[{"data":1,"prerenderedAt":1010},["ShallowReactive",2],{"content-index":3,"doc-en-macos":80},{"en":4,"de":54,"es":67},{"paths":5,"docs":29},[6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28],"\u002Fdocs\u002Fgetting-started","\u002Fdocs\u002Flinux","\u002Fdocs\u002Fmacos","\u002Fdocs\u002Fwindows","\u002Fdocs\u002Fdocker","\u002Fdocs\u002Fcreate-api-key","\u002Fguides\u002Ffind-your-public-ip-address\u002Ffind-your-ip-address-on-linux","\u002Fguides\u002Ffind-your-public-ip-address\u002Ffind-your-ip-address-on-mac","\u002Fguides\u002Ffind-your-public-ip-address\u002Ffind-your-ip-address-on-windows","\u002Fguides\u002Ffind-your-public-ip-address","\u002Fguides\u002Fself-hosting\u002Fdocker-desktop-mac-client-ip","\u002Fguides\u002Fself-hosting\u002Fexpose-docker-containers-to-the-internet","\u002Fguides\u002Fself-hosting\u002Fexpose-home-server-to-internet","\u002Fguides\u002Fself-hosting\u002Fgetpublicip-vs-cloudflare-tunnel-vs-tailscale","\u002Fguides\u002Fself-hosting\u002Fmac-mini-home-server","\u002Fguides\u002Fself-hosting\u002Fport-forwarding-not-working","\u002Fguides\u002Fself-hosting\u002Fself-hosting-behind-carrier-grade-nat-cgnat","\u002Fguides\u002Fself-hosting\u002Fwireguard-simple-watchdog-script","\u002Fguides\u002Fstatic-public-ip-address\u002Fhow-to-get-a-public-ip-address","\u002Fguides\u002Fstatic-public-ip-address\u002Fhow-to-get-a-static-ip-address","\u002Fguides\u002Fstatic-public-ip-address","\u002Fguides\u002Fuse-cases\u002Fhome-server","\u002Fguides\u002Fuse-cases\u002Foffice-server",[30,34,38,42,46,50],{"path":6,"title":31,"icon":32,"stem":33},"Getting Started","mdi-file-document-outline","docs\u002F1.getting-started",{"path":7,"title":35,"icon":36,"stem":37},"Linux","mdi-linux","docs\u002F2.linux",{"path":8,"title":39,"icon":40,"stem":41},"macOS","mdi-apple","docs\u002F3.macos",{"path":9,"title":43,"icon":44,"stem":45},"Windows","mdi-microsoft-windows","docs\u002F3.windows",{"path":10,"title":47,"icon":48,"stem":49},"Docker","mdi-docker","docs\u002F4.docker",{"path":11,"title":51,"icon":52,"stem":53},"Create API Key","mdi-key","docs\u002F5.create-api-key",{"paths":55,"docs":58},[6,7,8,9,10,11,12,14,15,56,17,18,57,19,21,22,24,25,26,27,28],"\u002Fguides\u002Fself-hosting\u002Fdyndns-hinter-cgnat","\u002Fguides\u002Fself-hosting\u002Ffritzbox-portfreigabe-ds-lite",[59,61,62,63,64,65],{"path":6,"title":60,"icon":32,"stem":33},"Erste Schritte",{"path":7,"title":35,"icon":36,"stem":37},{"path":8,"title":39,"icon":40,"stem":41},{"path":9,"title":43,"icon":44,"stem":45},{"path":10,"title":47,"icon":48,"stem":49},{"path":11,"title":66,"icon":52,"stem":53},"API-Schlüssel erstellen",{"paths":68,"docs":71},[6,7,8,9,10,11,12,14,15,69,70,17,18,19,21,22,24,25,26,27,28],"\u002Fguides\u002Fself-hosting\u002Fcomo-saber-si-tengo-cgnat","\u002Fguides\u002Fself-hosting\u002Fddns-detras-de-cgnat",[72,74,75,76,77,78],{"path":6,"title":73,"icon":32,"stem":33},"Primeros pasos",{"path":7,"title":35,"icon":36,"stem":37},{"path":8,"title":39,"icon":40,"stem":41},{"path":9,"title":43,"icon":44,"stem":45},{"path":10,"title":47,"icon":48,"stem":49},{"path":11,"title":79,"icon":52,"stem":53},"Crear clave API",{"id":81,"title":82,"body":83,"createdAt":1001,"description":1002,"extension":1003,"faq":1004,"meta":1005,"navigation":1006,"path":8,"seo":1007,"stem":41,"updatedAt":1008,"__hash__":1009},"content_en\u002Fdocs\u002F3.macos.md","Set Up a Public IP on macOS",{"type":84,"value":85,"toc":980},"minimark",[86,90,94,108,111,116,121,155,159,162,202,205,209,215,229,232,236,239,246,252,263,267,293,299,302,309,316,361,364,370,374,380,385,392,396,411,414,417,421,424,448,452,466,470,473,479,483,498,504,507,511,514,521,528,532,547,553,600,603,674,681,685,692,696,713,734,738,745,748,789,795,809,812,816,838,842,849,901,904,907,918,930,943,955,961,970,976],[87,88,39],"h1",{"id":89},"macos",[91,92,93],"p",{},"GetPublicIP