English · Русский · Technical (EN) · Техническое (RU)
1.5.1-beta
What's new in 1.5.1-beta — full changelog
- Content filtering (new in 1.5.0) — block ads, trackers, malware, adult content, gambling and more, per server, from curated lists. Enforced on the entry node; a streaming resolver keeps even multi-million-domain lists from running a small box out of memory.
- Protection dashboard (new in 1.5.0) — a live Overview card showing what filtering is catching (blocked sites per category, torrents, port-scanners), with a hover "who" bubble that ties torrents and scanners back to the user behind them.
- 1.5.1 fix — the "update available" changelog popover no longer sticks on screen or piles up; it's also wider and reads in full.
Easy-to-use self-hosted WireGuard & AmneziaWG control panel with TURN-PROXY support. Deploy your own VPN in minutes.
swgPanel is a control panel for running your own WireGuard / AmneziaWG VPN across one or more servers. You add your users in the browser, hand them a QR code, and they’re connected. Everything — who has access, which servers they use, how much they’re using — lives on one dashboard that you host yourself.
Run it for yourself, your household, your team, or a whole community — a fast private VPN with no monthly subscription and no one else sitting in the middle of your traffic.
This is a complete, plain-language guide — enough to install swgPanel and use it even if you’re not technical. If you are technical and want the internals — architecture, every flag, the API, security — read the Technical guide.
Click any tile to enlarge · more screenshots throughout this guide
- What it does
- Before you begin
- The three roles (in plain words)
- Step 1 — Install the panel
- Step 2 — Add your servers
- Step 3 — Add users and hand out access
- Using it day to day
- Keeping it running — updates, backups, recovery, switching method, uninstall
- A few things worth knowing
- Learn more
- Special thanks
- One page to run everything. Add servers, add users, hand out access — all from the web panel.
- Access in a QR code. Create a person, show them the QR, they scan it in the WireGuard/AmneziaWG app — no fiddly config files to email around.
- Subscriptions — one private link per user. Instead of a one-off QR, each person gets their own swgSub page: a phone-friendly link with the config and QR for every server they're on — WireGuard, AmneziaWG, and TURN-PROXY forks like WINGS-N, samosvalishe, Moroka8, anton48 and others — plus protocol/relay badges, light/dark mode, and one-tap copy / download / share. The unlock key rides in the link's
#fragment, so the server stores only ciphertext and never sees anyone's private keys. - Suspend access in one click. Block a person — or just one of their servers — instantly, without deleting them. Their tunnels stop and their subscription page goes dark; unblock to restore with the same keys, nothing to re-issue.
- See what’s happening, live. Who’s online, how much they’re downloading, which servers are busy — updated every few seconds.
- Single or multiple servers. Put servers in different countries; a person can fail over between them.
- Panel here or apart. Run the panel on the same server as a VPN node, or on a separate box that only manages your nodes — either works.
- Hard to block. Uses AmneziaWG (a stealthier WireGuard) and can route traffic cleverly by destination, so it keeps working where plain VPNs get blocked.
- Filter out the junk. Block ads, trackers, malware, adult content, gambling and more — per server, from curated category lists — and watch a live Protection panel show what's being caught, per category, plus which user is behind the torrents and port-scans it flags.
- Turn-proxies built in. Integrates with the leading vk-turn-proxy relay servers and their client apps — wrap traffic through VK TURN relays to slip past even the toughest blocks, all from the panel.
- You’re in control. It’s self-hosted, stores no passwords or keys it doesn’t need, and never phones home.
📸 More screenshots — click to expand
| Users — everyone you’ve given access to, at a glance |  |
| Activity log — every change, and anything that needs attention |  |
| Smart routing — send chosen sites out through a chosen server |  |
| Routing lists — pick a routing mode and manage lists per server |  |
| List providers — curated + community geo/domain lists |  |
| Content filters — block ads, trackers, malware & adult per server |  |
| Filter providers — the curated block-list feeds behind the filters |  |
| Protection dashboard — a live view of what filtering catches, per category |  |
| Turn-proxy — wrap traffic through relays to beat blocks |  |
| Turn-proxy catalog — which relay forks are offered, and auto-updates |  |
Subscription pages — each user's private swgSub link, with config + QR for every server (WireGuard, AmneziaWG, and TURN-PROXY forks):
You need one server to run the panel on — a cheap VPS (virtual server) from any hosting provider is plenty. It should have:
- A public IP address (so your users can reach it).
