Using Grok Bot to run WireGuard for Plex over Starlink

The problem: CGNAT vs Plex remote access

On many cable or fiber connections you get a public WAN address. You forward TCP 32400 (or terminate TLS on a reverse proxy), point remote friends at your house, and Plex Remote Access lights up green.

Starlink’s default IPv4 path is different. Per Starlink’s own help center, residential service uses carrier-grade NAT (CGNAT). Your router’s “WAN” address is not a unique public IPv4 the open internet can dial. Unsolicited inbound connections never reach your Plex box. Dynamic DNS that tracks a CGNAT address does not open a door.

Outbound still works fine — browsing, updates, and VPN clients that dial out first. That outbound-first property is exactly what a cheap VPS relay exploits.

Starlink offers an optional public IPv4 on Local and Global Priority plans (still DHCP-assigned, not a guaranteed forever-static address, and the stock Starlink Wi‑Fi router still does not do port forwarding). For a household that only needs remote Plex, jumping plans just to get inbound IPv4 is usually overkill compared with a tiny VPS.

What we asked Grok Bot to do

We described the goal in plain English: provision a small DigitalOcean droplet with a public IP, install and harden WireGuard, open only the ports we need, generate keys, hand back a peer config, and keep the box manageable afterward (health checks, restarts, resizing, key rotation) when we ask.

Grok Bot used the DigitalOcean API to create the droplet, installed WireGuard on Ubuntu, configured the interface and firewall, and returned a client peer config. No dashboard click-ops marathon. When something drifts later, we can ask for a check or a restart in the same conversational loop.

A high-level picture of the finished path:

Grok Build on the Plex machine: split tunnel matters

The VPS is only half the story. The home machine that runs Plex still has to join the tunnel and tell Plex where the public front door is.

We used Grok Build on that host to:

1. Install the WireGuard client.
2. Import the peer config as a split tunnel — only the Plex-relay destination (wireguard network / VPS forward path) goes through the VPS. Normal internet — streaming into the house, updates, Zoom, games — stays on Starlink.
3. Point Plex remote access at the relay (port forward on the VPS to the Plex service over the tunnel, typically TCP 32400).

Split tunnel is the detail people skip. If you full-tunnel the whole house through a tiny droplet, you pay in latency and you burn the VPS bandwidth allowance on traffic that never needed a public IP. Keep Starlink as the default route; use the VPS only as the inbound door for Plex.

A peer config looks like this in spirit (placeholders only — never paste real keys or hostnames into a blog):

[Interface]
PrivateKey = <client-private-key>
Address = 10.8.0.2/24

[Peer]
PublicKey = <server-public-key>
Endpoint = <server-public-ip>:51820
AllowedIPs = 10.8.0.0/24
PersistentKeepalive = 25

AllowedIPs scoped to the tunnel subnet (not 0.0.0.0/0) is what keeps everyday traffic on Starlink.

What it costs

Our relay runs on DigitalOcean’s s-1vcpu-1gb Basic droplet — 1 vCPU, 1 GiB RAM, 25 GiB SSD. DigitalOcean’s published Basic pricing (and the size catalog returned by their API) lists that plan at $6.00/month, including 1,000 GiB of outbound transfer. That is plenty for a handful of remote HD streams; your real ceiling is still home Starlink upload, not the VPS pipe.

Compared with alternatives you can verify from primary sources:

• Starlink public IPv4: available on Local / Global Priority plans only, per Starlink’s help center — not on ordinary Residential CGNAT. That is a plan-class change, not a $6 add-on, and you still need your own router for port forwarding because Starlink’s Wi‑Fi routers do not expose it.
• Paid “static IP / relay” services: prices move; check each vendor. A DigitalOcean droplet you control is simple to reason about, resize, or destroy.
• Grok Bot: this workflow uses the Grok Bot subscription you already have. We are not stating a separate Bot price here.

In short: a few dollars a month for a public IP and a WireGuard door, versus fighting CGNAT or changing Starlink plan tiers.

Day-two operations

Because the droplet was created through the API with Grok Bot in the loop, follow-up asks stay conversational: “is WireGuard up?”, “rotate the peer key”, “resize if we outgrow 1 GB”, “show who last shook hands.” That is the seamless part — not that networking became magic, but that the busywork moved into requests you would make anyway.

Still do the boring adult things: keep the VPS patched, limit which ports face the internet, prefer quality caps for remote Plex so one 4K remux does not flatten household upload, and treat the VPS as an internet-facing door even though your library stays home.

Takeaway

Starlink CGNAT is not a dead end for remote Plex. A small DigitalOcean WireGuard relay (~$6/mo on the 1 GB Basic size we use), provisioned with Grok Bot and paired to a split-tunnel client via Grok Build, restores inbound access without hauling your whole household through a VPS. Media still leaves on your Starlink uplink — so run the household calculator before you promise four remote 4K streams — but the networking knot is cut.

Want the broader pattern without the Bot angle? See How to set up a VPS if you want Plex over Starlink.

Get Starlink Open calculator

Affiliations

This site is independent and not affiliated with Starlink, SpaceX, Plex, DigitalOcean, WireGuard, or xAI. Links to Starlink.com may include a referral code; see the disclaimer.