for Mac connects your Mac to your public IP address. It downloads its configuration for you, lets you manage your port mappings from the app, and keeps itself in step with your dashboard. It runs on macOS 15 Sequoia or later, on Apple silicon and Intel Macs.",[95,96,97],"blockquote",{},[91,98,99,100,107],{},"This app is in beta. If something doesn't work, ",[101,102,106],"a",{"className":103,"href":105},[104],"link","\u002Fcontact-us","contact us"," and tell us what happened.",[109,110],"docs-toc",{},[112,113,115],"h2",{"id":114},"getpublicip-for-mac-beta","GetPublicIP for Mac (Beta)",[117,118,120],"h3",{"id":119},"download-and-install","Download and install",[122,123,124,135,148],"ol",{},[125,126,127,128,134],"li",{},"Download ",[101,129,133],{"href":130,"rel":131},"https:\u002F\u002Frepo.getpublicip.com\u002Fmac\u002FGetPublicIP.dmg",[132],"nofollow","GetPublicIP.dmg",".",[125,136,137,138,141],{},"Open it and drag GetPublicIP into the Applications folder. It has to run from there: macOS only runs network extensions for apps in Applications.",[139,140],"br",{},[142,143],"img",{"alt":144,"quality":145,"src":146,"width":147},"The GetPublicIP disk image, with an arrow from the GetPublicIP app to the Applications folder","80","\u002Fimages\u002Fmac-client\u002Fclient-install.png",560,[125,149,150,151,134],{},"Open GetPublicIP from Applications. The app is signed by GetPublicIP Limited and notarized by Apple. macOS asks once whether to open an app downloaded from the internet: click ",[152,153,154],"code",{},"Open",[117,156,158],{"id":157},"allow-the-network-extension","Allow the network extension",[91,160,161],{},"The tunnel runs as a network extension, which macOS asks you to approve once. Until you do, the app shows the steps at the top of its window:",[122,163,164,171,177,187,190],{},[125,165,166,167,170],{},"Click ",[152,168,169],{},"Open System Settings",". It opens General › Login Items & Extensions.",[125,172,173,174,134],{},"Scroll down to Extensions and click ",[152,175,176],{},"By Category",[125,178,179,180,182],{},"Click the Info button (ⓘ) next to Network Extensions.",[139,181],{},[142,183],{"alt":184,"quality":145,"src":185,"width":186},"System Settings' Extensions section, with arrows to By Category and to the Info button next to Network Extensions","\u002Fimages\u002Fmac-client\u002Fclient-extension-category.png",480,[125,188,189],{},"Turn on the switch next to GetPublicIP. GetPublicIP Tunnel is written under its name.",[125,191,166,192,134,195,197],{},[152,193,194],{},"Done",[139,196],{},[142,198],{"alt":199,"quality":145,"src":200,"width":201},"The Network Extensions sheet, with arrows to the switch next to GetPublicIP and to the Done button","\u002Fimages\u002Fmac-client\u002Fclient-extension-switch.png",471,[91,203,204],{},"The tunnel can't connect until the extension is on.",[117,206,208],{"id":207},"sign-in-with-your-api-key","Sign in with your API key",[91,210,211,212,134],{},"The app signs in with the API key of the IP address you want to use. If you don't have one yet, see ",[101,213,214],{"href":11},"Create an API Key",[122,216,217,223],{},[125,218,219,220,134],{},"Paste your API key into the app and click ",[152,221,222],{},"Sign In",[125,224,225,226,134],{},"The first time, macOS asks to allow GetPublicIP's VPN configuration: click ",[152,227,228],{},"Allow",[91,230,231],{},"The app downloads the address's configuration and connects. There's no config file to import.",[117,233,235],{"id":234},"status-tab","Status tab",[91,237,238],{},"The Status tab shows your IP address's name, its