IP-Mask

Step three sets up the WireGuard or L2TP client that conceals the Starlink IP.

Last updated Aug 14, 2026View as Markdown

Overview

The Starlink IP-mask VPN client step configures a single outbound VPN client on the Starlink uplink. The reasoning the wizard gives is plain: your use of Starlink can be traced back to your identity, so the panel routes that link through a VPN and the Starlink IP stops being the one the far end sees.

You pick one of two protocols with the tile picker, and the form below changes to match. WireGuard is marked recommended and takes a whole config file; L2TP takes a server address and credentials.

Before you start

  • For WireGuard: the .conf file from your provider, containing [Interface] and [Peer] sections.
  • For L2TP: the server address, username and password, plus the IPsec pre-shared secret if the server uses IPsec.
  • You have already chosen the Starlink interface in the WAN step.

Steps

WireGuard

  1. Select the WireGuard tile.
  2. Load the configuration one of three ways: press Upload Config and pick a .conf or .txt file, press Paste Config to read it from the clipboard, or paste the text straight into the box.
  3. The panel parses the config as soon as it is valid and fills in the private key, peer public key, endpoint, port and allowed IPs from it, while MTU and persistent keepalive too if the file sets them.
  4. Press Next.

L2TP

  1. Select the L2TP tile.
  2. Fill in Server, Username and Password.
  3. Turn on Use IPsec encryption if the server needs it, then fill in the IPsec secret field that appears.
  4. Press Next.

Reference

Protocol Description in the picker
WireGuard Fast, modern VPN with state-of-the-art cryptography. Marked as recommended.
L2TP Widely supported protocol with IPsec encryption.

L2TP fields

Field What it does Default
Server Address of the L2TP server. Required. empty
Username L2TP account name. Required. empty
Password L2TP account password. Required. empty
Use IPsec encryption Wraps the tunnel in IPsec. off
IPsec secret Pre-shared key. Required once IPsec is on. empty

Troubleshooting

“Invalid WireGuard config: missing [Interface] or [Peer] sections.” The text you pasted or uploaded is not a WireGuard configuration file. Check you copied the whole file.

“Cannot read from clipboard. Paste manually instead.” The browser refused clipboard access. Paste into the text box directly.

“Endpoint and port are required.” / “Peer public key is required.” The config parsed but was missing those values. Check the [Peer] section.

“L2TP server address is required.” / “L2TP credentials are required.” / “IPsec secret is required when IPsec encryption is enabled.” Fill in the named field.