Set up GetAStatic on Linux and Proxmox

Run your WireGuard tunnel on a Linux server, a Proxmox container or a VM. Start it at every boot, check that the internet sees your static IP, and share it with your other Proxmox containers and VMs.

You need an active GetAStatic plan and root access. The commands are for Debian 12 or newer and Ubuntu 22.04 or newer. Run them as root.

On Proxmox

  • Run the tunnel in a container (LXC) or a VM, not on the Proxmox host. The host keeps its normal connection.
  • An unprivileged Debian or Ubuntu container works. WireGuard runs in the host's kernel, so the container needs no extra device or setting.
  • Inbound traffic arrives in the container that runs the tunnel. Run your apps in that container, or make it a gateway so that your other containers and VMs use the static IP too.
  • Do the steps below inside the container: open its Console in Proxmox, or run pct enter <ID> on the host.

Connect the tunnel

  1. Install WireGuard

    apt update
apt install wireguard-tools

  2. Make sure resolvconf is there

    Your config has a DNS line, so that DNS lookups also go through the tunnel. WireGuard needs a program called resolvconf for that line. Most Debian installs and Proxmox containers do not have it. Without it, the tunnel does not start and you see resolvconf: command not found. Check:

    command -v resolvconf

    If this prints a path, go to the next step. If it prints nothing, install it:

    apt install openresolv

    On a machine that uses systemd-resolved (systemctl is-active systemd-resolved prints active, as on most Ubuntu installs), do not install openresolv. Use the one that comes with systemd:

    ln -s /usr/bin/resolvectl /usr/local/sbin/resolvconf

    You can also delete the DNS line from your config instead. The tunnel then works, but DNS lookups go to your normal DNS server, outside the tunnel.

  3. Add your config

    Sign in to your dashboard. On the Devices tab, select the IP for this machine. Under step 2 Add to WireGuard, click Copy config. If the setup steps are closed, click Set up another device, or get the config again first.

    On the machine, open a new file:

    nano /etc/wireguard/wg0.conf

    Paste the config, then press Ctrl+O, Enter and Ctrl+X to save and close. The file holds your private key, so only root may read it:

    chmod 600 /etc/wireguard/wg0.conf

    Use this config on this machine only. If another device runs it at the same time, both connect and disconnect.

  4. Start it, now and at every boot

    systemctl enable --now wg-quick@wg0

    All of this machine's IPv4 traffic now goes out from your static IP. Connections from your LAN and the Proxmox console keep working. An SSH session that comes in from outside your network through your router stops: its replies now go out through the tunnel. Connect to your static IP instead.

  5. Check the tunnel

    wg show

    latest handshake shows a few seconds ago, and the dashboard shows Connected under your IP. A handshake means our server answers. Then check the IP that the internet sees:

    curl -4 https://getastatic.com/api/tools/ip

    The ip value must be the IP on your dashboard.

Open a port

The example opens TCP 443 for a web server on this machine. Use your own port.

  1. Open the port on the dashboard

    New IPs start with every inbound port closed. On the Devices tab, select the IP and open Settings. Next to Open ports, click the current value (All closed on a new IP). Select TCP, enter 443, click Add, then Save.

  2. Let it through this machine

    The app must listen on all interfaces (0.0.0.0), not only on 127.0.0.1. If the machine runs a firewall, such as ufw or firewalld, allow the port on wg0 too.

  3. Check from outside

    On the dashboard, click the Open ports value again. Enter 443 in the box next to Port Test and click Port Test. TCP 443: open means our server reached your app through the tunnel.

Share the static IP with your other Proxmox guests

The container that runs the tunnel becomes a gateway on a new, private bridge, vmbr1. Each container or VM that you put on vmbr1 goes out from your static IP. Guests on vmbr1 cannot reach your home LAN, and if the tunnel stops, they have no internet at all. They never fall back to your home IP.

Do the Connect the tunnel steps in the gateway container first. The examples use 10.10.10.0/24 for vmbr1. If your LAN already uses that range, pick another private range and change it everywhere.

  1. Add the bridge on the Proxmox host

    In Proxmox, select your node, then System → Network. Click Create → Linux Bridge. Name: vmbr1. Leave IPv4/CIDR, Gateway (IPv4) and Bridge ports empty: the bridge connects your guests to each other and to nothing else. Click Create, then Apply Configuration.

  2. Connect the gateway container to it

    Select the gateway container, then Network → Add:

    • Name: eth1
    • Bridge: vmbr1
    • IPv4: Static, IPv4/CIDR: 10.10.10.1/24
    • Gateway (IPv4): empty. Its eth0 on vmbr0 keeps your router as its gateway, and the tunnel uses it.

