Frequently asked questions

Egret gives you a permanent public IPv4 address, and a VPN to handle the traffic. No server to manage, and it works on any device.

Yes. Every plan is one price for your own dedicated IP and the WireGuard VPN that carries your traffic. There is no separate VPN plan to buy first and no add-on fee for the IP.

Yes. Egret offers static IPv4 addresses with month-to-month billing and no annual commitment. Pay only for the months you need and cancel anytime. Optional annual plans are also available with two months free.

Use a dedicated US IP from anywhere. Reach websites and services that your local network or country restricts. Reach devices behind CGNAT and host services with open ports. Keep one consistent IP for work systems and allowlists. Get several dedicated IPs for separate devices, customers or setups.

Create your Egret account, install WireGuard on your device (https://www.wireguard.com/install/), then download your WireGuard config. Prefer AmneziaWG? Install the AmneziaWG app and download the AmneziaWG config instead. We handle everything else.

Any device that can run WireGuard: • Phones and tablets: iPhone, iPad, Android • Computers: Windows, Mac, Linux • Routers: OpenWrt, pfSense, OPNsense, MikroTik, GL.iNet, and most modern router firmware • Servers: Linux servers, Raspberry Pi, Docker Each IP address can have several devices: 2 on Plus, 5 on Pro, 10 on Ultra and 10 on Unlimited. Add one with "+ Add device" on the dashboard's My IPs tab: it gets its own config and uses the same static IP, at no extra charge. Set it up on your router to cover devices that can't run WireGuard, like game consoles and smart TVs. Get the free WireGuard app: https://www.wireguard.com/install/ Using AmneziaWG? It has apps for iPhone, iPad, Mac, Android and Windows, and a kernel module for Linux, but fewer routers support it.

• Extra IP addresses Each extra IP address is $3/mo ($30/yr on an annual plan) and comes with its own tunnel and config, sharing your account's plan and bandwidth. On the Ultra plan an extra IP is $8/mo ($80/yr) — it runs at 1 Gbps like the rest of the plan. On the Unlimited plan an extra IP is $15/mo ($150/yr) — it is unlimited at 100 Mbps too. IP addresses added mid-cycle are prorated so the whole account renews on one date. Unlockable options (per IP address): • Outgoing SMTP ($25) • Custom hostname ($5) • Gigabit Speed (Plus & Pro) — $5/mo

Speed depends on your plan: • Plus — 20 Mbps • Pro — 100 Mbps • Ultra — 1 Gbps • Unlimited — 100 Mbps For scale: HD video streams at about 5 Mbps and 4K at about 25 Mbps, so every plan covers everyday use. Higher speeds help with heavy traffic, like serving media or moving large files. On Plus or Pro, Gigabit Speed raises one IP address to 1 Gbps for $5/mo. It changes only the speed — your bandwidth allowance stays the same.

Most plans include a monthly bandwidth allowance, shared by all IP addresses on your account. Uploads and downloads both count, and the allowance resets every month. We email you before you run out. If you go over, your tunnel pauses until the reset — your IP address and config stay the same. Upgrade any time to reconnect right away. The Unlimited plan has no bandwidth limit: use as much as you want at 100 Mbps for $15/mo.

Currently we only operate in California, USA. We may add additional locations in the future.

Yes. In your dashboard, open the Account tab and turn on Two-factor authentication. Each time you sign in, you then also enter a 6-digit code from an authenticator app. You also get 8 one-time recovery codes. Keep them somewhere safe.

Egret is a service of Fork Networking, Inc., an internet infrastructure company founded in 1993. Egret is developed and operated directly by Fork Networking.

No. Egret generates the config for you. Download it, import it into any WireGuard client, and connect. There is nothing else to set up. You can use either WireGuard or AmneziaWG: switch between them from the My IPs tab. Switching moves your tunnel, so your current config stops working and you download a new one for the AmneziaWG app — same public IP either way. Only AmneziaWG is supported — not other Amnezia protocols or products.

Yes. In your dashboard, open the device's ⋯ menu, click Change next to Keys, choose Use my own key, and paste your public key. We then keep only the public key. Your download becomes a configuration template: put your private key on the PrivateKey line before you import it. To go back, choose Switch to automatically generated keys.

AmneziaWG is a version of WireGuard that is harder to detect and block. It hides that you use a VPN by making the connection look different from normal WireGuard traffic. Your service stays the same. You keep the same static IP, open ports, and plan.

