How to make a private VPN server in 10 minutes

Key Takeaways

You can run a personal VPN in 10 minutes with a $5 VPS and one script. No subscription, no logging policy you have to trust — you control the server.
This isn’t about anonymity. A self-hosted VPN hides your traffic from coffee-shop Wi-Fi and your ISP, but the VPS provider still sees everything. Know the threat model.
WireGuard over OpenVPN. Faster, simpler config, kernel-native on Linux. If your VPS runs a modern kernel, WireGuard is the right call in 2026.

Why self-host a VPN?

Commercial VPNs work fine for most people. But you’re a network engineer — you can do better. A $5/month VPS running your own VPN gives you:

A static IP you control (useful for whitelisting, remote access, and lab scenarios)
No data caps, no throttling, no “we don’t log (wink)” marketing
A server you can also use for other things — DNS (Pi-hole or Unbound), a jump box, a reverse proxy
The satisfaction of knowing exactly how it works

A VPS (virtual private server) is a rented virtual machine on someone else’s hypervisor, with its own public IP and root access, which is the cheapest way to own an endpoint on the public internet.

The trade-off: your VPS provider can still see your traffic. This setup is about privacy from the network you’re sitting on (airport Wi-Fi, hotel ethernet, your ISP), not anonymity from the world. If you need anonymity, Tor is the tool, not a VPN — self-hosted or otherwise.

What you need

A VPS — any $5/month Linux box will do. DigitalOcean, Linode, Vultr, Hetzner, whatever. 1 vCPU, 512MB RAM, 10GB disk is plenty.
A domain pointing at it (optional but convenient)
10 minutes

Step 1: Get the script

angristan/wireguard-install is the gold standard. It handles kernel headers, key generation, firewall rules, and client config in one run. I’ve used it across Debian, Ubuntu, and CentOS without issues.

curl -O https://raw.githubusercontent.com/angristan/wireguard-install/master/wireguard-install.sh
chmod +x wireguard-install.sh
sudo ./wireguard-install.sh

The script walks you through a few prompts — server IP, interface name, port, client name. Defaults work for everything except the IP (use your VPS public IP or domain).

Step 2: Add clients

Run the script again to add more devices:

sudo ./wireguard-install.sh
# Select "1) Add a new user"
# Give it a name (phone, laptop, lab-jumpbox)
# Scan the QR code with your phone, or copy the .conf file

Each client gets its own key pair and a dedicated IP in your VPN subnet. Revoking a client is the same script, option 2. Clean.

Step 3: Connect

On your laptop or desktop:

# Linux (NetworkManager)
nmcli connection import type wireguard file laptop.conf

# macOS — use the WireGuard app from the App Store
# iOS/Android — scan the QR code from the script output

That’s it. You’re connected. Your traffic now exits through your VPS instead of the coffee shop router.

Performance notes

I tested this on a $6/month Linode (1 vCPU, 1GB RAM), where WireGuard pushes about 400-500 Mbps. That’s more than most hotel Wi-Fi and enough to saturate a typical home connection. The bottleneck is almost never the VPN — it’s whatever garbage Wi-Fi you’re on.

WireGuard is a VPN protocol built around a fixed modern cipher suite and a roughly four-thousand-line codebase, in deliberate contrast to the negotiate-everything design of its predecessors. OpenVPN is the older userspace alternative, which runs TLS over UDP or TCP and is far more configurable, at the cost of being far easier to configure badly.

WireGuard’s crypto is lean. No TLS handshake per packet, no complex cipher negotiation. Just Curve25519 key exchange and ChaCha20-Poly1305 AEAD. It uses about 4% CPU at 500 Mbps on a single core.

What this setup does NOT do

Anonymity. Your VPS provider knows who you are (billing) and sees all your traffic. A subpoena lands on them, not you. This is privacy from local networks, not from nation-states.
Bypass geo-blocks reliably. Streaming services block known data-center IP ranges. Your VPS IP is almost certainly in one.
Replace a corporate VPN. No MFA, no SSO, no user directory. This is a personal tool, not an enterprise remote-access solution.

Alternatives

Tailscale — WireGuard under the hood with a coordination layer. Easier setup, but you’re trusting Tailscale’s coordination server. Free for up to 100 devices.
OpenVPN — still works, still supported, but slower and more complex to configure than WireGuard. Use it only if you need something WireGuard doesn’t do (like TCP mode for truly hostile networks).
Algo VPN — another good setup script, supports both WireGuard and IPsec IKEv2. More features, slightly more complex.

Why this matters for a network engineer

Running your own VPN isn’t just about privacy — it’s about understanding tunnels. When you set up WireGuard, you’re configuring:

A virtual network interface with its own IP space
Public-key cryptography for peer authentication
A routing table entry that sends traffic through the tunnel
NAT on the server side to forward traffic to the internet

Every one of those concepts maps directly to things you touch in enterprise networking: GRE tunnels, IPsec SAs, VRF route leaking, source NAT. Running a personal VPN keeps those skills sharp in a way that reading docs doesn’t.