WireGuard Easy, the open-source project that puts a web interface on top of the WireGuard VPN protocol, has shipped version 15.5. The release combines support for a newer anti-censorship protocol variant, a set of security hardening measures, and configuration options aimed squarely at administrators running the software in production rather than on a home server.
Harder to Detect, Easier to Deploy
The headline addition is support for AmneziaWG 3.1, an evolution of the WireGuard protocol built specifically to resist detection through deep packet inspection, the technique network operators and censors use to identify and block VPN traffic by examining its structural fingerprints rather than its content. Standard WireGuard, for all its cryptographic strength, produces packets with a recognizable signature that some firewalls can flag and throttle or block, which is a real problem for users in regions with aggressive network filtering. AmneziaWG addresses this by obfuscating that signature while preserving the underlying WireGuard handshake and encryption. By updating its AmneziaWG components, including the amneziawg-go implementation, WireGuard Easy keeps pace with a protocol that depends on exact version alignment between client and server to function correctly.
Closing Security Gaps
Two changes stand out on the security side. First, the developers updated Node.js, the JavaScript runtime the application depends on, to patch known vulnerabilities, a routine but essential maintenance step for any web-facing tool. Second, and more consequential, the client details API no longer returns private keys in its responses. Private keys are the cryptographic foundation of a WireGuard connection; anyone who obtains one can impersonate that client or decrypt its traffic. Removing them from an API response closes off a channel through which credentials could leak, whether through misconfigured access controls, logging systems, or a compromised client application reading more than it should.
More Control for Administrators
Version 15.5 also gives administrators the ability to name the WireGuard network interface themselves, rather than being locked into a default. This matters for anyone running multiple VPN instances or integrating WireGuard Easy into infrastructure with established naming conventions, where a fixed interface name can cause conflicts. Alongside this, the update introduces trusted proxy configuration, a feature relevant to anyone placing WireGuard Easy behind a reverse proxy for TLS termination or load balancing. Without correctly identifying trusted proxies, a web application can misread client IP addresses, which undermines logging, access control, and rate limiting alike. The project's documentation now also covers rate limiting setup, a basic but often overlooked defense against brute-force attempts on installations exposed to the open internet.
Better Visibility, Fewer Rough Edges
On the monitoring front, Prometheus metrics now expose peer endpoint information, giving operators more insight into who is connecting and from where, useful for spotting anomalies or simply understanding usage patterns across a fleet of clients. A smaller but practical fix ensures IPv6 addresses used as client endpoints are properly enclosed in brackets, a formatting detail that prevents malformed configuration files, something that has tripped up VPN tools before as IPv6 adoption grows.
The release rounds out with Swedish and Azerbaijani translations, refinements to existing language support, and new documentation for integrating VoidAuth via OpenID Connect, extending how administrators can handle authentication. Combined with the usual batch of dependency updates, version 15.5 reads as a maintenance-focused release, but one that meaningfully reduces attack surface while extending the tool's reach into environments where traffic obfuscation and proxy awareness are not optional extras but operational necessities.