public IPv4 and IPv6 addresses, its location and status, the tunnel's latest handshake and the traffic sent and received.",[91,240,241],{},[142,242],{"alt":243,"quality":145,"src":244,"width":245},"The Status tab while connected, showing the IP address's name, public IPv4 and IPv6 addresses, location and status, the outbound traffic mode and the Check button, and the traffic counters","\u002Fimages\u002Fmac-client\u002Fclient-status.png",700,[91,247,166,248,251],{},[152,249,250],{},"Check"," to see which address your Mac's traffic is leaving from right now. In Full tunnel it's your GetPublicIP address; in Split tunnel it's your normal connection's.",[91,253,254,255,258,259,134],{},"If the tunnel is up but nothing has come back from our server for over three minutes, the tab says ",[152,256,257],{},"No response from the server",". See ",[101,260,262],{"href":261},"#troubleshooting","Troubleshooting",[117,264,266],{"id":265},"port-mappings-tab","Port Mappings tab",[91,268,269,270,273,274,277,278,281,282,285,286,289,290,134],{},"Use ",[152,271,272],{},"Add…",", ",[152,275,276],{},"Edit…"," and ",[152,279,280],{},"Remove"," to manage your port mappings, then click ",[152,283,284],{},"Save",". ",[152,287,288],{},"Revert"," discards changes you haven't saved. While our server applies a change, the tab shows ",[152,291,292],{},"Applying changes on the server…",[91,294,295],{},[142,296],{"alt":297,"quality":145,"src":298,"width":245},"The Port Mappings tab with three mappings, the Listening on this Mac column, and the note about ports below 1024","\u002Fimages\u002Fmac-client\u002Fclient-mappings.png",[91,300,301],{},"Each mapping has a public port, an internal port, a protocol, an IP version, an allowed source and a comment. Leave the internal port empty to use the same port as the public one, and leave the allowed source empty to accept connections from any address.",[91,303,304],{},[142,305],{"alt":306,"quality":145,"src":307,"width":308},"The dialog for adding a port mapping, with fields for the public port, the port on this Mac, protocol, IP version, allowed source and comment","\u002Fimages\u002Fmac-client\u002Fclient-mapping-add.png",440,[91,310,311,312,315],{},"The ",[152,313,314],{},"Listening"," column checks whether something on your Mac accepts connections on each internal port:",[317,318,319,325,338,349,355],"ul",{},[125,320,321,324],{},[152,322,323],{},"listening on all addresses",": forwarded connections can reach it.",[125,326,327,330,331,277,334,337],{},[152,328,329],{},"only on 127.0.0.1 or ::1, which forwarded connections never reach",": the program only accepts connections from this Mac. Set it to listen on all addresses (",[152,332,333],{},"0.0.0.0",[152,335,336],{},"::",").",[125,339,340,343,344,277,346,348],{},[152,341,342],{},"in use",": for ports below 1024. Something on your Mac is using the port, but macOS doesn't let the app check which address it listens on, and a note under the table says so. Forwarded connections reach it only if it listens on all addresses (",[152,345,333],{},[152,347,336],{},"). Docker Desktop does; for anything else, check its settings.",[125,350,351,354],{},[152,352,353],{},"nothing listening",": start the program, or check that its port matches the internal port.",[125,356,357,360],{},[152,358,359],{},"connect to check",": the tunnel is off, so there's nothing to check against yet.",[91,362,363],{},"macOS doesn't let sandboxed apps like this one list open sockets, so the column can't name the program the way GetPublicIP for Windows does.",[91,365,366,367,369],{},"There are no firewall rules to add. The macOS firewall is off unless you've turned it on, and it works per app, not per port. See ",[101,368,262],{"href":261}," if