Some networks block WireGuard and other VPN traffic. This can happen in countries such as China, Iran, Russia, Turkmenistan, and Myanmar. It can also happen on some mobile, hotel, school, or workplace networks. AmneziaWG can help when normal WireGuard does not connect, disconnects often, or stops passing traffic.

Use WireGuard if it works correctly. Use AmneziaWG if WireGuard is blocked or does not work reliably on your network. WireGuard is simpler, faster, and works with more apps and routers.

1. Install the AmneziaWG app: • iPhone, iPad, Mac: https://apps.apple.com/app/amneziawg/id6478942365 • Android: https://play.google.com/store/apps/details?id=org.amnezia.awg • Windows: https://github.com/amnezia-vpn/amneziawg-windows-client/releases/latest • Linux: https://docs.amnezia.org/documentation/instructions/install-amneziawg-kernel-module-linux/ 2. On the dashboard, open the My IPs tab, open the device's ⋯ menu, and set Client to AmneziaWG. 3. Download the new config and import it into the AmneziaWG app. You switch each device separately. To switch back, select WireGuard in the same menu.

Only the connection between your device and our server changes. Each device uses WireGuard or AmneziaWG. Devices on the same IP address can use different ones. The old config of that device stops working, so download the new one. If you switch back, your old WireGuard config works again.

AmneziaWG is harder to block than WireGuard, but networks can still block it. • You need an AmneziaWG-compatible app. A normal WireGuard app cannot use an AmneziaWG config. • Some routers do not support it. AmneziaWG has less device and router support than WireGuard. • AmneziaWG hides that you use a VPN. It does not change what Egret is built for: a stable address, not anonymity. • We support AmneziaWG only. We do not support the other VPN protocols or products from Amnezia.

Egret assigns you a dedicated public IPv4 and runs a WireGuard peer on its node. When you connect, your outbound traffic exits from that IP. New IP addresses start with every inbound port closed. You open the ports you need in the dashboard (5 open ports on Plus, unlimited open ports on Pro, Ultra and Unlimited), and traffic to those ports is forwarded through the tunnel to your device.

Yes. It is a real WireGuard VPN with your own dedicated IP. Egret is built for a stable address, not anonymity. Your traffic exits from a fixed public IPv4 that only you use, not a shared IP that services may block or flag. You can also open inbound ports on it.

We support anonymous payments with Monero and anonymous accounts via Access Keys, so you can sign up with no email address and no personal details. Your traffic exits from a static public IPv4 that is yours alone. The IP you connect from is logged.

Standard VPN services use shared IPs and block inbound connections. Egret gives you a dedicated IPv4, and you can open inbound ports on it. It is built for a stable address, not anonymity.

Yes. All traffic routed through the tunnel exits from your dedicated IP, regardless of where you connect from.

Yes. You choose which ports to open for each IP address in your dashboard (TCP or UDP, single ports or ranges); new IP addresses start with every inbound port closed. How many you can open depends on your plan: 5 open ports on Plus, unlimited open ports on Pro, Ultra and Unlimited. You can run a web server (80/443), game server, SSH (22), Minecraft, Plex, or anything else that needs inbound connections.

Carrier-grade NAT (CGNAT) means your ISP assigns one public IP address to many customers at once. You share it, so there is no way to receive inbound connections or open ports — services like game servers, home labs, remote desktop, or self-hosted apps simply cannot be reached from the internet.

Egret gives you a dedicated static public IPv4, tunneled to your device over WireGuard. Your device connects outbound to Egret's node. You open the ports you need in the dashboard, and traffic to those ports on your public IP is forwarded through the tunnel to you — bypassing CGNAT entirely.

Yes. Starlink places most residential users behind carrier-grade NAT (CGNAT). This means you share a public IP address with other customers and cannot receive inbound connections or open ports.

Yes. Egret gives you a dedicated static public IPv4. Traffic to the ports you open goes through a WireGuard tunnel to your device, so you can host services and accept connections even through Starlink's CGNAT — no hardware changes needed.

Your Starlink-connected device runs the WireGuard client with a config Egret provides. It connects outbound to Egret's node (which works fine through CGNAT), and traffic to the ports you open on your dedicated public IPv4 is forwarded back through the tunnel to you.

No. WireGuard initiates outbound connections, so it works through Starlink's CGNAT without any hardware changes, firmware updates, or router bypass mode.

Port forwarding only works if your ISP gives you a real public IP. Behind CGNAT — common with Starlink, LTE, and many cable and fiber ISPs — it does nothing. Egret bypasses this by routing a real public IPv4 back to your device over WireGuard.