- A recent Linux (Ubuntu/Debian and most others are fine).
sudo/root access, and a way to paste a command into it (SSH).
That’s it. If you want a domain name (like vpn.example.com) you can point it at the server first — the
installer will get a real HTTPS certificate for it automatically. No domain? It still works with the
server’s IP address.
You can add more servers later — each extra server is one more command, run the same way.
Every server you set up plays one of three roles. You don’t have to memorise these — the installer asks you in plain language — but it helps to know the words:
- Host — just the control panel. The web page and the brains. It doesn’t carry any VPN traffic itself.
- Master — the control panel and a VPN server on the same box. Simplest for a one-server setup: one command gives you the panel and your first VPN server together.
- Node — just a VPN server. An extra server that carries traffic and reports back to your panel.
And there are two ways to install any of them — pick whichever you like:
- Bare-metal — installs straight onto the server (a little faster).
- Docker — runs in containers (tidy, easy to move around).
You can mix freely: a Docker panel with bare-metal servers, and so on.
Copy the command onto your server and run it. It asks you a few simple questions and sets everything up, including HTTPS.
curl -fsSL https://raw.githubusercontent.com/SanityProtocol/swg-panel/main/bootstrap.sh | sudo bash -s
Already
root? Many fresh Debian/VPS images log you in as root with nosudoinstalled — just drop thesudoand run… | bash -s. (The same applies to every command below.)
The first question is how to run it — bare-metal (directly on the host, best throughput) or Docker (in containers). The second is the role: choose Master to make this box your panel and your first VPN server in one go (recommended if you only have one server), or Host for just the panel. It then asks for your domain and a password, and when it finishes prints your panel’s web address and login — open it and sign in.
Want the details on bare-metal vs Docker, or to run
docker composeyourself? See the Technical guide.
If you chose Master above, you already have your first VPN server — you can skip to Step 3. To add more servers (called nodes), do this for each one:
-
In the panel, open Nodes → Add node. It shows you a ready-to-paste command with a key already filled in — one for bare-metal, one for Docker. It looks like this:
curl -fsSL https://raw.githubusercontent.com/SanityProtocol/swg-panel/main/bootstrap.sh | sudo bash -s node # bare-metal curl -fsSL https://raw.githubusercontent.com/SanityProtocol/swg-panel/main/bootstrap.sh | sudo bash -s docker node # Docker -
Run that command on the new server. It asks for your panel’s address and the key (both pre-filled if you copied the panel’s command), then connects itself back to the panel.
The new server reaches out to the panel on its own — you never have to open special access to it, no inbound ports, no SSH keys shared around. Within a few seconds it shows up in your Nodes list.
- Go to Peers → New peer, give it a name (e.g. a person or a device), and pick which server(s) it may use.
- The panel shows a QR code and a config file. The person opens the WireGuard or AmneziaWG app on their phone/computer, scans the QR (or imports the file), and they’re online.
- Using a turn-proxy on that server? Getting its config is just as easy — the panel shows the proxy’s address and a wrap key to drop into the vk-turn-proxy client app, right alongside the QR.
That’s the whole flow. The secret half of their key is created in your browser and shown once — so save/hand over the config there and then. Need to give the same person a second device? Just make another peer.
- Watch the dashboard. The Overview page shows who’s online, the busiest servers, and where traffic is going — all live.
- Add or remove users anytime. Changes reach your servers within seconds. Remove someone and their access stops on the next check-in.
- Change the panel’s login under ⚙︎ → Account — it takes effect immediately. While you’re there, switch on two-factor authentication (Google Authenticator) for stronger sign-in security.