it's on.",[117,371,373],{"id":372},"connection-tab","Connection tab",[91,375,376],{},[142,377],{"alt":378,"quality":145,"src":379,"width":245},"The Connection tab, showing the Outbound traffic, DNS, When to connect and API key sections","\u002Fimages\u002Fmac-client\u002Fclient-connection.png",[381,382,384],"h4",{"id":383},"when-to-connect","When to connect",[91,386,387,388,391],{},"With ",[152,389,390],{},"Reconnect automatically"," on, macOS keeps the tunnel up after a restart, sleep or a change of network, even while GetPublicIP is closed. Turning the tunnel off by hand stops this until you connect again.",[381,393,395],{"id":394},"outbound-traffic","Outbound traffic",[317,397,398,405],{},[125,399,400,404],{},[401,402,403],"strong",{},"Full tunnel: send all traffic through my GetPublicIP address."," Everything your Mac sends leaves from your GetPublicIP address. This is the default.",[125,406,407,410],{},[401,408,409],{},"Split tunnel: use my normal connection for outbound traffic."," Browsing, updates and other outbound traffic use your own connection.",[91,412,413],{},"In both modes, connections to your port mappings arrive through GetPublicIP, and their replies go back the same way. Switching modes restarts the tunnel.",[91,415,416],{},"There's no kill switch on the Mac. The one macOS provides for VPN apps drops incoming TCP connections after their first packet, which would break every TCP port mapping.",[381,418,420],{"id":419},"dns-servers","DNS servers",[91,422,423],{},"This setting only applies in Full tunnel. Split tunnel always uses your network's DNS servers.",[317,425,426,432,438],{},[125,427,428,431],{},[401,429,430],{},"Cloudflare public DNS",": the default.",[125,433,434,437],{},[401,435,436],{},"My network's DNS servers",": lookups use your network's servers and leave outside the tunnel.",[125,439,440,443,444,447],{},[401,441,442],{},"Custom",": enter up to three public DNS servers per IP version, then click ",[152,445,446],{},"Apply",". A local DNS server, such as a Pi-hole or your router, can't be used here.",[381,449,451],{"id":450},"api-key","API key",[317,453,454,460],{},[125,455,456,459],{},[401,457,458],{},"Download Configuration Again",": fetch a fresh copy of the configuration, if our support asks you to.",[125,461,462,465],{},[401,463,464],{},"Sign Out…",": disconnect, and remove the configuration and the API key from this Mac. Your IP address and its port mappings stay as they are.",[117,467,469],{"id":468},"log-tab","Log tab",[91,471,472],{},"The Log tab lists what the tunnel has been doing, such as connecting and handshakes with our server.",[91,474,475],{},[142,476],{"alt":477,"quality":145,"src":478,"width":245},"The Log tab, listing timestamped tunnel messages","\u002Fimages\u002Fmac-client\u002Fclient-log.png",[117,480,482],{"id":481},"support-tab","Support tab",[91,484,485,486,489,490,493,494,497],{},"If something isn't working, click ",[152,487,488],{},"Create Report",", then ",[152,491,492],{},"Copy Report",", and paste it into your message to ",[101,495,106],{"className":496,"href":105},[104],". The report covers the tunnel, your port mappings and what's listening on them, your DNS, other VPNs, your network routes and the recent log.",[91,499,500],{},[142,501],{"alt":502,"quality":145,"src":503,"width":245},"The Support tab with a report, showing its summary and the tunnel's status","\u002Fimages\u002Fmac-client\u002Fclient-support.png",[91,505,506],{},"It includes your Mac's IP addresses and network settings. It never includes your API key or the tunnel's private key.",[117,508,510],{"id":509},"menu-bar","Menu bar",[91,512,513],{},"The GetPublicIP icon in the menu bar shows whether the tunnel is connected