awg0-client.conf

[Interface]
PrivateKey = 4ADcTmeIglwS6O6VmMn8VZmyn5nA5aXN/4g53jAQH2Y=
Address = 10.47.0.2/24

[Peer]
PublicKey = PX6J6bFkdMEsKmqVl5M7sbgiXFHKWyl8rlGLaeUc0Rg=
PresharedKey = yIw2PtOGI35SczEyb4d4mcViTqIjk0wa4sScaE3ciHE=
AllowedIPs = 10.47.0.0/24
Endpoint = domain.com:12413
PersistentKeepalive = 25

awg0-server.conf

[Interface]
PrivateKey = oMnb3bDJuhouU5+YRwK2cfrey+DEQSNX3OH5BvWJt3g=
ListenPort = 12048

[Peer]
PublicKey = Cyxi3ECRBSTVdZXM9CIcGYTVjkQo2WiAzdVryCQhuAM=
PresharedKey = 2PeZAlcWuRVfqTpNDsdGLejkwNeUNXlyTG7EVSB482E=
AllowedIPs = 10.47.0.2/32

gen-awg.sh

#!/usr/bin/env bash
set -euo pipefail

rand() {
    local min="$1"
    local max="$2"
    shuf -i "${min}-${max}" -n 1
}

S1=$(rand 0 64)
S2=$(rand 0 64)
S3=$(rand 0 64)
S4=$(rand 0 32)

Jc=$(rand 2 5)
Jmin=$(rand 64 256)
Jmax=$(rand "$Jmin" 1024)

RANGE_SIZE=$(rand 1000000 5000000)

H1_START=$(rand 1000000000 1500000000)
H1_END=$((H1_START + RANGE_SIZE))

H2_START=$((H1_END + 1 + $(rand 1000000 10000000)))
H2_END=$((H2_START + RANGE_SIZE))

H3_START=$((H2_END + 1 + $(rand 1000000 10000000)))
H3_END=$((H3_START + RANGE_SIZE))

H4_START=$((H3_END + 1 + $(rand 1000000 10000000)))
H4_END=$((H4_START + RANGE_SIZE))

cat <<EOF
Jc = $Jc
Jmin = $Jmin
Jmax = $Jmax
S1 = $S1
S2 = $S2
S3 = $S3
S4 = $S4
H1 = $H1_START-$H1_END
H2 = $H2_START-$H2_END
H3 = $H3_START-$H3_END
H4 = $H4_START-$H4_END
EOF

install-amneziawg.txt

apt-get update
apt-get install -y git libelf-dev linux-headers-$(uname -r) build-essential pkg-config

git clone --single-branch --depth=1 https://github.com/amnezia-vpn/amneziawg-linux-kernel-module.git
git clone --single-branch --depth=1 https://github.com/amnezia-vpn/amneziawg-tools.git

make -C amneziawg-linux-kernel-module/src -j$(nproc)
make -C amneziawg-linux-kernel-module/src install

make -C amneziawg-tools/src -j$(nproc)
make -C amneziawg-tools/src install

route-nftables.txt

ip rule add fwmark 1 table 100
ip route add local 0.0.0.0/0 dev lo table 100


table ip xray {
        chain prerouting {
                type filter hook prerouting priority mangle; policy accept;
                ip saddr 10.47.0.0/24 ip daddr != 10.47.0.0/24 ip protocol { tcp, udp } tproxy to :1083 meta mark set 0x00000001
        }
}

xray.service

[Unit]
Description=xray
After=network.target

[Service]
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
ExecStart=/usr/local/bin/xray -c /etc/xray.yaml
User=xray
Group=xray
Restart=on-failure
RuntimeDirectory=xray
SyslogIdentifier=xray

[Install]
WantedBy=multi-user.target

xray.yaml

inbounds:
  - listen: 10.47.0.1
    tag: all-in
    port: 1083
    protocol: tunnel
    settings:
      allowedNetwork: tcp,udp
      followRedirect: true
    streamSettings:
      sockopt:
        tproxy: tproxy
    sniffing:
      enabled: true
      metadataOnly: true
      routeOnly: true
      destOverride:
        - fakedns
  - listen: 127.0.0.1
    tag: dns-in
    port: 5353
    protocol: tunnel
    settings:
      address: 8.8.8.8
      network: tcp,udp
routing:
  domainStrategy: AsIs
  rules:
    - inboundTag:
        - dns-in
      outboundTag: dns-out
    - inboundTag:
        - all-in
      outboundTag: freedom-out
outbounds:
  - protocol: dns
    tag: dns-out
    streamSettings:
      sockopt:
        mark: 2
  - protocol: freedom
    tag: freedom-out
    streamSettings:
      sockopt:
        mark: 2
dns:
  servers:
    - fakedns
    - address: fakedns
      skipFallback: true
  queryStrategy: UseIPv4
fakedns:
  ipPool: 100.64.0.0/10
  poolSize: 65535