Your own VPN, on your own server.

What a self-hosted VPN is good for

• Encrypting traffic on public Wi-Fi.
• Reaching your home or office network from anywhere.
• A stable IP address you control, in a region you choose.

What it does not do

• It does not make you anonymous. Your VPS provider can see that the server exists and whom it was rented by, and any site you log into still knows who you are.
• A single-user exit IP is easy to link to you over time. If you need anonymity against a capable observer, use Tor.

Which plan

A small plan handles WireGuard comfortably. Choose the region nearest you for speed, or a region with the jurisdiction you prefer. Watch the monthly transfer allowance if you stream a lot.

Minimal WireGuard setup

The WireGuard quick start covers the configuration file and the firewall and NAT rules in detail. Open only the UDP port you chose and SSH, as in the hardening checklist.

apt update && apt install -y wireguard
wg genkey | tee /etc/wireguard/server.key | wg pubkey > /etc/wireguard/server.pub
# write /etc/wireguard/wg0.conf with an [Interface] and one [Peer] per device
sysctl -w net.ipv4.ip_forward=1
systemctl enable --now wg-quick@wg0

Before you rely on it

• Check for DNS and IPv6 leaks after setup.
• Pick a region that gives your traffic a sensible exit location.
• Keep the server patched. See the hardening checklist.
• Remember the server has one IP address. It is not the shared-pool anonymity of a commercial VPN.

Common questions