Set up GetAStatic on OPNsense

Run your WireGuard tunnel on OPNsense. Then reach a server on your LAN from the internet, and send LAN traffic out from your static IP.

You need an active GetAStatic plan and admin access to OPNsense. Menu and field names follow the OPNsense manual for version 26 (October 2026). Where older versions use another name, it is in brackets.

Connect the tunnel

  1. Download your config

    Sign in to your dashboard. On the Devices tab, select the IP for OPNsense. Under step 2 Add to WireGuard, click Download Config. If the setup steps are closed, click Set up another device, or get the config again first.

    Open the file in a text editor. It looks like this:

    [Interface]
PrivateKey = <your private key>
Address = 10.x.x.x/32
DNS = 10.x.x.1

[Peer]
PublicKey = <server public key>
AllowedIPs = 0.0.0.0/0
Endpoint = <server>:1194
PersistentKeepalive = 25

    If your file has no DNS line, it is from an older download. Download it again. Use this config only on OPNsense: if another device runs it at the same time, both connect and disconnect.

  2. Add our server as a peer

    In OPNsense, go to VPN → WireGuard → Peers and click +. Fill in:

    • Name: any name, for example GetAStatic
    • Public key: the PublicKey value
    • Allowed IPs: 0.0.0.0/0
    • Endpoint address: the Endpoint value before the colon
    • Endpoint port: the number after the colon, 1194 (or 443 if you downloaded the Port 443 config)
    • Keepalive: 25

    Leave the other fields empty and click Save.

  3. Add the instance

    Go to VPN → WireGuard → Instances, click + and turn on advanced mode. Fill in:

    • Name: any name, for example GetAStatic
    • Private key: the PrivateKey value. Leave Public key empty. Do not click the cogwheel next to the keys: it makes a new key pair, and our server accepts only the key in your config.
    • Listen port: any unused port, for example 51820
    • Tunnel address: the Address value, with the /32
    • Peers: the peer you just added
    • Disable routes: on. Without it, OPNsense sends all of its own traffic into the tunnel. The steps below choose what goes through it.
    • Gateway: the DNS value. This is our server's address inside the tunnel.

    Click Save.

  4. Turn WireGuard on

    Go to VPN → WireGuard → General, enable WireGuard and click Apply.

  5. Assign the interface

    Go to Interfaces → Assignments. Under New interface, select the WireGuard device (for example wg0), enter the description STATICIP, add it and click Save.

    Open Interfaces → STATICIP. Turn on Enable. Leave IPv4 Configuration Type and IPv6 Configuration Type at None: the interface gets the tunnel address from the instance. Click Save, then Apply changes. Then click Apply under VPN → WireGuard once more, so the tunnel starts on the new interface.

  6. Add the gateway

    Go to System → Gateways → Configuration and click Add:

    • Name: STATICIP_GW
    • Interface: STATICIP
    • Address Family: IPv4
    • IP address: the DNS value again
    • Far Gateway: on
    • Disable Gateway Monitoring: on

    Click Save, then Apply changes.

  7. Check the tunnel

    VPN → WireGuard → Status shows a handshake a few seconds ago, and the dashboard shows Connected under your IP. A handshake means our server answers.

Reach a server on your LAN

The example forwards HTTPS (TCP 443) to a web server at 192.168.1.10. Use your own port and server address.

  1. Open the port on the dashboard

    New IPs start with every inbound port closed. On the Devices tab, select the IP and open Settings. Next to Open ports, click the current value (All closed on a new IP). Select TCP, enter 443, click Add, then Save.

  2. Forward the port

    Go to Firewall → NAT → Destination NAT (Port Forward) and add a rule:

    • Interface: STATICIP
    • Version: IPv4
    • Protocol: TCP
    • Destination address: STATICIP address
    • Destination port: 443
    • Redirect target IP: 192.168.1.10
    • Redirect target port: 443
    • Firewall rule: Manual (Filter rule association: None). You add the rule yourself in the next step, so that you can set Reply-to on it.

    Click Save, then Apply.

  3. Let it in, and send replies back through the tunnel

    Go to Firewall → Rules, select the STATICIP interface and add a rule:

    • Action: Pass
    • Direction: in
    • Version: IPv4
    • Protocol: TCP
    • Source: any
    • Destination: 192.168.1.10, the server, not your static IP. OPNsense checks the rule after the port forward.
    • Destination port: 443
    • Reply-to: STATICIP_GW

    Leave Gateway at default. Click Save, then Apply changes.

    Reply-to is the step that is easy to miss. Default is not enough on this interface. Without it, the server's replies go out through your normal internet line, and the connection never completes.

  4. Check from outside

    On the dashboard, click the Open ports value again. Enter 443 in the box next to Port Test and click Port Test. TCP 443: open means our server reached your web server through the tunnel.

    To test it yourself, use a device outside your network, for example a phone on mobile data. A device on your LAN is not a good test.

Send LAN traffic out from your static IP

Without these steps, your LAN still goes out through your normal internet line. Skip them if you only need inbound. Use LAN net for the whole LAN, or one device's address.

  1. Translate LAN traffic to the tunnel address

    Go to Firewall → NAT → Source NAT (Outbound). Set the mode to Hybrid and click Save. Add a rule:

    • Interface: STATICIP
    • Version: IPv4
    • Protocol: any
    • Source: LAN net
    • Destination: any
    • Translation: Interface address

    Click Save, then Apply changes.

  2. Route that traffic into the tunnel

    Go to Firewall → Rules, select LAN and add a rule above the default rule that allows the LAN out:

    • Action: Pass
    • Source: LAN net
    • Destination: LAN net, with Invert on. Traffic to the router and to your LAN stays local.
    • Gateway: STATICIP_GW

    Click Save, then Apply changes.

  3. Check your static IP

    On a LAN device, open our open port checker. Your public IPv4 must be the IP on your dashboard.

If inbound traffic does not arrive

  • Capture on the tunnel address. Inbound traffic reaches OPNsense addressed to your tunnel address (the Address value), not to your static IP. In Interfaces → Diagnostics → Packet Capture, select STATICIP and filter on the port only. A filter on your static IP shows nothing.
  • Packets arrive, but the connection hangs: check Reply-to on the STATICIP rule.
  • Nothing arrives: make sure the port is open for that IP on the dashboard and the tunnel has a recent handshake. Click Test connection on the Devices tab.
  • The server gets the packets but does not answer: the service must listen on all interfaces (0.0.0.0) or on its LAN address. The server's own firewall must allow the port, and its default gateway must be OPNsense.

Still stuck? Ask on the Support tab of your dashboard. Tell us the port and what the capture shows.