Policy-Based Routing (Incoming Only)

By default, the WireGuard config routes all traffic through the tunnel. That’s fine for most setups — it’s simple and everything just works. But if you’re running a server and only want inbound connections on your static IP to use the tunnel (while your outbound browsing, DNS, updates, etc. stay on your regular ISP connection), you want policy-based routing.

What it does

• Inbound connections to your static IP arrive via the tunnel ✓
• Reply traffic for those connections goes back through the tunnel ✓
• Your own outbound traffic (browsing, updates, etc.) uses your normal ISP ✓
• No double-hop latency for outbound traffic ✓

How to use it

Linux

Download the Incoming Only (Linux) config from your dashboard. Move it to /etc/wireguard/ and bring it up with wg-quick:

sudo mv getrealip.conf /etc/wireguard/
sudo wg-quick up getrealip

That’s it. The config uses Table = off plus fwmark and CONNMARK rules to handle the routing for you.

For details on what these rules are doing under the hood, see Policy-Based Routing Internals.

macOS (Homebrew)

Download the Incoming Only (macOS Homebrew) config from your dashboard. It requires wg-quick from Homebrew:

brew install wireguard-tools
sudo mv getrealip.conf /etc/wireguard/
sudo wg-quick up getrealip

The config uses macOS’s pf firewall with reply-to to route replies back through the tunnel.

pfSense / OPNsense

In the web UI:

1. Go to Firewall → Rules → [your WireGuard interface]
2. Add or edit a pass rule
3. Under Advanced Options, find Reply-to (pfSense) or Reply To (OPNsense)
4. Set it to the WireGuard gateway

OPNsense does this automatically if you have the WireGuard gateway configured correctly.

MikroTik

Use mangle rules with routing-mark to tag connections arriving on the WireGuard interface, then create a separate routing table that routes via the WireGuard interface. Similar concept to Linux fwmark but configured via Winbox or CLI with /ip firewall mangle and /ip route.

GL.iNet

GL.iNet runs OpenWrt underneath. You can add mangle rules via the LuCI firewall UI or directly via SSH using the same iptables and ip rule approach as Linux.

---

Multiple IPs to different LAN hosts

If you have multiple static IPs and want each one to reach a different machine on your LAN, see Advanced Networking: Multi-IP Routing.

---

Troubleshooting

Inbound connections work but replies don’t go back: The most common issue — your OS is sending replies out the default gateway instead of the tunnel. Make sure you’re using the Incoming Only config (not Full Tunnel with manual modifications).

Outbound traffic is going through the tunnel: You’re likely using the Full Tunnel config instead of Incoming Only. Re-download from the dashboard using the correct option.

Works for one connection but not multiple: If you’ve set this up manually, make sure you’re using CONNMARK (connection tracking), not just MARK. Without connmark, only the first packet of each connection gets marked.