8. Giving the server a static address

Why a static address

Devices find your VPN server by its address, and the router forwards the VPN port to the server's address inside your network. If the server gets its address from DHCP, that address can change (after a reboot, or when the router hands out a different one). Then the router forwards to the wrong machine, nothing connects, and the web interface moves. Tunnelry warns you about this on the Dashboard and on the VPN server page.

A reservation in the router (the router always gives this machine the same address) helps, but it is not fully reliable: the router can forget it, be reset or be replaced. A static address set on the server itself is the safe choice. You can do both.

Before you start

Do this on the console of the machine (or the console of your virtual machine), not over SSH: the connection drops when the address changes. Collect four things on the server:

ip -4 -br addr
ip route | grep default

The first shows the name of the network interface (for example ens18) and its current address and mask. The second shows the gateway, which is usually your router. Then pick a new address in the same network that nobody else uses: it must be outside the range your router hands out by DHCP (look at the router's DHCP settings), and it must not answer a ping before you use it:

ping -c 2 192.168.17.50

The examples below use the interface ens18, the address 192.168.17.50, the gateway 192.168.17.1 and the network 192.168.17.0/24; replace them with your own.

Debian 13

Debian configures the network in /etc/network/interfaces. Make a copy and open the file:

sudo cp /etc/network/interfaces /etc/network/interfaces.bak
sudo nano /etc/network/interfaces

Replace the lines of the interface that say dhcp with:

allow-hotplug ens18
iface ens18 inet static
    address 192.168.17.50/24
    gateway 192.168.17.1

Name servers are set separately:

printf "nameserver 192.168.17.1\nnameserver 1.1.1.1\n" | sudo tee /etc/resolv.conf

Apply the change (this is where an SSH session would drop):

sudo systemctl restart networking

Ubuntu 24.04

Ubuntu uses netplan. Find the file and open it (its name differs between installations):

ls /etc/netplan
sudo nano /etc/netplan/50-cloud-init.yaml

Set the interface like this (keep the indentation exactly, with spaces, never tabs):

network:
  version: 2
  ethernets:
    ens18:
      dhcp4: false
      addresses: [192.168.17.50/24]
      routes:
        - to: default
          via: 192.168.17.1
      nameservers:
        addresses: [192.168.17.1, 1.1.1.1]

Try it with an automatic way back: if you do not confirm within two minutes, netplan restores the old settings by itself, so a mistake cannot lock you out:

sudo netplan try

If everything works, press Enter to keep it. If the machine was created from a cloud image, cloud-init may write the old settings back at the next boot; stop that with:

echo "network: {config: disabled}" | sudo tee /etc/cloud/cloud.cfg.d/99-disable-network-config.cfg

After the change

1. Check the new address and the connection: ip -4 -br addr and ping -c 2 1.1.1.1.
2. Change the port forwarding in the router (and the reservation, if you have one) to the new address of the server.
3. Open the web interface at the new address, for example https://192.168.17.50:8443. Its certificate was made for the old address, so the browser warns again. To make a certificate for the new address, run the installer once more with --address 192.168.17.50 (see installing); it keeps all your data.
4. Open VPN server in Tunnelry: the warning about DHCP should be gone within a minute, and the Dashboard shows the address as fixed.

If you lose access

The console of the machine (or of the virtual machine in your hypervisor) always works. Put the old settings back and restart the network:

sudo cp /etc/network/interfaces.bak /etc/network/interfaces
sudo systemctl restart networking

On Ubuntu, if you used netplan try, you only need to wait: the old settings return after two minutes.

Next: uninstalling and troubleshooting.