macOS & Windows

Both work, in full-tunnel mode. Read the warning first — it is the single most common way a first attempt fails.

Use a full tunnel here

A source-routing config uses Table = off and PostUp shell rules. Those are wg-quick features. The macOS and Windows apps have nowhere to run shell commands, so they read the file, find no routes to install, and stop before sending a single packet. The button returns to “Connect”, nothing is logged, and nothing reaches us.

It looks exactly like a blocked port. It is not. Create the tunnel in full tunnel mode and it will connect.

macOS

Install WireGuard from the Mac App Store, or brew install wireguard-tools for the command-line version.

In the app: Import tunnel(s) from file, choose your .conf, activate. Everything this Mac sends now leaves as your leased address.

With Homebrew instead, macOS has no /etc/wireguard by default:

sudo mkdir -p /usr/local/etc/wireguard
sudo install -m 600 anchoredip-42.conf /usr/local/etc/wireguard/aip0.conf
sudo wg-quick up aip0

Corporate device management often pins the default route — Cloudflare WARP under a Zero Trust policy is the common one, and it cannot be turned off from the machine. Any WireGuard tunnel needing the default route will spin for ever against it, with no packet ever sent. If a Mac is managed, test from a machine that is not.

Windows

Install the official client from wireguard.com/install, then Add Tunnel → Import from file and activate.

Or from an elevated PowerShell, as a service that survives reboots:

wireguard.exe /installtunnelservice C:\path\to\anchoredip-42.conf

The Windows client supports a split-tunnel of its own through AllowedIPs: replacing 0.0.0.0/0, ::/0 with your partner's prefixes sends only that traffic through us. That is a different mechanism from our source routing — it selects by destination rather than by source — but for “reach this one API from my address” it does the job.

AmneziaWG on a desktop

Use the AmneziaVPN client, which imports the same file. The obfuscation parameters travel in the config and must not be edited.

Verify

curl -s https://api.ipify.org

It should print your leased address. In a full tunnel there is nothing to bind — everything already goes through us. If it prints your own address, the tunnel is not actually up; check troubleshooting.