# IP-Mask

> Step three sets up the WireGuard or L2TP client that conceals the Starlink IP.

Source: https://joinnasnet.com/en/guides/nasnet-panel/easy-config/ip-mask/
Last updated: 2026-08-14

---

## Overview

The **Starlink IP-mask VPN client** step configures a single outbound VPN
client on the Starlink uplink. The reasoning the wizard gives is plain: your
use of Starlink can be traced back to your identity, so the panel routes that
link through a VPN and the Starlink IP stops being the one the far end sees.

You pick one of two protocols with the tile picker, and the form below changes
to match. WireGuard is marked recommended and takes a whole config file;
L2TP takes a server address and credentials.

## Before you start

- For WireGuard: the `.conf` file from your provider, containing `[Interface]`
  and `[Peer]` sections.
- For L2TP: the server address, username and password, plus the IPsec
  pre-shared secret if the server uses IPsec.
- You have already chosen the Starlink interface in the
  [WAN step](/en/guides/nasnet-panel/easy-config/wan/).

## Steps

### WireGuard

1. Select the **WireGuard** tile.
2. Load the configuration one of three ways: press **Upload Config** and pick a
   `.conf` or `.txt` file, press **Paste Config** to read it from the
   clipboard, or paste the text straight into the box.
3. The panel parses the config as soon as it is valid and fills in the private
   key, peer public key, endpoint, port and allowed IPs from it, while MTU and
   persistent keepalive too if the file sets them.
4. Press **Next**.

### L2TP

1. Select the **L2TP** tile.
2. Fill in **Server**, **Username** and **Password**.
3. Turn on **Use IPsec encryption** if the server needs it, then fill in the
   **IPsec secret** field that appears.
4. Press **Next**.

## Reference

| Protocol | Description in the picker |
| -------- | ------------------------- |
| **WireGuard** | Fast, modern VPN with state-of-the-art cryptography. Marked as recommended. |
| **L2TP** | Widely supported protocol with IPsec encryption. |

### L2TP fields

| Field | What it does | Default |
| ----- | ------------ | ------- |
| **Server** | Address of the L2TP server. Required. | empty |
| **Username** | L2TP account name. Required. | empty |
| **Password** | L2TP account password. Required. | empty |
| **Use IPsec encryption** | Wraps the tunnel in IPsec. | off |
| **IPsec secret** | Pre-shared key. Required once IPsec is on. | empty |

## Troubleshooting

**"Invalid WireGuard config: missing [Interface] or [Peer] sections."** The
text you pasted or uploaded is not a WireGuard configuration file. Check you
copied the whole file.

**"Cannot read from clipboard. Paste manually instead."** The browser refused
clipboard access. Paste into the text box directly.

**"Endpoint and port are required." / "Peer public key is required."** The
config parsed but was missing those values. Check the `[Peer]` section.

**"L2TP server address is required." / "L2TP credentials are required." /
"IPsec secret is required when IPsec encryption is enabled."** Fill in the
named field.

## Related

- [WiFi](/en/guides/nasnet-panel/easy-config/wifi/)
- [Internet](/en/guides/nasnet-panel/internet/)