Plus
$2/mo
- 1 dedicated IP address
- 10 devices
- 5 open ports
- 100 GBbandwidth
- 20 Mbpsspeed
GetAStatic gives you your own dedicated static IP over WireGuard, starting at $2/month. Your internet traffic uses that IP, and you can open ports to make your device accessible from anywhere, even behind CGNAT.
Updated
WireGuard makes a tunnel between two peers. It does not give you an address. Your traffic leaves from the IP of the other peer. If that peer is your home router behind CGNAT, nobody outside can reach it.
So most guides tell you to rent a VPS, run WireGuard on it and write NAT rules that send its public IP down the tunnel. That works, but the server, the rules and the patching are yours (build or buy). VPN providers that sell WireGuard usually share each exit IP between many users and give no inbound ports.
Plus for light use, Pro for most people, Ultra for full gigabit.
5× speed · 10× bandwidth · 2 IPs — only $2/mo more
Pricing based on crypto.
Address is a private tunnel address (a 10.x address with /32). Our server maps your public static IPv4 to it one-to-one. Traffic that you send leaves from your public IP, and connections to an open port on that IP arrive at this address. A service must listen on all interfaces (0.0.0.0) or on the tunnel address.
AllowedIPs = 0.0.0.0/0 sends all of the device's traffic through the tunnel. Because of this, every app on the device uses your static IP, and replies to people who connect to you go back out the correct way.
Endpoint is our server on UDP 1194. If a network blocks that port, use the same tunnel on UDP 443: on the dashboard, click "Trouble connecting?" and select Port 443. PersistentKeepalive = 25 sends a small packet every 25 seconds. This keeps the tunnel open behind NAT, CGNAT and Starlink, so inbound connections can reach you at any time.
Some configs also have a DNS line that resolves names through the tunnel. Without it, the device keeps its own resolver.
If a network blocks WireGuard itself (with deep packet inspection in some countries, and on some hotel, school and mobile networks), switch the IP to AmneziaWG on the dashboard. It is free on every plan and keeps the same IP and open ports. It needs the AmneziaWG app. See WireGuard blocked.
One config runs on one device or router at a time; on a router, every device behind it shares the IP. See a static IP on your router.
Example: a Linux server that hosts a website and SSH.
[Interface] PrivateKey = <your private key> Address = 10.x.x.x/32 [Peer] PublicKey = <server public key> AllowedIPs = 0.0.0.0/0 Endpoint = <server>:1194 PersistentKeepalive = 25
Plus lets you open 5 open ports per IP. Pro and Ultra have unlimited open ports. Use TCP or UDP, single ports or ranges. A range counts as its size. You open them in the dashboard, with no ticket, and ping always answers.
No. Address is a private tunnel address. Our server maps your public static IPv4 to it. The dashboard shows your public IP, and any what-is-my-IP site shows it when the tunnel is on.
None at first. Every new IP starts with all inbound ports closed. You open TCP or UDP ports, or ranges, in the dashboard, with no ticket. Plus allows 5 open ports; Pro and Ultra have unlimited open ports. Open ports never change your outbound traffic.
Yes. It is a standard WireGuard config. It works in the official WireGuard apps, with wg-quick on Linux, and on OpenWrt, GL.iNet, pfSense, OPNsense and MikroTik. AmneziaWG has apps for iPhone, Mac, Android and Windows, but less router support.
Yes. It is a WireGuard VPN that exits from your own dedicated IP, not from an IP shared with other users. It is built for a stable address, not anonymity.
First, get the Port 443 version of your config: on the Devices tab, click "Trouble connecting?" and select Port 443. If it still does not connect, switch that IP to AmneziaWG and use the AmneziaWG app.
Have more questions? See the full FAQ →