  3. Turn on forwarding

    In the gateway container:

    echo net.ipv4.ip_forward=1 > /etc/sysctl.d/99-wg-gateway.conf
sysctl --system

  4. Add the firewall rules

    apt install nftables
nano /etc/nftables.conf

    Replace everything in the file with this, then save:

    #!/usr/sbin/nft -f
table inet wggw
delete table inet wggw

table inet wggw {
  chain prerouting {
    type nat hook prerouting priority dstnat; policy accept;
    # Port forwards to guests: one line per port
    # iifname "wg0" tcp dport 25565 dnat ip to 10.10.10.10
  }
  chain forward {
    type filter hook forward priority filter; policy drop;
    tcp flags syn tcp option maxseg size set rt mtu
    ct state established,related accept
    iifname "eth1" oifname "wg0" accept
    iifname "wg0" oifname "eth1" ct status dnat accept
  }
  chain postrouting {
    type nat hook postrouting priority srcnat; policy accept;
    oifname "wg0" masquerade
  }
}

    Guests may only go out through wg0, and their traffic leaves from your static IP. The rules use their own table, so they do not touch WireGuard's own rules. Load them now and at every boot:

    nft -c -f /etc/nftables.conf
systemctl enable nftables
systemctl restart nftables

    The first command checks the file. If it prints an error, fix the file first.

  5. Give guests an address

    dnsmasq gives each guest on vmbr1 an address and DNS:

    apt install dnsmasq
nano /etc/dnsmasq.d/vmbr1.conf
    interface=eth1
bind-dynamic
dhcp-range=10.10.10.100,10.10.10.200,12h
no-resolv
server=<the DNS value from your config>

    Put your config's DNS value on the last line, so that guests' DNS lookups also go through the tunnel. bind-dynamic lets dnsmasq start even if eth1 is not ready yet at boot. Then:

    systemctl restart dnsmasq

  6. Move a guest onto vmbr1

    • Container: Network, edit eth0. Bridge: vmbr1, IPv4: DHCP.
    • VM: Hardware, edit the Network Device. Bridge: vmbr1. The VM's system must get its address by DHCP.

    A guest that must also reach your home LAN keeps a second network device on vmbr0, with a static address and no gateway. It then reaches your LAN directly, and the internet through your static IP. Port forwards on your home router to that guest no longer work. Use port forwards on the static IP instead (next step).

  7. Forward a port to a guest

    Give the guest a fixed address. In Proxmox, copy the MAC address of its vmbr1 device. Add a line to /etc/dnsmasq.d/vmbr1.conf in the gateway container, then run systemctl restart dnsmasq and restart the guest:

    dhcp-host=BC:24:11:00:00:00,10.10.10.10

    In /etc/nftables.conf, add one line per port in the prerouting chain, like the example there, without the #. Use udp for UDP ports. Then run nft -c -f /etc/nftables.conf and systemctl restart nftables. Open the same port on the dashboard too (see Open a port).

  8. Check a guest

    In a guest on vmbr1:

    curl -4 https://getastatic.com/api/tools/ip

    The ip value must be your static IP. A ping to your home router (for example ping 192.168.1.1) must fail. To test the kill switch, run systemctl stop wg-quick@wg0 in the gateway: the guest then has no internet. Run systemctl start wg-quick@wg0 to bring it back.

If it does not work

To see why the tunnel did not start, run journalctl -u wg-quick@wg0 -n 20.

  • resolvconf: command not found: do the resolvconf step, then systemctl restart wg-quick@wg0.
  • Unknown device type or Operation not supported in a Proxmox container: the host has not loaded WireGuard. On the Proxmox host, run modprobe wireguard, and echo wireguard > /etc/modules-load.d/wireguard.conf so that it loads at every boot. Then restart the tunnel in the container.
  • wg0 already exists: the tunnel was started by hand. Run wg-quick down wg0, then systemctl start wg-quick@wg0.
  • A guest on vmbr1 gets no address: in the gateway, run journalctl -u dnsmasq -n 20, and check that eth1 has 10.10.10.1 (ip -4 addr show eth1).
  • No handshake: your network may block UDP 1194. On the dashboard, under step 2, click Trouble connecting?, then Port 443, and copy that config into /etc/wireguard/wg0.conf in place of the old one. Then run systemctl restart wg-quick@wg0.

Still stuck? Ask on the Support tab of your dashboard, and include the output of journalctl above. Never send your config: it holds your private key.