Anything that listens on a port: web servers, game servers, SSH, home automation hubs, media servers, sync tools. If it can bind to an address and listen for connections, it works.

You need WireGuard running on whatever device hosts the service — a Raspberry Pi, an always-on router, or a home server. WireGuard is lightweight and reconnects automatically after interruptions.

Yes. WireGuard is supported on OpenWrt, pfSense, OPNsense, and most modern router firmware. Running it at the router level means all devices on your network can be reached without installing WireGuard on each one.

Egret runs on an account balance. Choose "Subscribe" and your card is saved, so your service renews automatically every month or year — no action required. Or pre-load your balance with crypto or "Pay Once", a one-time payment through Stripe (card, wallet, or a local payment method), and your service renews from that balance at each billing period. Annual billing is available on paid plans at ten months' price — two months free.

No. Your plan and add-on prices stay locked at what you paid when you purchased them, for as long as you keep them. If you switch plans, current prices apply to the new plan and the extra IP addresses on it.

You get a grace period first: 5 days from the failed renewal. The dashboard shows your actual grace end date. After that your tunnel is paused, but your IP address is not released: we hold a paused paid account's IP for at least 30 days, and email you a week before it would be released, so you have time to top up or update your card and keep the same IP. Top up enough to cover the whole renewal and your service comes back by itself, with the same IP and config. The free plan works differently — it never runs out of money, so its IP is instead released after 7 days with no connection (48 hours if it never connected at all), with a warning email the day before.

We accept credit cards, debit cards, Apple Pay, Google Pay, UnionPay, Link, Amazon Pay, Cash App Pay, Klarna, Korean cards, Kakao Pay, Naver Pay, Bancontact, BLIK, EPS, MB WAY and Pix. We accept the following crypto currencies: Monero (XMR), Bitcoin (BTC), Litecoin (LTC), Bitcoin Cash (BCH), Ethereum (ETH), Polygon (POL) and Toncoin (TON), and Tether (USDT) on Tron, Ethereum, Polygon, Solana or TON.

If you're not happy within the first 7 days, we'll refund you in full. Use the Support tab in your dashboard or email support@egret.host.

New customers: Go to the pricing page and select a plan. Select "Crypto", then select your coin. Your invoice shows immediately. You do not need an email address. You do not need to wait for confirmations. Existing customers: Go to your Dashboard and click "Add credit". Select an amount, select "Crypto", then select your coin. Your service renews from your balance. 10% Discount when using Crypto and 5% for Tether.

Some coins have a minimum payment that is more than the price of a plan. To use one of these coins, add credit first. Then start the plan from your balance. For USDT on Tron, Ethereum, Polygon or Solana, the invoice first asks for the wallet address you will send from, and your payment is matched by that address. Send from that exact wallet, not from an exchange. Send the full amount the invoice shows, in the coin and on the network it names, before the invoice expires. A payment that is short, late, or in another coin or network is not credited automatically: contact support with the transaction ID.

Yes. Share your invite link from the Refer tab in your dashboard. Your friend gets $5 credit once they have paid $10. You get 40% of everything they pay, with no limit, as account credit. Prefer cash payout? Email us. We pay in crypto once a month, with a $50 minimum.

Egret uses WireGuard, which may work in China, but performance and availability can vary depending on your ISP, location, and network conditions. Because internet filtering in China can change over time, we cannot guarantee that WireGuard will work consistently on every network. If standard WireGuard will not connect, switch to AmneziaWG on the dashboard's My IPs tab and download the new config for the AmneziaWG app. It is the same tunnel made harder to detect, but it is not guaranteed either. Switching stops your current WireGuard config; switch back any time to make it work again.

Yes. v2rayN supports WireGuard connections, so you can use your Egret WireGuard configuration with v2rayN. Egret does not provide VLESS, VMess, or other V2Ray protocols — the connection itself is still WireGuard.

Do not use "Global" mode unless you specifically want all of your internet traffic to use your Egret IP. For better performance, use rule-based routing such as "Bypass Mainland China". This keeps normal Chinese websites and services on your local connection while sending other traffic through Egret. This usually provides a much faster experience than routing everything through the VPN.

The most common cause is using a full-tunnel or "Global" routing mode. When Global mode is enabled, even traffic going to nearby Chinese websites may first travel through the Egret server and then back to China, adding unnecessary latency. If you are using v2rayN, try "Bypass Mainland China" or another rule-based routing mode so local Chinese traffic stays direct. If the WireGuard connection itself is slow even with proper routing, the issue may be related to your ISP or current network conditions.