Set Up Your Own VPN Server

Why Self-Host a VPN?

Commercial VPN services are convenient, but they come with tradeoffs. Someone else controls the server, holds the logs, and decides what happens to your data. When you self-host, everything changes.

• •You own the server — No third party can see your traffic, throttle your speed, or sell your browsing data. The logs belong to you and you alone.
• •Access your home network from anywhere — This is the real killer feature. Connect to your VPN and it's like you're sitting at home. Access your NAS, smart home dashboard, media server, or development machine from a coffee shop, hotel, or another country.
• •No monthly subscription — Once your server is running, the only ongoing cost is electricity. A Raspberry Pi 4 draws about 5 watts — that's pennies a month.
• •Share access with family — Give your partner, kids, or parents secure access to shared resources like photo backups, document servers, or your media library — without exposing anything to the public internet.

We'll use WireGuard, the modern VPN protocol that's faster, simpler, and more secure than older options like OpenVPN. It's built into the Linux kernel and has clients for every platform.

Step 1. Gather Your Prerequisites

Before you touch any config files, make sure you have these basics in place:

• •A server that stays on — Any Linux machine that runs 24/7. A Raspberry Pi 4 or 5 is ideal (low power, silent). An old laptop running Ubuntu works too. If you don't have hardware at home, a cheap VPS (around $5/month from providers like Hetzner or DigitalOcean) is a solid alternative.
• •Docker and Docker Compose installed — We'll use WG-Easy, which runs in Docker. If you need help, check our Docker setup guide first.
• •A domain name (recommended) — You don't strictly need one, but typing vpn.yourdomain.com into your WireGuard config is much nicer than remembering an IP address that might change. Any domain registrar works — Namecheap, Cloudflare, or Porkbun.
• •Port forwarding on your router — WireGuard uses UDP port 51820 by default. You'll need to forward this port from your router to your server's local IP address. Every router does this differently — search "[your router model] port forwarding" for specific instructions.
• •A static local IP for your server — Set a DHCP reservation in your router so your server always gets the same IP address (e.g., 192.168.1.100). Otherwise port forwarding will break when the IP changes.

Step 2. Install WG-Easy with Docker Compose

WG-Easy is the simplest way to run WireGuard. It bundles the VPN server with a clean web interface for managing clients — no command-line config file editing required.

Create a new directory for your VPN setup and add a Docker Compose file:

Here's the Docker Compose configuration. Copy this into docker-compose.yml:

Now start it up:

Once it starts, the web UI is available at http://your-server-ip:51821. Log in with the password you set in the config.

Step 3. Configure Your Clients

WG-Easy's web UI makes client setup trivially easy. You can generate config files for each device, and for phones and tablets, you can even scan a QR code.

• •From the WG-Easy web UI — Click "New Client," give it a name (like "Phone" or "Laptop"), and it generates a config file instantly. Download the .conf file or scan the QR code with your phone.
• •On your laptop (Linux/Mac/Windows) — Install the WireGuard client for your OS. Open the app, import the .conf file, and click connect. That's it.
• •On your phone (iOS/Android) — Install the WireGuard app from the App Store or Play Store. Open the app, tap the + button, and choose "Scan from QR code." Point your camera at the QR code in the WG-Easy web UI. Tap connect when done.

Each device gets its own config file with a unique private key. This means you can revoke access for a single device without affecting others — great if a phone gets lost.

About AllowedIPs: 0.0.0.0/0 means "route all traffic through the VPN." If you only want to access your home network while keeping regular internet traffic local, change it to your home network range (e.g., 192.168.1.0/24). This is called a "split tunnel."

Step 4. Test the Connection

Before you rely on this for anything important, verify everything works. Test from outside your home network — disconnect from Wi-Fi and use your phone's mobile data, or test from a coffee shop.

• •Check your IP — Connect to the VPN and visit whatismyipaddress.com. The IP shown should be your home IP address, not your phone's or the coffee shop's.
• •Ping a local device — From your laptop (connected via VPN), try pinging a device on your home network by its local IP: ping 192.168.1.50. If it responds, your VPN can see your home network.
• •Access a service — Try opening a service that's only available on your home network, like your router's admin page or a self-hosted dashboard. If it loads, everything is working.
• •Run a speed test — Your VPN speed will be limited by your home internet's upload speed. If your home upload is 20 Mbps, your VPN won't go faster than that. This is fine for accessing files and services but not ideal for streaming 4K video.

Step 5. Harden Your Security

A VPN server is an entry point to your home network. Treat it with the same caution you'd give any internet-facing service.

• •Use a strong admin password — The WG-Easy web UI password should be at least 20 characters, random, and unique. Use a password manager. If someone guesses this, they can add themselves as a VPN client.
• •Don't expose the web UI to the internet — WG-Easy's web UI runs on port 51821. Only the VPN port (51820/UDP) needs to be forwarded on your router. Access the web UI from within your home network, or tunnel in with Tailscale if you need remote admin access.
• •Set up automatic updates — Docker containers don't update themselves. Use Watchtower to automatically pull the latest WG-Easy image. Add this to your docker-compose.yml or run it alongside your existing containers.
• •Configure your firewall — If your server runs UFW (common on Ubuntu/Debian), make sure only the necessary ports are open:

• •Audit your clients regularly — Every few months, review the client list in WG-Easy's web UI. Remove any devices you no longer use. If a device was lost or stolen, revoke its access immediately.
• •Consider using a VPS as a jump box — If you're very security-conscious, run the VPN on a cheap VPS rather than on hardware inside your home network. This way, even if the VPN is compromised, the attacker isn't inside your LAN. The VPN becomes a controlled entry point rather than a direct bridge.

Step 6. Going Further — What to Build Next

Now that your VPN is running, here's what you can do with it:

• •Access your media server anywhere — Connect to your VPN and stream from Jellyfin or Plex as if you were on the couch. No need to expose your media server to the public internet at all.
• •Use your Pi-hole on the go — Set your WireGuard DNS to your Pi-hole's IP. Now you get ad blocking on your phone even when you're on mobile data. See our guide on Pi-hole setup for details.
• •Secure public Wi-Fi — Whenever you're on airport, hotel, or coffee shop Wi-Fi, flip on your VPN. All your traffic is encrypted back to your home network, safe from snooping on the local network.
• •Remote development — SSH into your home development machine, access your NAS, or pull up your self-hosted Git server — all through your VPN tunnel.
• •Combine with Tailscale for mesh networking — WireGuard gives you a hub-and-spoke VPN (all traffic through your server). Tailscale (also built on WireGuard) gives you a mesh where devices connect directly. Use both: WireGuard for remote access, Tailscale for connecting your own devices peer-to-peer.

Quick Tips

• •If your home IP address changes (most residential connections do), use a dynamic DNS service like DuckDNS (free) or Cloudflare DDNS to keep your domain pointing at the right IP.
• •If you're behind a carrier-grade NAT (CGNAT) — common with 5G home internet and some ISPs — you won't be able to port forward. In that case, use Tailscale or a VPS with a public IP instead.
• •WireGuard is extremely efficient. A Raspberry Pi 4 can handle 500+ Mbps of VPN throughput without breaking a sweat. You almost certainly don't need powerful hardware.
• •Back up your ~/wireguard/data directory regularly. It contains all client keys and configs. If you lose it, you'll need to regenerate every client's config from scratch.
• •If the VPN suddenly stops working after being fine for months, check three things: did your home IP change, is your Docker container still running, and did your ISP start blocking UDP ports?