and gives you your public addresses, the tunnel switch and the app's window. The tunnel keeps running when you quit GetPublicIP. Settings › General decides whether the app opens at login and whether it appears in the menu bar, the Dock or both.",[91,515,516],{},[142,517],{"alt":518,"quality":145,"src":519,"width":520},"The GetPublicIP menu bar menu, with the connection status, the tunnel switch and both public addresses","\u002Fimages\u002Fmac-client\u002Fclient-menubar.png",300,[91,522,523],{},[142,524],{"alt":525,"quality":145,"src":526,"width":527},"Settings › General, with the options for opening at login and showing GetPublicIP in the Dock and the menu bar","\u002Fimages\u002Fmac-client\u002Fclient-settings.png",450,[117,529,531],{"id":530},"command-line","Command line",[91,533,534,535,538,539,542,543,546],{},"GetPublicIP for Mac includes a ",[152,536,537],{},"getpublicip"," command that uses the same commands as the Linux client. It's off until you turn it on in Settings › General › Command line › ",[152,540,541],{},"Allow the getpublicip command",". Settings shows the command that links it onto your ",[152,544,545],{},"PATH",":",[91,548,549],{},[142,550],{"alt":551,"quality":145,"src":552,"width":527},"Settings › General, with the Updates section and the Command line section's switch and install command","\u002Fimages\u002Fmac-client\u002Fclient-settings-command-line.png",[554,555,560],"pre",{"className":556,"code":557,"language":558,"meta":559,"style":559},"language-bash shiki shiki-themes monokai","sudo mkdir -p \u002Fusr\u002Flocal\u002Fbin && sudo ln -sf \"\u002FApplications\u002FGetPublicIP.app\u002FContents\u002FHelpers\u002Fgetpublicip\" \u002Fusr\u002Flocal\u002Fbin\u002Fgetpublicip\n","bash","",[152,561,562],{"__ignoreMap":559},[563,564,567,571,575,579,582,586,588,591,594,597],"span",{"class":565,"line":566},"line",1,[563,568,570],{"class":569},"sHkqI","sudo",[563,572,574],{"class":573},"s_Ekj"," mkdir",[563,576,578],{"class":577},"s7s5_"," -p",[563,580,581],{"class":573}," \u002Fusr\u002Flocal\u002Fbin",[563,583,585],{"class":584},"sCdxs"," && ",[563,587,570],{"class":569},[563,589,590],{"class":573}," ln",[563,592,593],{"class":577}," -sf",[563,595,596],{"class":573}," \"\u002FApplications\u002FGetPublicIP.app\u002FContents\u002FHelpers\u002Fgetpublicip\"",[563,598,599],{"class":573}," \u002Fusr\u002Flocal\u002Fbin\u002Fgetpublicip\n",[91,601,602],{},"Some commands:",[554,604,606],{"className":556,"code":605,"language":558,"meta":559,"style":559},"getpublicip status              # the address, the tunnel and where your traffic leaves from\ngetpublicip up --mode split     # connect in split tunnel\ngetpublicip ports               # forwarded ports and what listens behind each one\ngetpublicip ports add 8443      # forward TCP 8443 on IPv4 and IPv6\ngetpublicip doctor              # check the install, the tunnel, the firewall and every port\n",[152,607,608,619,636,647,663],{"__ignoreMap":559},[563,609,610,612,615],{"class":565,"line":566},[563,611,537],{"class":569},[563,613,614],{"class":573}," status",[563,616,618],{"class":617},"snpHw","              # the address, the tunnel and where your traffic leaves from\n",[563,620,622,624,627,630,633],{"class":565,"line":621},2,[563,623,537],{"class":569},[563,625,626],{"class":573}," up",[563,628,629],{"class":577}," --mode",[563,631,632],{"class":573}," split",[563,634,635],{"class":617},"     # connect in split tunnel\n",[563,637,639,641,644],{"class":565,"line":638},3,[563,640,537],{"class":569},[563,642,643],{"class":573}," ports",[563,645,646],{"class":617},"               # forwarded ports and what listens behind each