macOS Setup

This guide covers running the WireGuard tunnel on macOS. There are two options: the App Store app (GUI) or the Homebrew wireguard-tools package (command-line with wg-quick).

Prerequisites

• macOS 12 (Monterey) or later
• Your Get Real IP WireGuard config downloaded from the dashboard

---

Option A: WireGuard App (App Store)

The WireGuard app from the Mac App Store provides a simple GUI for managing tunnels.

Install and import

1. Install WireGuard from the App Store
2. Open the app and click Import Tunnel(s) from File (or drag and drop the .conf file)
3. Allow the app to add a VPN configuration when prompted

Activate

Click Activate on the tunnel. Verify your IP:

curl -4 https://api.ipify.org

Limitations

The App Store version runs in a sandboxed environment. It does not support PostUp/PostDown scripts in the config file — these lines are silently ignored. This means:

• The Full Tunnel config works perfectly
• The Incoming Only config that uses PostUp/PostDown routing commands will not work — those scripts are silently ignored

If you need policy-based routing (incoming traffic only) on macOS, use the Homebrew option below.

---

Option B: Homebrew (wg-quick)

The Homebrew version installs the standard wireguard-tools package, which includes wg-quick. It runs as a command-line tool with full support for PostUp/PostDown scripts — the same as Linux.

Install

brew install wireguard-tools

Install the config

sudo mkdir -p /etc/wireguard
sudo cp ~/Downloads/getrealip.conf /etc/wireguard/getrealip.conf
sudo chmod 600 /etc/wireguard/getrealip.conf

Bring the tunnel up

sudo wg-quick up getrealip

Verify:

curl -4 https://api.ipify.org

Bring the tunnel down

sudo wg-quick down getrealip

Start on boot

Create a launch daemon to start the tunnel automatically:

sudo tee /Library/LaunchDaemons/com.getrealip.wireguard.plist << 'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>com.getrealip.wireguard</string>
    <key>ProgramArguments</key>
    <array>
        <string>/opt/homebrew/bin/wg-quick</string>
        <string>up</string>
        <string>getrealip</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
    <key>StandardErrorPath</key>
    <string>/var/log/wireguard-getrealip.log</string>
</dict>
</plist>
EOF

sudo launchctl load /Library/LaunchDaemons/com.getrealip.wireguard.plist

---

Policy-based routing on macOS

If you’re using the Incoming Only config (inbound traffic uses the tunnel, your own outbound traffic stays on your ISP), download the Incoming Only (macOS) config from the dashboard and run it with wg-quick via Homebrew — the App Store version can’t run the routing commands it needs.

The config includes PostUp and PreDown lines that add a routing entry scoped to the WireGuard interface only, so replies to inbound connections go back out the tunnel without redirecting the rest of your Mac’s traffic. wg-quick runs these automatically when you bring the tunnel up and down — you don’t need to do anything.

If you want the details of how this works, see Policy-Based Routing Internals.

---

Which should I use?

	App Store	Homebrew (wg-quick)
GUI	✅	❌ (command-line)
Full Tunnel	✅	✅
Incoming Only (policy routing)	❌	✅
PostUp/PostDown scripts	❌ (ignored)	✅
Start on boot	✅ (built-in toggle)	Manual (LaunchDaemon)
Menu bar icon	✅	❌

Most users: App Store version is simpler and works great for full tunnel use.

Power users / incoming-only: Use Homebrew for PostUp/PostDown support.

---

macOS Firewall

macOS’s built-in firewall blocks incoming connections by default. To allow traffic to reach services on your Mac:

1. System Settings → Network → Firewall
2. Either disable the firewall (not recommended) or add specific apps to the “Allow incoming connections” list

Alternatively, use pfctl for fine-grained port control.

---

Troubleshooting

App Store version: tunnel is active but IP doesn’t change:

• Check that AllowedIPs = 0.0.0.0/0 is in the config
• Try curl -4 https://api.ipify.org from Terminal (browser may prefer IPv6)

Homebrew: wg-quick up fails with “operation not permitted”:

• Run with sudo
• If using Apple Silicon, verify the path: /opt/homebrew/bin/wg-quick

No handshake:

• Verify DNS resolution: nslookup turnpike.getrealip.net
• Check that outbound UDP 51834 isn’t blocked by your network