Set Up ChangeMyIP WireGuard on Windows: Full-Tunnel and Split-Tunnel Routing

Overview

ChangeMyIP offers WireGuard alongside its HTTP, HTTPS, SOCKS5, Shadowsocks, and Trojan endpoints. On Windows, WireGuard runs as a background service, so the moment a tunnel is active every application leaves through the ChangeMyIP exit instead of your home connection. That makes it the least fiddly way to change your IP address on Windows when you do not want to configure a proxy for each program.

You will:

1. Build a WireGuard tunnel from your ChangeMyIP connection details.
2. Confirm the handshake, the new public IP, and DNS resolution.
3. Choose between full-tunnel routing and split routing by destination.
4. Diagnose the failures that account for most broken setups.

What you need

• Windows 10 or Windows 11 with administrator rights.
• A ChangeMyIP plan that includes WireGuard access, plus its connection details: endpoint host and UDP port, server public key, your private key, assigned tunnel address, and DNS value.
• The official WireGuard client for Windows from the WireGuard download page.
• Any public IP echo service for verification (the examples below use one; any equivalent works).

Full tunnel or split tunnel?

WireGuard decides what to tunnel by destination IP address, not by program. If you need "only this browser through the proxy", a proxy configuration is the right tool, not a WireGuard interface.

Baseline: record your current IP and DNS

# Public IP before the tunnel
curl.exe -s https://ifconfig.co/ip

# DNS servers currently in use
Get-DnsClientServerAddress -AddressFamily IPv4 |
  Where-Object { $_.ServerAddresses } |
  Select-Object InterfaceAlias, ServerAddresses

Keep both outputs. You need a known before value to compare against once the tunnel is up.

Steps

1. Collect the ChangeMyIP WireGuard values

Sign in to your ChangeMyIP account and locate the WireGuard connection details. A WireGuard configuration maps one-to-one to these fields:

• Interface > PrivateKey — the private key assigned to your device
• Interface > Address — the tunnel address for your device, usually a /32
• Interface > DNS — the resolver to use inside the tunnel
• Peer > PublicKey — the ChangeMyIP server public key
• Peer > Endpoint — hostname or IP address plus the UDP port
• Peer > AllowedIPs — 0.0.0.0/0, ::/0 for a full tunnel

If ChangeMyIP provides a downloadable .conf file, you can import it directly in step 3. Open it once anyway to confirm the DNS and AllowedIPs lines.

2. Install WireGuard for Windows

1. Download the installer from the official WireGuard site.
2. Run it as administrator and complete the wizard.
3. Confirm the background service is running:

Get-Service -Name 'WireGuardManager' |
  Select-Object Name, Status, StartType

If that service name does not exist on your build, open services.msc and look for a service whose name begins with WireGuard.

3. Create the tunnel

If you received a configuration file, choose Import tunnel(s) from file and continue to step 4. Otherwise paste your values into a new tunnel:

[Interface]
PrivateKey = <client-private-key-from-changemyip>
Address = 10.7.0.2/32
DNS = <dns-server-from-your-changemyip-config>

[Peer]
PublicKey = <changemyip-server-public-key>
Endpoint = <endpoint-host-or-ip>:<udp-port>
AllowedIPs = 0.0.0.0/0, ::/0
PersistentKeepalive = 25

1. Open WireGuard and select Add tunnel > Add empty tunnel.
2. Name it after the exit location, for example changemyip-de-frankfurt, so switching cities later is obvious.
3. Replace every <placeholder> with your own values. Do not add quotation marks, commas, or trailing semicolons.
4. Save the tunnel.

The Address value is your address inside the encrypted link, not the IP that websites will see. The public IP is the ChangeMyIP endpoint's.

4. Activate and confirm the handshake

1. Select the tunnel and click Activate.
2. Watch the status line: it should move from Waiting for handshake to a fresh handshake timestamp within a few seconds.
3. Optionally verify from a terminal. The wg.exe tool ships with the Windows client:

& 'C:\Program Files\WireGuard\wg.exe' show

Look for a latest handshake line. Non-zero transfer counters confirm that traffic is flowing in both directions. If wg.exe is not in your install directory, rely on the status shown in the WireGuard window.