one\n",[563,648,650,652,654,657,660],{"class":565,"line":649},4,[563,651,537],{"class":569},[563,653,643],{"class":573},[563,655,656],{"class":573}," add",[563,658,659],{"class":577}," 8443",[563,661,662],{"class":617},"      # forward TCP 8443 on IPv4 and IPv6\n",[563,664,666,668,671],{"class":565,"line":665},5,[563,667,537],{"class":569},[563,669,670],{"class":573}," doctor",[563,672,673],{"class":617},"              # check the install, the tunnel, the firewall and every port\n",[91,675,676,677,680],{},"The command asks for no confirmation. While it's on, any program running as you can use it to connect, disconnect, change your port mappings or sign out. Turn it on only if you use it. It never takes the API key as an argument: ",[152,678,679],{},"getpublicip login"," asks for it.",[117,682,684],{"id":683},"updates","Updates",[91,686,687,688,691],{},"The app checks for updates by itself and shows you when one is ready to install. The Updates section in Settings sets what happens when a new version is out, and ",[152,689,690],{},"Check Now"," checks straight away.",[117,693,695],{"id":694},"uninstall","Uninstall",[122,697,698,704,710],{},[125,699,700,701,703],{},"In the Connection tab, click ",[152,702,464],{},". This removes the configuration and the API key from your Mac.",[125,705,706,707,709],{},"Open System Settings › General › Login Items & Extensions. Under Extensions, choose By Category and click the Info button (ⓘ) next to Network Extensions. Click the actions button (…) next to GetPublicIP's switch and choose Delete Extension. Click ",[152,708,695],{},", then enter your Mac's password.",[125,711,712],{},"Quit GetPublicIP from its menu bar icon, then move it from Applications to the Trash.",[91,714,715,716,721,722,725,726,729,730,733],{},"macOS is meant to remove an app's network extension when the app goes to the Trash, but macOS 15.3 and macOS 26 were both ",[101,717,720],{"href":718,"rel":719},"https:\u002F\u002Fobdev.at\u002Fblog\u002Fdeletion-impossible-2\u002F",[132],"reported to leave it behind",", so step 2 removes it first. To check, run ",[152,723,724],{},"systemextensionsctl list"," in Terminal. If a ",[152,727,728],{},"com.getpublicip.mac"," line still says ",[152,731,732],{},"[activated enabled]",", the extension is still installed.",[112,735,737],{"id":736},"docker-desktop","Docker Desktop",[91,739,740,741,744],{},"If your service runs in a container in Docker Desktop, it sees every visitor as ",[152,742,743],{},"192.168.65.1"," instead of their real address. Your logs show only that address, and anything that acts on a visitor's address inside the container sees one visitor: rate limits, fail2ban and CrowdSec, geo-blocking, and allowlists.",[91,746,747],{},"The tunnel isn't the cause. In our test on 3 November 2026 (Docker Desktop 4.96.3, nginx behind a TCP port mapping), the Mac and the container saw the same request differently:",[749,750,751,764],"table",{},[752,753,754],"thead",{},[755,756,757,761],"tr",{},[758,759,760],"th",{},"Where",[758,762,763],{},"Address seen for the visitor",[765,766,767,780],"tbody",{},[755,768,769,777],{},[770,771,772,773,776],"td",{},"The Mac (",[152,774,775],{},"lsof -iTCP:80",")",[770,778,779],{},"the visitor's real address",[755,781,782,785],{},[770,783,784],{},"nginx in the container",[770,786,787],{},[152,788,743],{},[91,790,791,792,794],{},"Docker Desktop runs containers in a Linux virtual machine. A Docker process on your Mac holds each published port, accepts the connection and opens a new one into the virtual machine, so the visitor's address is gone before the container sees anything. ",[152,793,743],{}," is Docker's own gateway inside that machine.",[91,796,797,798,803,804,337],{},"No Docker Desktop setting changes this. Docker's request to keep the