Skip to content
Get Real IP Docs

pfSense Setup

This guide walks through setting up the Get Real IP WireGuard tunnel on pfSense so your entire network routes inbound traffic through your static public IP.

Step 1 — Get your config details

Section titled “Step 1 — Get your config details”

From the dashboard, open your tunnel and note:

  • Your static IP address (e.g. 134.49.198.16)
  • Your WireGuard private key
  • The server public key
  • The endpoint (e.g. turnpike.getrealip.net:51834)

You can also download the .conf file and reference it while filling in the pfSense fields.

Step 2 — Add a WireGuard tunnel in pfSense

Section titled “Step 2 — Add a WireGuard tunnel in pfSense”
  1. Go to VPN → WireGuard
  2. Click Add Tunnel
  3. Fill in:
    • Description: Get Real IP
    • Listen Port: Leave blank (pfSense will assign one — outbound only)
    • Interface Keys: Click Generate to create a new keypair, or paste the private key from your downloaded config
  1. Click Save Tunnel

Note the Interface name pfSense assigns (e.g. tun_wg0).

Step 3 — Add a peer

Section titled “Step 3 — Add a peer”

Still in VPN → WireGuard, click the Peers tab, then Add Peer:

Field Value
Tunnel Select the tunnel you just created
Description Get Real IP Server
Endpoint turnpike.getrealip.net
Endpoint Port 51834
Keep Alive 25
Public Key (server public key from your config/dashboard)
Allowed IPs 0.0.0.0/0

Click Save Peer.

Step 4 — Assign the WireGuard interface

Section titled “Step 4 — Assign the WireGuard interface”

  1. Go to Interfaces → Assignments

  2. Find the WireGuard tunnel interface in the Available network ports list

  3. Click Add, then click the interface name to configure it

  4. Set:

    • Enable: ✓ checked
    • Description: GETREALIP (or whatever you prefer)
    • IPv4 Configuration Type: Static IPv4
    • IPv4 Address: Your static IP (e.g. 134.49.198.16) with /32
    • IPv4 Upstream Gateway: Click Add a new gateway, name it GETREALIP_GW, and set the gateway IP to the same static IP

  5. Click Save, then Apply Changes

Step 5 — Add a firewall rule on the WireGuard interface

Section titled “Step 5 — Add a firewall rule on the WireGuard interface”
  1. Go to Firewall → Rules → GETREALIP (or whatever you named the interface)
  2. Click Add
  3. Set:
    • Action: Pass
    • Interface: GETREALIP
    • Protocol: Any
    • Source: Any
    • Destination: Any
  4. Click Save, then Apply Changes

This allows inbound traffic arriving on the WireGuard interface to pass through.

Step 6 — Add an outbound NAT rule

Section titled “Step 6 — Add an outbound NAT rule”

For inbound traffic to reach LAN devices, pfSense needs to NAT traffic from the WireGuard interface onto your LAN.

  1. Go to Firewall → NAT → Outbound
  2. Switch to Hybrid Outbound NAT mode
  3. Click Add to create a new rule:
    • Interface: GETREALIP
    • Source: Your LAN subnet (e.g. 192.168.1.0/24)
    • Translation / Address: Interface Address
  4. Click Save, then Apply Changes

Step 7 — Port forwarding (optional)

Section titled “Step 7 — Port forwarding (optional)”

To expose specific services on LAN machines:

  1. Go to Firewall → NAT → Port Forward
  2. Click Add:
    • Interface: GETREALIP
    • Protocol: TCP (or UDP, or both)
    • Destination: GETREALIP address
    • Destination Port Range: Your service port (e.g. 443)
    • Redirect Target IP: Your LAN device (e.g. 192.168.1.100)
    • Redirect Target Port: Same port
  3. Click Save, then Apply Changes

Step 8 — Verify

Section titled “Step 8 — Verify”

From a device outside your network, try to reach your static IP on the port you forwarded. You can also check from inside:

Terminal window
curl https://api.ipify.org

This should return your Get Real IP static address if your default route goes through the tunnel.

Troubleshooting

Section titled “Troubleshooting”

Tunnel shows “No Handshake” in the peer list:

  • Verify the endpoint hostname resolves: Diagnostics → DNS Lookup → turnpike.getrealip.net
  • Check that UDP 51834 is allowed outbound on your WAN firewall rules
  • Confirm the public key in pfSense matches what’s in your dashboard

Handshake succeeds but traffic doesn’t reach LAN devices:

  • Check the outbound NAT rule is correct and applied
  • Verify port forward rules have associated firewall rules (pfSense usually creates them automatically — check Firewall → Rules → GETREALIP)
  • Check that the target LAN device’s default gateway is pfSense