Documentation

AnchoredIP leases you a dedicated IPv4 address out of AS41800 and delivers it to machines you already run, over a WireGuard tunnel. Nothing moves and nothing is hosted here — you install one configuration file and your traffic starts leaving the internet as your address.

The model in one picture

Three things exist: a lease, which is your right to a set of addresses for a period; one or more tunnels, each being one machine of yours; and the edge, our router in Karaganda that holds your address and speaks WireGuard.

your server ──WireGuard──▶  edge (AS41800)  ──▶  internet
  10.128.4.7                194.0.108.64          seen as 194.0.108.64

your CI runner ──WireGuard──▶      ▲
  10.128.4.8                        │  same lease, same identity

The address is not tied to a machine. Every machine on the lease leaves the internet as the same address, so a partner allowlists one entry and you scale behind it without asking them again. One machine per lease can additionally receive connections on the address — see use cases.

The one decision that matters

Every tunnel is created in one of two routing modes, and picking the wrong one is the most common way a first attempt fails.

Mode	What goes through us	Where it runs
source	Only traffic whose source is a leased address. Your default route, your SSH session and everything else are untouched.	Linux with `wg-quick` only.
full	Everything the machine sends. Simple, and it will move your SSH session too.	Any client, any platform.

A source-routing config will not work in a graphical client. It is written with Table = off and PostUp rules, which are wg-quick features. A desktop or phone app has nowhere to run shell commands, so it reads the file, finds no routes to install, and gives up before sending a packet — with nothing in any log. That looks exactly like a blocked port, and it is not. On macOS, Windows or a phone, create a full tunnel.

Transports

WireGuard on UDP 51820 is the default and what you want unless something is filtering it.

AmneziaWG on UDP 51821 is the same cryptography with the handshake obfuscated, for networks whose deep packet inspection recognises WireGuard by the fixed 148-byte handshake and drops it. It needs an AmneziaWG client — a stock WireGuard client discards the obfuscated packets as malformed and neither end logs anything.

Where to go next

What this is not

Not a VPN for browsing, not a proxy pool, and not a residential-IP service. It is one fixed identity you control, for machines that talk to partners who filter by address. The acceptable use policy says the same thing in the language of what gets you suspended.

Traffic takes a detour to Kazakhstan and back. For allowlisted API calls a few times a minute that is invisible; for a chatty protocol between two continents it is not. Source routing exists so that only the traffic that needs the address pays that cost.