Linux / Generic Setup

This guide covers running the WireGuard tunnel on a Linux machine — a server, a Raspberry Pi, or any device running a standard WireGuard client. This is also the right guide if you want to set up routing so that multiple LAN devices use the tunnel.

Prerequisites

A Linux machine (Ubuntu, Debian, Fedora, Arch, etc.)
Your Get Real IP WireGuard config downloaded from the dashboard
wireguard-tools installed

Install WireGuard

Ubuntu / Debian:

sudo apt update && sudo apt install wireguard

Fedora / RHEL / Rocky:

sudo dnf install wireguard-tools

Arch Linux:

sudo pacman -S wireguard-tools

Install the config

Copy your downloaded config to /etc/wireguard/:

sudo cp ~/Downloads/getrealip.conf /etc/wireguard/getrealip.conf
sudo chmod 600 /etc/wireguard/getrealip.conf

Bring the tunnel up

sudo wg-quick up getrealip

Verify the tunnel is active:

sudo wg show

You should see a peer entry with a handshake timestamp within the last minute or two.

Check your public IP:

curl https://api.ipify.org

It should match the static IP shown in your dashboard.

Start on boot

sudo systemctl enable --now wg-quick@getrealip

This creates a systemd service that starts the tunnel automatically on every boot.

Routing LAN traffic through the tunnel

If you want inbound traffic on your static IP to reach other machines on your LAN (not just the WireGuard machine), you need to set up NAT and IP forwarding on the Linux box running WireGuard.

1. Enable IP forwarding

# Apply immediately
sudo sysctl -w net.ipv4.ip_forward=1

# Persist across reboots
echo "net.ipv4.ip_forward=1" | sudo tee /etc/sysctl.d/99-wireguard.conf

2. Add NAT/masquerade rules

Replace eth0 with your LAN interface and 192.168.1.0/24 with your LAN subnet:

sudo iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o getrealip -j MASQUERADE
sudo iptables -A FORWARD -i getrealip -o eth0 -j ACCEPT
sudo iptables -A FORWARD -i eth0 -o getrealip -j ACCEPT

To make these rules persist across reboots:

sudo apt install iptables-persistent   # Debian/Ubuntu
sudo netfilter-persistent save

3. Port forwarding (optional)

To forward a specific inbound port to a LAN device:

# Forward TCP port 80 to 192.168.1.100
sudo iptables -t nat -A PREROUTING -i getrealip -p tcp --dport 80 -j DNAT --to-destination 192.168.1.100:80

Repeat for each port/service you want to expose.

Troubleshooting

sudo wg show shows no peers / no handshake:

Check that wg-quick up getrealip ran without errors
Verify DNS resolves the endpoint: nslookup turnpike.getrealip.net
UDP 51834 must be allowed outbound — check your firewall or ISP

Handshake succeeds but traffic doesn’t flow:

Run ip route show and verify a route exists for your static IP via the getrealip interface
Check AllowedIPs — make sure the traffic you expect is covered

I see the right IP on the WireGuard machine but not on other LAN devices:

Verify IP forwarding is enabled: cat /proc/sys/net/ipv4/ip_forward (should be 1)
Check your NAT rules: sudo iptables -t nat -L -n -v
Make sure the LAN devices use the WireGuard machine as their default gateway (or have a route to the static IP via it)