address, ",[101,799,802],{"href":800,"rel":801},"https:\u002F\u002Fgithub.com\u002Fdocker\u002Froadmap\u002Fissues\u002F157",[132],"docker\u002Froadmap#157",", has been open since 2020. OrbStack has the same limitation (",[101,805,808],{"href":806,"rel":807},"https:\u002F\u002Fgithub.com\u002Forbstack\u002Forbstack\u002Fissues\u002F710",[132],"orbstack#710",[91,810,811],{},"A mapping's allowed source still works, because our server applies it before the traffic reaches your Mac.",[117,813,815],{"id":814},"what-to-do-instead","What to do instead",[317,817,818,824],{},[125,819,820,823],{},[401,821,822],{},"Run the service on macOS itself",", outside Docker. A program listening on your Mac sees each visitor's real address over IPv4 and IPv6, for TCP and UDP.",[125,825,826,829,830,833,834,837],{},[401,827,828],{},"Put a reverse proxy on your Mac, in front of the container."," Run it directly on macOS (from Homebrew, for example), point your port mapping's internal port at it, and have it forward to the container. For websites, the proxy passes the visitor's address in the ",[152,831,832],{},"X-Forwarded-For"," header; set your app to trust that header from the proxy only. For other TCP services, some proxies, HAProxy among them, can pass it with the PROXY protocol, if the service in the container accepts it. Publish the container's port on ",[152,835,836],{},"127.0.0.1"," only, so nothing can reach it without going through the proxy. This doesn't help UDP.",[117,839,841],{"id":840},"publish-on-ipv4-and-ipv6","Publish on IPv4 and IPv6",[91,843,844,845,848],{},"A port published with an address, such as ",[152,846,847],{},"\"0.0.0.0:80:80\"",", makes Docker Desktop listen on IPv4 only, so the IPv6 half of your port mapping is refused. Leave the address out to publish on both:",[554,850,854],{"className":851,"code":852,"language":853,"meta":559,"style":559},"language-yaml shiki shiki-themes monokai","services:\n  web:\n    image: nginx:stable-alpine\n    ports:\n      - \"80:80\"        # IPv4 and IPv6. \"0.0.0.0:80:80\" would be IPv4 only\n","yaml",[152,855,856,865,872,883,890],{"__ignoreMap":559},[563,857,858,862],{"class":565,"line":566},[563,859,861],{"class":860},"s8I7P","services",[563,863,864],{"class":584},":\n",[563,866,867,870],{"class":565,"line":621},[563,868,869],{"class":860},"  web",[563,871,864],{"class":584},[563,873,874,877,880],{"class":565,"line":638},[563,875,876],{"class":860},"    image",[563,878,879],{"class":584},": ",[563,881,882],{"class":573},"nginx:stable-alpine\n",[563,884,885,888],{"class":565,"line":649},[563,886,887],{"class":860},"    ports",[563,889,864],{"class":584},[563,891,892,895,898],{"class":565,"line":665},[563,893,894],{"class":584},"      - ",[563,896,897],{"class":573},"\"80:80\"",[563,899,900],{"class":617},"        # IPv4 and IPv6. \"0.0.0.0:80:80\" would be IPv4 only\n",[91,902,903],{},"We tested both forms through a GetPublicIP port mapping: with the address, IPv6 connections were refused; without it, IPv4 and IPv6 both reached the container.",[112,905,262],{"id":906},"troubleshooting",[91,908,909,914,915,134],{},[401,910,911,912,134],{},"The Status tab says ",[152,913,257],{}," The tunnel is running, but our server isn't answering. Check that the network you're on allows outgoing UDP to port 51820; some workplace, hotel and guest networks block it. Another VPN or a security product on your Mac can also block it. If it carries on, ",[101,916,106],{"className":917,"href":105},[104],[91,919,920,923,924,926,927,929],{},[401,921,922],{},"A port mapping doesn't connect."," Check the ",[152,925,314],{}," column on the Port Mappings tab. A program listening only on ",[152,928,836],{}," can't be reached from the internet: set it to listen