5. Verify the new public IP

curl.exe -s https://ifconfig.co/ip

Then confirm all three of these:

• The value differs from the baseline you recorded earlier.
• The country reported by an IP lookup service matches the endpoint you imported.
• A browser in a fresh private window reports the same address. A normal window can reuse cached geolocation and stale DNS results.

6. Check DNS and IPv6

1. Compare resolvers before and after activation:

Get-DnsClientServerAddress -AddressFamily IPv4 |
  Where-Object { $_.ServerAddresses } |
  Select-Object InterfaceAlias, ServerAddresses

2. If the DNS line was empty in your configuration, lookups still go to your ISP resolver. That is a DNS leak in practice even though the tunnel is up. Add the DNS value ChangeMyIP provided and reactivate.
3. Run an IPv6 connectivity test in the browser. A tunnel with only 0.0.0.0/0 in AllowedIPs leaves IPv6 traffic outside the tunnel. Add ::/0 or disable IPv6 on the active adapter.
4. Run a WebRTC leak test. If it reveals your ISP address, disable WebRTC in that browser or use one that does not expose local candidates by default.

7. Optional: split the tunnel by destination

1. Deactivate the tunnel.
2. Edit the peer AllowedIPs line down to the ranges you want tunneled, for example 198.51.100.0/24, 203.0.113.10/32.
3. Keep the DNS line only if you also want those lookups tunneled. Otherwise remove it and let the system resolver handle everything.
4. Reactivate, then re-check the public IP. Ordinary browsing keeps your original address while requests to the listed ranges use the ChangeMyIP exit.

8. Switch exit locations

Every ChangeMyIP endpoint you import becomes a separate tunnel. Save one configuration per city, then deactivate the current tunnel and activate the other. The public IP changes with the endpoint, which makes this the fastest way to compare how a page behaves from different countries.

Troubleshooting

• Status never leaves Waiting for handshake. UDP is usually blocked, which is common on corporate, campus, and hotel networks. Check Windows Firewall for a WireGuard rule, request a different endpoint or port from ChangeMyIP, and if UDP is blocked outright, switch to one of ChangeMyIP's TCP-based options such as its HTTP, HTTPS, or SOCKS5 endpoints.
• Handshake succeeds but pages will not load. Check that AllowedIPs contains 0.0.0.0/0, ::/0, that a DNS value is present, and that the MTU is sane. On networks with unusual encapsulation, add MTU = 1280 to the [Interface] section and reactivate.
• The public IP is unchanged. The tunnel may not actually be active, the test page may be cached, or a second VPN or proxy client on the machine is overriding the routes. Test with curl.exe in a fresh terminal.
• The IP changes but the site still shows your home country. The site is using cached geolocation, browser language, or an account setting rather than your address. Test in a private window with a cleared cache.
• Everything stops the moment the tunnel drops. With a full-tunnel configuration Windows has no path out except the tunnel, so a failed handshake looks exactly like an internet outage. That is the safer failure mode; deactivate the tunnel to restore normal connectivity.
• Frequent CAPTCHAs or blocks. The exit address is shared and may already be flagged. Import a configuration for a different city, or use ChangeMyIP residential endpoints where the task needs a cleaner IP.
• Slow throughput. Try another endpoint closer to you, lower the MTU, and compare Wi-Fi against Ethernet before blaming the provider.

Summary

• WireGuard on Windows routes traffic system-wide, so it changes the IP for every application at once.
• Import or paste the ChangeMyIP connection details into a named tunnel, then confirm the handshake before testing anything else.
• Always verify the public IP, the DNS resolver, and the IPv6 path. A connected status does not prove there is no leak.
• WireGuard splits by destination IP, not by application. Use ChangeMyIP's SOCKS5 or HTTP endpoints with a per-app router when you need process-level control.
• Keep one saved tunnel per city so you can switch exit locations without reconfiguring anything.