macOS guide

What you get from us

Replace these placeholders with the details you received with your FixedIP.be order.

`PRIVATE_KEY`	the private key of your tunnels (keep it secret)
`PORT`	the UDP port of our tunnel servers
`ENDPOINT_1`	the address of our tunnel server in Antwerp
`SERVER_PUBLIC_KEY_1`	the public key of our tunnel server in Antwerp
`TUNNEL_IP_1`	the tunnel address of your router towards Antwerp
`ENDPOINT_2`	the address of our tunnel server in Zaventem
`SERVER_PUBLIC_KEY_2`	the public key of our tunnel server in Zaventem
`TUNNEL_IP_2`	the tunnel address of your router towards Zaventem
`FIXED_IP`	your fixed IPv4 address

This guide gives a single Mac your fixed IP, for example to make a service on that Mac reachable.

Important:

On a Mac, the WireGuard app sends all of that Mac's internet traffic through the tunnel while it is on.

The app can only have one tunnel active at a time. You set up two, one per PoP; if one drops, you switch over to the other yourself. You only get automatic failover on a router.

Do you want only the traffic of your fixed IP to go through the tunnel, automatic failover, or to make a device on your network reachable? Then set up the tunnels on your router (see the guide for your router).

1. The app

Install WireGuard from the Mac App Store.

2. The tunnels

Open WireGuard and choose Add Empty Tunnel…
Name it fixedip1 and replace the contents with:

[Interface]
PrivateKey = PRIVATE_KEY
Address = TUNNEL_IP_1/32, FIXED_IP/32
MTU = 1420

[Peer]
PublicKey = SERVER_PUBLIC_KEY_1
Endpoint = ENDPOINT_1:PORT
AllowedIPs = 0.0.0.0/0, ::/0
PersistentKeepalive = 25

Turn on Exclude private IPs, so your own network (printer, NAS) stays reachable, and click Save.
Create a second tunnel fixedip2 in the same way, with SERVER_PUBLIC_KEY_2 and ENDPOINT_2:

[Interface]
PrivateKey = PRIVATE_KEY
Address = TUNNEL_IP_2/32, FIXED_IP/32
MTU = 1420

[Peer]
PublicKey = SERVER_PUBLIC_KEY_2
Endpoint = ENDPOINT_2:PORT
AllowedIPs = 0.0.0.0/0, ::/0
PersistentKeepalive = 25

Select fixedip1 and click Activate. Approve the VPN configuration if macOS asks for it.

3. The firewall

Is the macOS firewall on (System Settings › Network › Firewall)? Then allow the app you want to make reachable. Only share what you really need.

If stealth mode is on, turn it off: our tunnel servers ping your tunnel to know whether it works. Without a reply, we don't send your fixed IP to your Mac.

4. Connecting automatically (optional)

In the app, click Edit on fixedip1 and turn on On-Demand for Ethernet and/or Wi-Fi.

5. Switching over to PoP 2

Does Latest handshake for fixedip1 stay empty or old, or is your fixed IP no longer reachable? Then click Deactivate on fixedip1 and Activate on fixedip2. If needed, move On-Demand over to fixedip2.

Checking

In the app, Latest handshake should show a recent time.
Open https://ifconfig.me: you should see your fixed IP.
Test from outside, for example with your phone on mobile data.

Rolling back

Click Deactivate and remove both tunnels in the app.

Problems?

No handshake: check ENDPOINT_1/ENDPOINT_2, PORT and the keys.
Sites do not load or hang: set MTU = 1360.
Your own network is unreachable: turn on Exclude private IPs.

Stuck? E-mail us at info@fixedip.be