on all addresses.",[91,931,932,935,936,938,939,942],{},[401,933,934],{},"The macOS firewall blocks forwarded connections."," With \"Block all incoming connections\" turned on, forwarded connections are blocked too. Turn it off in System Settings › Network › Firewall › Options. With the firewall on but that option off, macOS may ask once whether each program can accept incoming connections: click ",[152,937,228],{},". The app can't read the firewall's settings, but ",[152,940,941],{},"getpublicip doctor"," can, and reports them.",[91,944,945,948,949,954],{},[401,946,947],{},"Your Mac stops answering after a while."," A sleeping Mac answers nothing. Apple's ",[101,950,953],{"href":951,"rel":952},"https:\u002F\u002Fsupport.apple.com\u002Fguide\u002Fmac-help\u002Fmchle41a6ccd\u002Fmac",[132],"sleep and wake settings"," are in System Settings › Energy on a desktop Mac: turn on \"Prevent automatic sleeping when the display is off\". On a MacBook, go to System Settings › Battery › Options and turn on \"Prevent automatic sleeping on power adapter when the display is off\". A MacBook with its lid closed sleeps unless it's on power with an external display attached.",[91,956,957,960],{},[401,958,959],{},"A UDP service in Split tunnel."," A UDP server listening on all addresses would send its replies through your normal connection. The app routes each new client of a UDP mapping through the tunnel as its first packet arrives, so replies leave from your GetPublicIP address. UDP that a service sends first, to an address that hasn't sent it anything, still leaves through your normal connection. To avoid that, make the service listen on the tunnel address the Port Mappings tab shows, or use Full tunnel. TCP services aren't affected.",[91,962,963,966,967,969],{},[401,964,965],{},"Another VPN is connected."," Disconnect it while you use GetPublicIP. ",[152,968,941],{}," names any other VPN that's connected.",[91,971,972,975],{},[401,973,974],{},"Only one device per IP address."," Don't use the same API key on another computer or in the Docker image at the same time. Two devices with one key fight over the connection.",[977,978,979],"style",{},"html pre.shiki code .sHkqI, html code.shiki .sHkqI{--shiki-default:#A6E22E}html pre.shiki code .s_Ekj, html code.shiki .s_Ekj{--shiki-default:#E6DB74}html pre.shiki code .s7s5_, html code.shiki .s7s5_{--shiki-default:#AE81FF}html pre.shiki code .sCdxs, html code.shiki .sCdxs{--shiki-default:#F8F8F2}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html pre.shiki code .snpHw, html code.shiki .snpHw{--shiki-default:#88846F}html pre.shiki code .s8I7P, html code.shiki .s8I7P{--shiki-default:#F92672}",{"title":559,"searchDepth":621,"depth":621,"links":981},[982,996,1000],{"id":114,"depth":621,"text":115,"children":983},[984,985,986,987,988,989,990,991,992,993,994,995],{"id":119,"depth":638,"text":120},{"id":157,"depth":638,"text":158},{"id":207,"depth":638,"text":208},{"id":234,"depth":638,"text":235},{"id":265,"depth":638,"text":266},{"id":372,"depth":638,"text":373},{"id":468,"depth":638,"text":469},{"id":481,"depth":638,"text":482},{"id":509,"depth":638,"text":510},{"id":530,"depth":638,"text":531},{"id":683,"depth":638,"text":684},{"id":694,"depth":638,"text":695},{"id":736,"depth":621,"text":737,"children":997},[998,999],{"id":814,"depth":638,"text":815},{"id":840,"depth":638,"text":841},{"id":906,"depth":621,"text":262},"2026-11-03","Connect a Mac to your public IP address with GetPublicIP for Mac (beta). Install it, approve the network extension, sign in with your API key, and forward ports.","md",null,{},{"title":39,"icon":40},{"title":82,"description":1002},"2026-11-05","o-r3b9yoq-EMQcjm1mGU-3YJgKyW1MQ8fXQWFiEgZJw",1793914024049]