Setting up your own VPN with WireGuard is an increasingly simple alternative to paying a monthly subscription to a commercial provider. You can do it for practically €0 extra using a computer, mini PC, or Raspberry Pi that’s already left on at home, or deploy it on a VPS with a public IP for a few euros a month. It doesn’t offer exactly the same thing as NordVPN, Proton VPN, or Mullvad, but for securely reaching a private network, protecting traffic on public Wi-Fi, or having your own outbound IP, it can actually be even more appealing.
Setting up your own VPN in 30 seconds
- WireGuard ships built into modern Linux and uses a considerably simpler setup than IPsec.
- A home device lets you run the VPN with no extra monthly fee, though it needs a reachable IP and usually port forwarding.
- With CG-NAT, common with some ISPs, a VPS with a public IP is usually the simplest solution.
- A basic Linux server is enough: Spanish providers like GINERNET, Raiola Networks, or cloud platforms like Aire Cloud can all be used.
- A self-hosted VPN gives you control, but it doesn’t automatically give you the anonymity of a commercial VPN with thousands of users sharing an IP.
WireGuard is a modern VPN tunnel that encapsulates IP traffic over UDP and uses public/private key cryptography. It’s available directly in the major Linux distributions and has official clients for Windows, macOS, Android, and iOS. The project’s own documentation also covers routing all Internet traffic through the tunnel.
The initial decision matters more than the installation itself: use a server at home, or rent a VPS?
Home, VPS, or cloud: three different ways to set up WireGuard
The cheapest option is reusing a computer that’s already connected around the clock.
It could be a Raspberry Pi, a mini PC, a NAS that can run WireGuard, or a dedicated Linux server. The device needs to stay powered on whenever you want to use the VPN from outside.
The advantage is obvious: there’s no new monthly infrastructure fee. On top of that, while traveling, your phone or laptop can reach the Internet using your home connection’s IP address.
There are, however, three requirements that can complicate the setup:
- Your router needs to allow forwarding a UDP port to the server.
- The connection needs an address reachable from the Internet.
- If the IP changes, it’s worth setting up dynamic DNS.
The main obstacle is CG-NAT (Carrier-Grade NAT). Some providers share a single public IPv4 address across multiple customers, so you can’t just open port 51820 on your router and expect connections from the Internet to reach it.
In that case, you can request a public IP from your ISP, use IPv6 if your whole setup is properly configured for it, or move WireGuard to a VPS.
And a VPS can actually turn out to be even simpler.
A VPN server barely needs any CPU or memory for personal use. For example, GINERNET currently offers VPS hosting in Madrid from €5 a month on its Intel configuration, with a dedicated IPv4 and 1 TB of traffic, while its Cloud S configuration with AMD, 1 vCore, 1 GB of RAM, and 10 GB of NVMe storage costs €6 a month. The provider itself lists VPNs among the uses for its basic plan.
Raiola Networks likewise offers KVM VPS instances with a dedicated European IP and guaranteed resources, so they can technically be used for the same purpose.
For a business that wants to fold the VPN into a larger infrastructure, a public cloud like Aire Cloud, or other European infrastructure providers, is worth considering. In that scenario, finding the absolute cheapest VPS matters less than having a fixed IP, enough transfer, a good network, and the right geographic location.
A minimal setup for personal use might look like this:
| Scenario | Reasonable resources | Main advantage |
|---|---|---|
| Raspberry Pi / mini PC | 1 GB RAM | No new monthly fee |
| Basic VPS | 1 vCPU / 1 GB RAM | Public IP and 24/7 service |
| Enterprise cloud | Depends on traffic | Private networks and infrastructure integration |
| Dedicated server | Usually overkill | Large volumes or many users |
WireGuard uses very few resources. On a personal VPN, the bottleneck is usually your connection’s bandwidth rather than processing power.
How to install WireGuard on Ubuntu or Debian
On an updated Ubuntu- or Debian-based server, installing the tools you need is just:
sudo apt update
sudo apt install wireguard qrencode -yThe official WireGuard installation uses exactly this — apt install wireguard — on both Ubuntu and Debian.
Next, generate the keys using restrictive permissions:
sudo -i
cd /etc/wireguard
umask 077
wg genkey | tee server_private.key | wg pubkey > server_public.keyserver_private.key should never be shared. The public key, on the other hand, will be needed to configure the clients.
The next step is identifying the interface that connects the server to the Internet:
ip route show defaultA VPS might return, for example:
default via 185.xxx.xxx.1 dev ens3In this case, the interface is ens3.
Next, you need to let Linux forward packets coming from WireGuard:
cat >/etc/sysctl.d/99-wireguard.conf <<EOF
net.ipv4.ip_forward=1
EOF
sysctl --systemThis is preferable to repeatedly adding lines to /etc/sysctl.conf.
Creating the server configuration
You can use a private network like 10.8.0.0/24. The server will be 10.8.0.1.
The /etc/wireguard/wg0.conf file could contain:
[Interface]
Address = 10.8.0.1/24
ListenPort = 51820
PrivateKey = SERVER_PRIVATE_KEY
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o ens3 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -D FORWARD -o wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o ens3 -j MASQUERADEReplace ens3 with your actual interface.
On systems managed with nftables, the same NAT function can be implemented directly with nftables. While iptables is still a widely used and simple choice for a basic guide, in enterprise deployments it’s worth integrating the rules with whatever firewall system the server already uses.
The file contains the private key, so it needs to be protected:
chmod 600 /etc/wireguard/wg0.confThen you can start it:
systemctl enable --now wg-quick@wg0And check its status:
wg showThe official documentation also provides wg-quick precisely to automate bringing WireGuard interfaces up and down.