- Route certain sites through a certain country (optional). For example, send streaming out through a server abroad and keep everything else local. Set it per server under Settings → Routing lists.
- Get past tougher blocks (optional). If plain VPN traffic is blocked on a network, swgPanel can wrap it through a turn-proxy — set up under a server’s details and in Settings → Turn proxies.
- Feed other tools (optional). The panel can share live status with dashboards like Grafana or Uptime Kuma, and ping a webhook when a server goes offline — Settings → Integrations.
Everything below is one command, run on the server, the same way you installed. Each one asks before it does anything and keeps your data safe.
Run this on any server (panel or VPN server) — it figures out what’s installed and updates it in place, keeping all your settings and users:
curl -fsSL https://raw.githubusercontent.com/SanityProtocol/swg-panel/main/bootstrap.sh | sudo bash -s update
- Automatic. Every time something changes — you add a person, add a server, change a setting — the panel writes a timestamped backup of that file right next to it, and keeps the last several. If a file ever gets damaged (a bad shutdown, a full disk), the panel quietly restores the newest good backup on its own the next time it starts. You don’t have to do anything.
- Manual (recommended anyway). For an off-server copy, save the panel’s state folder
(
/var/lib/swg-panel, which holds your users and servers) somewhere safe — a copy is all it takes to rebuild the panel elsewhere.
- Re-running any installer is safe. It notices there’s already an install and keeps your data (login, certificate, users, servers) — handy if a command got interrupted, or to change an option.
- Rebuilding a VPN server? Run the recovery helper on it and it finds the server’s leftover identity so
it rejoins your panel without re-enrolling:
curl -fsSL https://raw.githubusercontent.com/SanityProtocol/swg-panel/main/bootstrap.sh | sudo bash -s recovery - Lost the whole panel box? Put your saved
/var/lib/swg-panelfolder back on a fresh install and your users and servers are there again; the servers reconnect on their own.
Changed your mind about how a server is installed? You can convert it in place, keeping everything. Just re-run the installer asking for the other method — it offers convert · keep · abort:
curl -fsSL https://raw.githubusercontent.com/SanityProtocol/swg-panel/main/bootstrap.sh | sudo bash -s master # → bare-metal
curl -fsSL https://raw.githubusercontent.com/SanityProtocol/swg-panel/main/bootstrap.sh | sudo bash -s docker master # → Docker
It stages the new version fully before removing the old one, so the switch takes only a few seconds and your users barely notice. (A “master” box can convert as a whole, or just its panel half or just its server half.)
Removes swgPanel, asking about each piece first (the panel, a VPN server, the VPN software, any turn-proxies) — nothing goes without a yes, and you can keep your users/servers data for a future reinstall:
curl -fsSL https://raw.githubusercontent.com/SanityProtocol/swg-panel/main/bootstrap.sh | sudo bash -s uninstall
- You decide how private it is. A person’s keys are always created in your browser. By default, the panel keeps a copy of each config (which includes the secret key) so you can re-show its QR code or hand it out again later. Want maximum privacy instead? Flip one setting — Settings → Client configs → off — and the panel keeps only the public parts (public key, address, preshared key); the secret key is then shown once and never stored anywhere.
- A hiccup won’t lock anyone out. If the panel is briefly unreachable, your servers keep running with the access they already have and catch up on the next check-in.
- It’s early. This is a Beta — great for tinkering and small setups, not yet for anything critical.
- Technical guide (English) — architecture, every install option and flag, Docker by hand, converting, smart routing, the external API, backups & security, and troubleshooting.
- Русский · Техническое (RU)
swgPanel integrates several excellent open-source projects — huge thanks to their authors.
Turn-proxy forks — wrap WireGuard/AmneziaWG through VK TURN relays to get past tough blocks:
Routing / geo-data lists — the domain & IP lists behind smart routing:
Content filters / block lists — the ad, tracker, malware & threat-IP feeds behind content filtering: