Amnezia. Multi-hop mode

Multi-hop mode links two independent BeAdmin installs into an entry → exit chain. Traffic goes device → entry hop → exit hop → internet: the device connects to the first server, but reaches the internet from the second. A chain is a fit when a single Amnezia server is no longer enough — its IP has become unreachable, or you need an egress address in another country.

This article covers why you'd want a chain and how to assemble one from two servers: create the exit hop, link an entry hop to it, and check that the chain works. If you're just getting to know the module, start with Amnezia quick start; how the traffic masking works is in Amnezia. How the service works.

Why a multi-hop chain

With a regular Amnezia user, traffic reaches the internet from your server's IP, and the provider sees a connection to that same server. As long as the server stays off the radar, that's enough. But if its IP has become unreachable, or you need to release traffic from another location, you need a different egress address.

A chain splits apart the two points the server is visible from on the outside:

• entry hop — what the user's provider sees. To it, this is an ordinary obfuscated AmneziaWG connection.
• exit hop — what the internet sees. Destination sites receive requests from the exit hop's IP, on another network and, as a rule, in another country.

Even if the entry hop becomes unreachable, the egress address stays out of the way — and vice versa. This is not Tor-grade anonymization: the chain adds exactly one intermediate hop to change the egress IP, no more.

What you'll need

• At least two BeAdmin servers in different locations — otherwise a chain makes no sense: its whole job is to spread the entry and the exit across different networks. The Amnezia module must be installed on each server. Let's call them install A (the future entry) and install B (the future exit).
• Take the entry hop as close to the client's location as you can — ideally in the same country: the device connects to the entry directly, and the shorter that leg is, the more stable the link. The far point is the exit hop — it's the one that gives you the egress IP you want.
• Access to both panels with edit rights: linking is done by hand, by copying a link from one panel into the other.

If you haven't picked the servers for the entry and exit hops yet, our partners offer a VPS with BeAdmin already installed — in a choice of several countries: take the entry close to the user, and the exit in the location you need.

Proven over 15 years in hosting. Your VPS with BeAdmin is ready to go out of the box.

• Germany
• Netherlands
• Sweden
• Switzerland
• Spain
• USA

Select server

European reliability made simple. Launch BeAdmin with your VPS in just one click.

• Germany
• Netherlands
• Sweden
• Estonia
• Romania
• Switzerland
• Spain
• United Kingdom
• USA

Sign up

ℹ️ The role belongs to a user, not a server

Multi-hop mode is the role of a particular user, not a mode of the whole install. Standalone users, entry hops, and exit hops happily share one server. A single install can be the entry for some users and the exit for others at the same time — that is, work in both directions.

ℹ️ A chain needs two users

A chain is built from two users: an exit hop on one server and an entry hop on the other. Each one takes up a slot in its server's licence. If you need more than one multi-hop connection, you'll have to purchase a licence on both servers.

How to link two servers

There's no shared management between the two panels — they don't know about each other. The link is one-way and assembled by hand: the exit hop issues a special awgmh://… link, and you copy it and paste it into the entry hop on the other server. Order matters — exit first, then entry.

Step 1. The exit hop on install B

1. On install B, open the Amnezia module and click Create user.
2. In the Mode field pick Multi-hop, and in the Role in the chain field that appears — Exit hop. Fill in the required fields and create the user.
3. The exit hop has no QR code or config of its own — in their place the expanded row shows the note "Exit hop — no connection settings". That's expected: this user only releases someone else's traffic to the internet, it doesn't connect directly.
4. Click the Link for the entry hop button — the panel generates a link of the form awgmh://… and copies it to the clipboard. It encodes the connection parameters of this exit hop. Pass it to install A any way that's convenient.

Step 2. The entry hop on install A

1. On install A, open the Amnezia module and click Create user.
2. In the Mode field pick Multi-hop, and in the Role in the chain field — Entry hop.
3. An Exit hop link field appears — paste the awgmh://… link you copied in step 1 here.
4. Fill in the required fields and create the user.

The exit-hop link can be pasted either at creation time or later — the Edit user dialog of an existing entry hop has the same field.

The entry hop is a full-fledged user with its own config: its expanded row has two QR codes (on the AmneziaVPN and AmneziaWG tabs) and a .conf file. Those are what you hand to the end device, just like with a regular user (see Amnezia. Managing users). From there the traffic travels the chain on its own.

Multi-hop status

The entry hop's expanded row gains a Multi-hop status tile — it shows whether the entry reaches its exit. Next to it, once the link is set up, an Exit hop tile with the exit hop's address appears.

Status	What it means and what to do
Active	The link is up, the exit hop is reachable — the chain is working.
Checking…	The panel is polling the exit hop right now. Wait — the status will update on its own.
Exit not bound	The exit-hop link hasn't been pasted yet. Open the entry hop for editing and paste the awgmh://… link (step 2).
Exit unreachable	The exit hop isn't responding. Check that the Amnezia service is running on install B, the server is on and reachable over the network, and the exit's address and port haven't changed.

Turning an existing user into an exit hop

You can assign the exit-hop role to an existing user too — through the Edit user dialog, by changing Mode to Multi-hop and the role to Exit hop. But an exit hop has no config of its own, so on save the panel warns you with a Turn into an exit hop dialog: the user loses their connection settings, and their active connection is dropped. If the user has connected devices, do this deliberately — after the switch there's nothing left for them to import.

Rebinding and unbinding

The entry hop's link to its exit can be changed at any time:

• Rebind to a different exit. Get a new awgmh://… link on the exit hop you want and paste it into the Exit hop link field in the entry hop's edit dialog — the previous link is replaced with the new one. The link itself isn't pre-filled into this field: it's secret and never shown again, so the field always opens empty, while the current binding is visible from the Bound to … note above it.
• Unbind. In the entry hop's expanded row click Unbind. The user returns to a direct exit to the internet — traffic goes through the entry hop itself again, without the second server.

Change the exit point

To release traffic from a different location, set up a new exit hop and rebind the entry to it:

1. Take a server in the location you want, deploy BeAdmin on it, and bind a licence — it's a standalone install, just like the first.
2. On it, create a user in Multi-hop → Exit hop mode and copy its link with the Link for the entry hop button (as in step 1 of assembling the chain).
3. On the entry hop, paste the new link into the Exit hop link field. The end devices re-import nothing — the entry keeps its existing config.

What multi-hop does not do

• Does not unify management of the two panels. Installs A and B stay independent; all the linking is manual, via the link. The entry install's name isn't shown on the exit side — there's no reverse channel between the panels, and the exit hop doesn't know who's connected to it.
• Does not replace anonymization. The destination site sees the exit hop's IP — that's a change of address, not a hiding of identity.

What's next

• Amnezia. Managing users — how to create, edit, disable, and delete users and hand them their config.
• Amnezia. How the service works — how AmneziaWG masks traffic from DPI.
• Amnezia. Managing the module — starting and stopping the service, updating the module, changing the UDP port.