The firewall and router steps change depending on where the server lives
If you’re using UFW:
ufw allow 51820/udpOn a VPS with a public IPv4, this can be practically everything you need, along with whatever firewall the cloud panel itself provides.
At home, there’s one more step: log into your router and create a forwarding rule:
UDP 51820 → SERVER_LOCAL_IP:51820For example:
UDP 51820 → 192.168.1.20:51820It’s worth giving your home server a fixed local IP or a DHCP reservation.
If your public address changes, you can set up a dynamic DNS service and use:
Endpoint = vpn.mydomain.com:51820instead of writing an IP address.
Adding your first phone
Every device should have its own key pair. Don’t share a single private key across all of them.
On the server:
wg genkey | tee phone_private.key | wg pubkey > phone_public.keyThe phone could use this configuration:
[Interface]
Address = 10.8.0.2/32
PrivateKey = PHONE_PRIVATE_KEY
DNS = 1.1.1.1
[Peer]
PublicKey = SERVER_PUBLIC_KEY
Endpoint = SERVER_IP_OR_DOMAIN:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25PersistentKeepalive = 25 is exactly the interval WireGuard’s documentation considers reasonable when the client sits behind NAT or a firewall.
On the server, you need to add:
[Peer]
PublicKey = PHONE_PUBLIC_KEY
AllowedIPs = 10.8.0.2/32And apply the new configuration:
wg syncconf wg0 <(wg-quick strip wg0)To conveniently transfer the configuration to Android or iPhone:
qrencode -t ansiutf8 < phone.confThe official WireGuard app can scan that code directly.
There’s one important correction to a lot of the guides floating around online: you shouldn’t add ::/0 to the client if the server is only set up to route IPv4. Doing so risks IPv6 not working correctly or ending up misconfigured. To tunnel IPv6 as well, you need to assign IPv6 addresses to the tunnel, enable IPv6 forwarding, and configure the routing properly.
Split tunnel, or routing all your Internet traffic through the VPN
WireGuard supports two very different setups.
With:
AllowedIPs = 0.0.0.0/0all IPv4 traffic goes through the server.
That’s the right option for connecting from an airport, a hotel, or public Wi-Fi and using the VPN as your gateway to the Internet.
But you might only want to reach the office or home network. In that case you can use:
AllowedIPs = 10.8.0.0/24, 192.168.1.0/24This creates a split tunnel: only traffic headed to those networks passes through WireGuard; YouTube, web browsing, and the rest of the Internet keep using the phone or computer’s connection directly.
For corporate remote access, this is often a very appealing option.
A self-hosted VPN isn’t the same as a commercial VPN
This is where the main caveat of this whole approach comes in.
WireGuard provides an encrypted tunnel between your device and the server, but installing it doesn’t automatically make you anonymous.
With a home VPN:
Phone → encrypted tunnel → home → Internetwebsites will see your home IP.
With a VPS:
Phone → encrypted tunnel → VPS → Internetthey’ll see the VPS’s IP.
A commercial provider works differently, because thousands of customers can share the same exit addresses, and it usually lets you switch countries easily.
That’s why a self-hosted VPN is especially good for security, remote access, control, and privacy on untrusted Wi-Fi networks, but not necessarily for blending in among thousands of other users or simulating a presence in dozens of countries.
It’s also not accurate to simply claim it “keeps no logs.” WireGuard itself doesn’t need to keep a browsing history, but Linux, DNS, the VPS provider, installed applications, or other components can still generate logs. Owning the infrastructure lets you decide what gets logged — but you still have to configure it.
Which option makes the most sense
For someone with fiber, a public IP, and a device that’s already always on, setting up WireGuard at home can cost practically €0 extra a month, beyond the electricity and connectivity they’re already paying for.
For anyone behind CG-NAT, who doesn’t want to open ports at home, or who needs constant availability, a small VPS is probably more practical. A cost of €5–10 a month works out to between €60 and €120 a year, though the server can also double as private DNS, monitoring, a bastion host, or other services.
GINERNET is a particularly straightforward option, since it offers VPS instances with a dedicated IPv4 in Madrid from €5 a month with hourly billing. Raiola Networks offers Spanish KVM VPS instances, while Aire Cloud makes more sense when the VPN is part of a larger enterprise cloud setup rather than simply a personal Internet gateway.
There are also other European and Spanish providers. The choice should come down to location, public IP address, included transfer, connectivity, and trust in the provider, rather than having eight CPU cores for a service that probably won’t need them. If you’re weighing tunneling options more broadly, it’s also worth looking at self-hosted alternatives built around reverse proxying instead of a classic VPN, such as Pangolin, a self-hosted alternative to Cloudflare Tunnels with built-in access control.
And that’s probably WireGuard’s biggest advantage: you don’t need complicated infrastructure to have a VPN under your own control. A small Linux box, a reachable IP, and a few minutes of setup are enough for an encrypted tunnel that can keep running for years without depending on a traditional VPN subscription.
Frequently asked questions
How much does it cost to set up your own VPN with WireGuard?
If you reuse a home device that’s already powered on, the extra cost can be practically nothing beyond electricity and connectivity. On a Spanish VPS, options start at around €5 a month.
Does WireGuard work if your home connection has CG-NAT?
Not directly through a simple IPv4 port forward. You can request a public IP from your ISP, design the connection around IPv6, or use a VPS with a public IP as the server.
Does a self-hosted VPN make you anonymous?
Not necessarily. The sites you visit will typically see the public IP of your home or your VPS. A self-hosted VPN is especially well suited to encrypting connections, reaching private networks, and controlling your own infrastructure.
What kind of server does WireGuard need?
For a handful of users, 1 vCPU and 1 GB of RAM are usually more than enough. Available bandwidth and included data transfer are typically more important variables than CPU count.
