← All guides

Windows guide

This guide gives a single Windows computer your fixed IP, for example to make a game server, Remote Desktop or a web server on that PC reachable.

Important:

• On a PC, the WireGuard app sends all of that PC's internet traffic through the tunnel while it is on.
• The app can only have one tunnel active at a time. You set up two, one per PoP; if one drops, you switch over to the other yourself. You only get automatic failover on a router.

Do you want only the traffic of your fixed IP to go through the tunnel, automatic failover, or to make a device on your network reachable? Then set up the tunnels on your router (see the guide for your router).

1. The app

Download and install WireGuard for Windows from wireguard.com/install.

2. The tunnels

1. Open WireGuard and choose Add Tunnel › Add empty tunnel…
2. Name it fixedip1 and replace the contents with:

[Interface]
PrivateKey = PRIVATE_KEY
Address = TUNNEL_IP_1/32, FIXED_IP/32
MTU = 1420

[Peer]
PublicKey = SERVER_PUBLIC_KEY_1
Endpoint = ENDPOINT_1:PORT
AllowedIPs = 0.0.0.0/0, ::/0
PersistentKeepalive = 25

3. Turn the Block untunneled traffic (kill-switch) checkbox off. Otherwise your PC can no longer reach your own network (printer, NAS).
4. Click Save.
5. Create a second tunnel fixedip2 in the same way, with SERVER_PUBLIC_KEY_2 and ENDPOINT_2:

[Interface]
PrivateKey = PRIVATE_KEY
Address = TUNNEL_IP_2/32, FIXED_IP/32
MTU = 1420

[Peer]
PublicKey = SERVER_PUBLIC_KEY_2
Endpoint = ENDPOINT_2:PORT
AllowedIPs = 0.0.0.0/0, ::/0
PersistentKeepalive = 25

6. Select fixedip1 and click Activate.

3. The Windows firewall

Windows treats the tunnel as a public network and blocks incoming traffic there. In PowerShell (as administrator), open only what you need, for example:

New-NetFirewallRule -DisplayName "fixedip HTTPS" -Direction Inbound -Protocol TCP -LocalPort 443 -LocalAddress FIXED_IP -Action Allow

Preferably don't just open Remote Desktop (port 3389) to the internet.

Also allow ping from our tunnel servers. They ping your tunnel to know whether it works; without a reply, we don't send your fixed IP to your PC.

New-NetFirewallRule -DisplayName "fixedip ping" -Direction Inbound -Protocol ICMPv4 -IcmpType 8 -RemoteAddress SERVER_TUNNEL_IP_1,SERVER_TUNNEL_IP_2 -Action Allow

4. Starting automatically (optional)

Do you want the tunnel to be active even when nobody is signed in? Run in PowerShell (as administrator):

& "C:\Program Files\WireGuard\wireguard.exe" /installtunnelservice "C:\Program Files\WireGuard\Data\Configurations\fixedip1.conf.dpapi"

5. Switching over to PoP 2

Does Latest handshake for fixedip1 stay empty or old, or is your fixed IP no longer reachable? Then click Deactivate on fixedip1 and Activate on fixedip2. If you use the tunnel service from step 4, first remove it with /uninstalltunnelservice fixedip1 and install fixedip2.

Checking

• In the app, Latest handshake should show a recent time.
• Open https://ifconfig.me: you should see your fixed IP.
• Test from outside, for example with your phone on mobile data.

Rolling back

Click Deactivate and remove both tunnels in the app, and the firewall rule with:

Remove-NetFirewallRule -DisplayName "fixedip HTTPS"
Remove-NetFirewallRule -DisplayName "fixedip ping"

Problems?

• No handshake: check ENDPOINT_1/ENDPOINT_2, PORT and the keys.
• Sites do not load or hang: set MTU = 1360.
• Your own network is unreachable: the kill-switch is on; untick the checkbox.

Stuck? E-mail us at info@fixedip.be