The open-source project WireGuard Easy, which provides a web interface for deploying and managing WireGuard VPN servers, has released version 15.5. The update focuses on closing a credential-exposure gap, broadening protocol compatibility, and giving administrators finer control over network and proxy configuration.
Tighter security and private key protection
The development team updated the embedded Node.js runtime to patch known vulnerabilities, a routine but important maintenance step for any self-hosted service exposed to the internet. More notably, the client details API no longer returns private keys in its responses. Previously, applications or scripts querying client information could inadvertently receive sensitive cryptographic material; removing that data from the API reduces the risk of leaking VPN credentials through logs, misconfigured integrations, or compromised third-party tools.
AmneziaWG 3.1 support for obfuscated traffic
Version 15.5 adds compatibility with AmneziaWG 3.1, a fork of the WireGuard protocol built specifically to resist detection by deep packet inspection systems. Unlike standard WireGuard, whose packet structure can be fingerprinted and blocked by restrictive networks, AmneziaWG obfuscates traffic patterns to make VPN usage harder to identify. WireGuard Easy updated its underlying components, including amneziawg-go, so administrators running the newer protocol version can integrate it with the tool's existing management interface.
Custom network interfaces and proxy handling
Administrators can now assign a custom name to the WireGuard network interface instead of using a fixed default. This matters for deployments running multiple VPN instances or network interfaces on the same host, where naming collisions or organizational conventions previously required manual workarounds outside the tool itself.
The release also adds support for trusted proxy configuration, relevant for installations placed behind a reverse proxy for load balancing or TLS termination. Accompanying documentation now explains how to configure rate limiting, a safeguard recommended for any WireGuard Easy instance exposed on a public-facing address.
Monitoring fixes and broader language support
Prometheus metrics now include peer endpoint information, giving administrators more visibility into active connections for monitoring and troubleshooting. A separate fix ensures IPv6 addresses used as client endpoints are properly wrapped in brackets, preventing malformed entries in generated configuration files - a formatting detail that can otherwise break client connections.
The update rounds out with new Swedish and Azerbaijani translations, refinements to existing language files, documentation for integrating the VoidAuth identity tool via OpenID Connect, and a batch of dependency updates. Full details are available in the project's changelog, and deployment instructions can be found in general self-hosting guides for the tool.