9 or newer, server implementation, and a sanitised configuration hash. Record the WireGuard version.
Place servers on one host or in one data center with equal CPU and bandwidth limits. Check for competing jobs. Use an iperf3 endpoint inside the server network and one external service to capture the wider route.
Record MTU, transport, port, and profile class. Never publish PrivateKey, a management endpoint, or the full configuration.
Collect baseline and repeated runs
Start without VPN. Run seven equal-duration downstream and upstream cycles, a ping series, and a loss test. Enable WireGuard and repeat, then disconnect and allow the path to settle. Enable AWG 3.0 and follow the same sequence.
Reverse protocol order in another round so changing server load does not align with one candidate. Keep every attempt, including handshake failures. Do not select the best run.
Mobile radio cannot stay fixed. Record radio type and signal level, and label results as field observations. A wired control run helps separate protocol behavior from radio variance.
Measure more than Mbps
Throughput describes useful transfer rate. RTT p50 and p95 expose typical latency and spikes. Packet loss helps explain congestion behavior. Handshake duration affects first connection and recovery after a network change.
Capture client and server CPU, bytes transferred, and retransmits for inner TCP sessions. For UDP iperf3, publish the offered rate; an excessive target can manufacture loss. Test larger responses for MTU diagnosis.
AWG adds handshake service data and packet prefixes. Their share has no universal percentage because parameters and user-flow size differ.
Blank results table
Fill this table after the run and attach a CSV containing each attempt.
| Mode | Successful connections | Download median, Mbps | Upload median, Mbps | RTT p50/p95, ms | Loss, % | Handshake median, ms | Client/server CPU |
|---|---|---|---|---|---|---|---|
| No VPN | — | — | — | — | — | — | — |
| WireGuard | — | — | — | — | — | — | — |
| AmneziaWG 3.0 | — | — | — | — | — | — | — |
The dash means no measurement, not zero. Do not replace missing observations with an estimate. Add a failure reason and stage for unsuccessful connections.
Interpretation and publication
Compare medians and dispersion. A difference smaller than run-to-run variance does not establish a protocol effect. High CPU on a stable path points to an implementation or device limit. Loss that appears in one mode calls for MTU, route, and load checks.
Do not reuse old unsupported percentages or Mbps values without a primary dataset and implementation details. Official Amnezia material explains architecture and compatibility but does not publish one benchmark for every server.
Attach date, versions, setup, raw data, and limitations. Architecture sources include https://docs.amnezia.org/documentation/amnezia-wg/, https://github.com/amnezia-vpn/amneziawg-go, and https://www.wireguard.com/protocol/. Repeat after client or server updates.
Report an interquartile range or confidence interval for each series. An average without dispersion hides route instability. Separate a cold connection after idle time from a rekey during an active tunnel because they represent different user events.
Synchronise client and server clocks before collecting logs. A timeline can separate DNS, handshake, and first useful packet. Redact management addresses, private keys, and command lines that contain credentials.
To isolate masking overhead, use one implementation and alter only a documented parameter set under server control. A comparison across data centers, clients, or time windows cannot assign the difference to obfuscation.
End the report with geography, carrier, versions, sample size, and date. Those boundaries tell readers whether they can apply the result or need a new run.
Before you choose a configuration
Protocol availability and connection quality depend on the network, device, client version, and server route. Check the current plan terms before payment, use the official client source, and contact support with the operator, device, client, and exact error if the connection fails.
Sources and update policy
Technical statements are checked against the primary project documentation available on the update date. Network behavior can change; the article avoids promising universal availability.