WireGuard VPS

Set up a personal VPN on your own server: WireGuard with forwarding on and one client profile prepared for you.

Who it suits

One person or a household who wants traffic to leave from their own server's address, on public Wi-Fi or to reach the server privately. It changes where your traffic exits, not who can see it at the server's end, and it doesn't make you anonymous.

Which plan

Budget is plenty: WireGuard runs in the kernel and uses little CPU. What matters more is the plan's monthly transfer, since everything you send through the tunnel passes through the server.

What we install

WireGuard with the server side configured and one client profile generated, with forwarding on. Your devices' IPv4 traffic leaves through the server; their IPv6 traffic is kept inside the tunnel too, so it can't slip around the VPN, and it will flow once our servers have IPv6 addresses. Copy the client file to your laptop or scan its QR code on your phone.

$ apt Debian family (apt)

wireguard
wireguard-tools
qrencode
iptables

$ dnf Red Hat family (dnf)

wireguard-tools
iptables-nft
qrencode

From order to ready

Server ready. We email you when the server is running, and you can log in with SSH. The installer starts on that same first boot.
Installer running. It logs to /var/log/vps9-setup.log; tail -f it to watch.
Application ready. This can be minutes after SSH works. The installer writes its exit code to /var/lib/vps9-setup.exit; a value of 0 means installation succeeded. It's ready when wg show lists the wg0 interface and /root/wireguard/client1.conf exists.

What you still do

Run cat /root/wireguard/client1.conf and import it into the WireGuard app, or run qrencode -t ansiutf8 < /root/wireguard/client1.conf and scan it.
Connect and check your IP at any what-is-my-IP site.

Exposure and security

UDP port 51820 is open for WireGuard, which ignores packets that aren't from a known key, so it doesn't answer scanners. The client file holds a private key: treat it like a password.

Backups and upgrades

To add a device, generate a key pair and add a [Peer] to /etc/wireguard/wg0.conf with the next address (10.9.0.3 and fd09::3); to revoke one, delete its peer and restart wg-quick@wg0. WireGuard updates with the kernel and the system's packages. We run the hardware, the network and the first-boot install; after that, WireGuard VPN is yours to run, and we don't manage or update it for you. Off-site backups of the whole disk are an optional paid add-on; they copy the disk as it is at one moment, so keep the app's own backups as well.