The AmneziaWG config sends all IPv4 and IPv6 traffic into the tunnel (AllowedIPs = 0.0.0.0/0, ::/0). That way IPv6 goes through the tunnel instead of leaking past it - keep that line as it is.
Install Streisand or Hiddify from the App Store, or AmneziaVPN for the AmneziaWG profile.
Download the .conf from your cabinet, or copy the subscription link.
Import:Import tunnel(s) from file, or add from the clipboard.
Allow the configuration in System Settings when prompted.
Tick On-Demand so macOS reconnects automatically on wake and on new Wi-Fi networks.
Check the firmware. The AmneziaWG profile runs on OpenWrt with the amneziawg package; the VLESS link needs firmware that can run xray.
Open the VPN section and create a client tunnel from the AmneziaWG config.
Paste the config from your .conf file - interface keys, then the peer block.
Set DNS to the address in the config so lookups stay inside the tunnel.
Apply, then check any device on that network with the leak check.
A router tunnel covers everything on the network - TVs, consoles, anything without a VPN app. It counts as one device against your plan.
Which app should I use?
Happ / v2rayBox
Take the VLESS subscription link. This is the default profile - use it wherever it connects.
AmneziaVPN / Happ
Speak AmneziaWG, which disguises the traffic. Use these where plain VPN protocols get blocked.
Streisand / Hiddify
Multi-protocol clients that also take the VLESS link. Handy if you juggle several providers on one device.
Getting the AmneziaWG profile
Your key carries two profiles and one price. The subscription link is the default; the AmneziaWG config is the fallback for networks that filter it. Open your cabinet, go to Config, switch to AmneziaWG and download the file - then import it into the AmneziaWG or AmneziaVPN app, or scan the QR code beside it.
The config is issued once. Its private key is generated on the node and we keep no copy, so it cannot be shown a second time - save the file. If it is lost, issue a new one from the same screen; the old one stops working immediately.
IPv6: keep it inside the tunnel
If your network also hands out IPv6 and the app only covers IPv4, sites that reach you over IPv6 see your real address. How to close it:
AmneziaWG: nothing to do. The config routes IPv6 into the tunnel too.
VLESS apps (Happ, v2rayN, v2rayNG, v2RayTun, Hiddify, Streisand): turn on TUN mode, sometimes called VPN mode, instead of system proxy. A system proxy only covers the apps that honour it.
Windows: Control Panel → Network Connections → your adapter → Properties → untick Internet Protocol Version 6 (TCP/IPv6).
macOS: System Settings → Network → your connection → Details → TCP/IP → Configure IPv6: Link-local only. Or in Terminal: networksetup -setv6off Wi-Fi
Linux: set IPv6 to Disabled for the connection in NetworkManager, or run sudo sysctl -w net.ipv6.conf.all.disable_ipv6=1
Android: there is no system switch. Use TUN (VPN) mode in the VLESS app or the AmneziaWG profile; on mobile data you can also set the APN protocol to IPv4.
iPhone and iPad: there is no switch either. Use the AmneziaWG profile or TUN mode, then check the result.
Router: if it hands out IPv6, turning IPv6 off in its settings covers the whole home network.
Then open the leak check and run the IPv6 test. “No IPv6” is the result you want.
Cypher VPN