Setup Guide · 2 min read

How to set up WireGuard VPN, step by step

WireGuard is a fast, modern VPN protocol, and s4m hands you a ready-made config so you can connect in a few minutes. This guide walks you through setup on every major platform and shows how to confirm your origin IP is actually hidden.

Get started

Connect with s4m in five steps

The same flow works on desktop and mobile — only the import method differs.

Download your WireGuard config

Sign in to the s4m dashboard and open the VPN section. Choose a WireGuard endpoint and generate a config. You'll get a .conf file for desktop and a QR code for mobile. Each config embeds your private key, so treat it like a password and never share it.

Install the WireGuard client

Install the official WireGuard app for your platform: Windows and macOS from wireguard.com or the app stores, Linux via your package manager (the wireguard-tools package), and Android or iOS from Google Play or the App Store. Routers running OpenWrt or pfSense can run WireGuard too.

Import the .conf or scan the QR

On desktop, open WireGuard and choose Import tunnel(s) from file, then pick the .conf you downloaded. On Android or iOS, tap the plus button, choose Scan from QR code, and point your camera at the QR shown in the dashboard.

Activate the tunnel

Toggle the tunnel on. WireGuard performs a near-instant handshake and starts routing your traffic through the s4m endpoint. On mobile you'll see a VPN key icon in the status bar once the tunnel is up, and the app will show a recent handshake time.

Verify your real IP is hidden

Confirm the tunnel is actually carrying your traffic. Open an IP echo service such as api.ipify.org in a browser or from the terminal. It should return the s4m endpoint address, not your home or origin server IP. If your real IP still appears, the tunnel isn't active or split-tunneling is excluding your app.

Example config and IP check

A trimmed WireGuard config with placeholder values, plus the Linux CLI commands to bring it up and verify.

ini
# wg0.conf — download this from the s4m dashboard (VPN -> WireGuard)
[Interface]
PrivateKey = <your-private-key>      # keep this secret
Address    = 10.7.0.2/32
DNS        = 10.7.0.1

[Peer]
PublicKey           = <server-public-key>
Endpoint            = your-endpoint.s4m.online:51820
AllowedIPs          = 0.0.0.0/0, ::/0   # route all traffic through the tunnel
PersistentKeepalive = 25

# Linux CLI: bring the tunnel up
#   sudo wg-quick up ./wg0.conf
#
# Verify your public IP is now the s4m endpoint, not your own:
#   curl https://api.ipify.org

Why the tunnel hides your origin IP

When your WireGuard tunnel is active, every packet leaves your device encrypted and exits from the s4m VPN endpoint. Any third party you connect to — a website, an API, an attacker probing your service — sees that endpoint address, never your home connection or your origin server. That is the whole point: your real IP stays private while your traffic still reaches the internet normally.

WireGuard makes this practical because it is small, fast, and built on modern cryptography. The handshake is near-instant, reconnects survive network changes, and battery impact on mobile is minimal compared with older protocols. If you prefer OpenVPN, s4m supports it too, but WireGuard is the recommended default for most people.

A few things worth knowing:

  • No-logs by design. s4m runs a RAM-first architecture, so there is no persistent traffic history sitting on disk.
  • Flat monthly rate on paid VPN plans — no pay-per-GB metering on the tunnel itself. See pricing for the current tiers, including anonymous accounts.
  • Dedicated personal IP is an optional add-on: a static address that is yours alone and stays associated with your s4m account, bindable to the VPN or to a proxy.

Need to route just one app or script instead of the whole device? An authenticated SOCKS5 or HTTP proxy is often the better fit, and the free public proxy list is handy for quick, throwaway testing.

VPN, proxy, or the free list?

Not sure which product fits your task? Here's how the options compare.

WireGuard VPN

A full-tunnel VPN configuration can route device traffic through the tunnel. Split-tunnel exclusions may bypass it. Verify the issued routes, DNS and IPv6 behaviour for your setup.

Datacenter proxy

Authenticated SOCKS5 and HTTP endpoints for per-app or per-script routing. Metered, pay-as-you-go. These are datacenter IPs — fast and cost-effective, not residential.

Dedicated personal IP

Optional static IP that is yours alone, associated with your s4m account. Bind it to your VPN tunnel or to a proxy for a stable, private exit address.

Free proxy list

Third-party proxies harvested from open sources and continuously validated, filterable by country, protocol, and anonymity. Great for testing — use at your own risk.

FAQ

Questions, answered

My real IP still shows after connecting. What's wrong?

The tunnel probably isn't active, or split-tunneling is routing your browser around it. Toggle the tunnel off and on, confirm the WireGuard app shows a recent handshake, and make sure AllowedIPs is set to 0.0.0.0/0, ::/0 so all traffic goes through the tunnel. Then re-check api.ipify.org.

The handshake never completes. How do I fix it?

A stalled handshake usually means the UDP port is filtered by a firewall or a restrictive network. Confirm outbound UDP to the endpoint port is allowed, add PersistentKeepalive = 25 to keep the connection warm, and if UDP is blocked entirely, switch to the OpenVPN config or use a proxy instead.

Can I use the same config on multiple devices?

We recommend generating a separate config per device from the dashboard. Reusing one key set across devices can cause handshake conflicts and unexpected disconnects, and it makes it harder to revoke a single device without affecting the others.

Does the VPN keep logs of what I do?

No. s4m is no-logs by design and runs a RAM-first architecture, so there's no persistent record of your traffic. To be clear, this is about our infrastructure — the sites you visit can still set their own cookies and will see the endpoint IP you exit from.

Does WireGuard count against my usage?

Paid VPN plans include a flat monthly rate (not metered per-GB) on the tunnel, with no pay-per-GB metering like the datacenter proxies have. Admin-tunable limits do exist per account-type, per IP, and per account, so extreme usage may be shaped, but normal use is not metered.

Keep reading

You might also like

How to hide your real server IP address

Read →

What is a SOCKS5 proxy?

Read →

How to use proxies for web scraping

Read →

How to check if a proxy is anonymous

Read →

Ready to hide your real IP?

Create an s4m account and activate a paid VPN plan with a fixed monthly rate. Then download a WireGuard configuration and connect. A dedicated personal IP is optional if you need a stable exit address.

Get your WireGuard configSee pricing

People found this page by searching for

Real search phrases this page answers — the linked ones open the page that covers them in depth.