Set up a Static IP User VPN for Whitelisting, with WireGuard and Netmaker

This guide is intended for IT administrators who want to route user traffic through a static IP address for whitelisting purposes.

Why this is useful:

Provide support staff with a single IP to whitelist on a customer firewall so support traffic can reach on-site services.
Give a customer a single outbound, whitelisted IP by installing the VPN client locally and routing outbound traffic through your endpoint.

Netmaker lets you deploy an endpoint and route all internet-bound traffic through it; that endpoint’s public IP is what you can whitelist on firewalls. Follow the steps below.

Log into your Netmaker dashboard

In your Netmaker dashboard (on-prem or cloud) you will see a Node already deployed. In the cloud version you select a region for your endpoint. On-prem, the server can act as an endpoint.

You can use the existing endpoint to route traffic, or deploy your own if you have a specific IP you want to use.

(optional) Deploy an endpoint

If you want to use a pre-existing IP, deploy the netclient on a device with that IP (note: must run Linux).

Click the “+Add device” button in the dashboard and follow the steps.

Set as Gateway to Internet

Once the node is visible in your dashboard, set it as a Gateway to route traffic from other VPN devices to the internet.

Navigate to the “Gateways” screen.
Click “+ Create Gateway” and select the node.
Make sure to enable “Set as Internet Gateway” and set a “Default client DNS” resolver (recommended: Google DNS 8.8.8.8 if unsure).

Invite Users

As an administrator, invite users to use the VPN:

Add their email addresses (or create usernames manually).
Grant them access to the platform. (If using Pro, you can enable IDP sync to join automatically.)
When inviting, select “Service Users” — this grants only the ability to use the VPN client.
Add them to the group with access to the network (typically “[network name] User Group”).
Click “Create User Invites”.