Most commercial VPN services work the same basic way: your computer or phone creates an encrypted connection to a remote server, and that server becomes the gateway between you and the Internet.
But you do not necessarily need to pay a commercial VPN company every month to do this.
With an inexpensive VPS, WireGuard and a properly configured browser, you can operate your own personal VPN server for only a few dollars per month while maintaining complete control over the server configuration.
This setup is especially useful for business owners, developers, remote workers and anyone who regularly uses public Wi-Fi or wants an additional layer of privacy while browsing.
What Is a Self-Hosted VPN?
A self-hosted VPN uses a virtual private server that you control instead of connecting through a commercial VPN provider.
The connection looks like this:
Computer / Phone
|
Encrypted WireGuard Connection
|
Private VPS
|
Internet
When the VPN is active, websites see the public IP address of the VPS rather than the IP address assigned by your home Internet provider, hotel, coffee shop or cellular carrier.
Traffic between your device and the VPS is encrypted using WireGuard.
The VPS Requirements Are Surprisingly Small
WireGuard is extremely lightweight. You do not need an expensive cloud server.
For this project, I used a basic KVM VPS with:
1 CPU Core
1 GB RAM
1 GB Swap
20 GB Storage
Approximately 3 TB Monthly Bandwidth
Dedicated IPv4 Address
Debian Linux
The VPS is located in Chicago to minimize latency for devices connecting from the Chicago area.
For a server whose primary job is running WireGuard, even this configuration provides plenty of resources.
The VPS does not need Apache, MySQL, WordPress, Docker, a control panel or a graphical desktop.
Keeping the server minimal also reduces the number of services exposed to the Internet.
Why WireGuard?
WireGuard is a modern VPN protocol designed to be fast, lightweight and relatively simple to configure.
Compared with older VPN technologies, WireGuard requires very little overhead and works particularly well on phones and laptops.
It is available for:
Windows
macOS
Linux
iPhone
iPad
Android
Each device gets its own cryptographic key pair and private VPN address.
In this configuration, the VPN server uses:
10.66.66.1
with individual devices receiving addresses such as:
Windows PC
10.66.66.2
iPhone
10.66.66.3
Additional devices can easily be added later.
Installing WireGuard on Debian
The VPS runs Debian Linux with WireGuard installed directly on the operating system.
IP forwarding is enabled so that Debian can forward traffic from WireGuard clients to the public Internet.
The VPS then performs NAT through its primary network interface.
Conceptually:
10.66.66.x
|
WireGuard
|
Debian VPS
|
NAT
|
Public VPS IP
|
Internet
WireGuard listens on:
UDP 51820
Once configured, WireGuard is registered as a system service so that the VPN automatically starts whenever the VPS reboots.
This is important because a VPN server should not require manual intervention after normal maintenance or a hosting-provider restart.
Full-Tunnel VPN Configuration
For this particular setup, the devices use a full tunnel.
That means normal IPv4 Internet traffic is routed through WireGuard instead of only routing specific private networks through it.
The client configuration uses:
AllowedIPs = 0.0.0.0/0
When the tunnel is active, a browser visiting an IP-checking service sees the VPS’s IP address rather than the user’s normal Internet connection.
This makes the VPN useful when using:
hotel Wi-Fi
airport Wi-Fi
coffee shops
public hotspots
mobile networks
untrusted networks
The device-to-VPS portion of the connection remains encrypted even if the local network cannot be trusted.
Separate Keys for Every Device
Every WireGuard device should have its own private key.
The Windows computer and iPhone in this setup therefore have different WireGuard identities.
The server only needs the public key belonging to each client.
The client private keys should remain on the devices whenever possible.
After the Windows configuration was created and imported, the temporary copy containing the Windows private key was deleted from the VPS.
This follows an important security principle:
A private key should exist only where it is actually needed.
Securing SSH
Installing the VPN was only part of the project.
A publicly accessible Linux VPS is constantly scanned by automated systems looking for servers with weak passwords, outdated software and exposed services.
The SSH configuration was therefore hardened as well.
Instead of logging into the server with a password, an Ed25519 SSH key was generated on the Windows computer.
The public key was installed on the server.
After confirming key authentication worked correctly, password authentication was disabled:
PasswordAuthentication no
Root access was also configured as:
PermitRootLogin prohibit-password
This means the root account can still be accessed with the authorized cryptographic key, but not by someone repeatedly guessing passwords.
Every configuration change was tested from a second SSH session before the existing connection was closed.
That small precaution can prevent accidentally locking yourself out of a remote server.
Adding a Default-Deny Firewall
The server was also configured with a restrictive inbound firewall.
Instead of accepting arbitrary inbound connections, the default INPUT policy is:
DROP
Only the required traffic is explicitly allowed.
That includes:
TCP 22
SSH
UDP 51820
WireGuard
Loopback traffic
Established and related connections
ICMP
Everything else reaching the server is dropped.
The result is a very small publicly exposed attack surface.
Running:
ss -tulpn
confirmed that only SSH and WireGuard were listening for external connections.
Making Firewall Rules Permanent
Linux firewall rules entered manually do not necessarily survive a reboot.
The configuration therefore uses persistent firewall rules that automatically load when Debian starts.
There is one important detail with WireGuard.
The forwarding and NAT rules created by wg-quick should not also be permanently duplicated in the saved firewall configuration.
Otherwise those rules can accumulate as WireGuard starts and stops.
The permanent firewall handles the server’s inbound protection, while WireGuard manages its own forwarding and masquerading rules.
Automatic Security Updates
A VPN server exposed to the Internet should also receive regular security updates.
Debian’s unattended upgrade system was enabled so security updates can be installed automatically.
After configuration, the service was verified as running.
That reduces the likelihood of the VPS quietly sitting online for months with known vulnerabilities.
Testing Everything After a Reboot
One of the most important steps was a complete VPS reboot.
After rebooting, the following were verified:
WireGuard automatically started.
The WireGuard interface returned.
Both client peers remained configured.
SSH key authentication still worked.
Password authentication remained disabled.
The firewall returned with the default DROP policy.
The iPhone successfully reconnected.
Internet traffic continued exiting through the VPS IP address.
A setup is not really complete until it survives a reboot.
Using Brave Browser With the VPN
The VPN protects network traffic between the device and the VPS, but it is important to understand what a VPN does not do.
A VPN does not automatically prevent browser fingerprinting.
Websites can potentially identify or correlate browsers using characteristics such as:
screen dimensions
browser configuration
cookies
local storage
fonts
graphics capabilities
WebGL
WebRTC behavior
installed browser extensions
language settings
logged-in accounts
For that reason, Brave Browser can complement the VPN.
Brave contains several privacy protections intended to limit tracking and browser fingerprinting.
For a privacy-focused Brave configuration, unnecessary browser features and extensions should also be minimized.
Disable Media Router If You Do Not Use Casting
One example is Brave’s built-in Media Router functionality.
Media Router allows the browser to discover Chromecast and other compatible devices on the local network.
If casting is never used, there is little reason to leave that functionality enabled.
It can be disabled from Brave’s extension settings.
Removing unnecessary browser capabilities reduces network discovery activity and keeps the browser configuration simpler.
WebRTC Deserves Attention
WebRTC allows browsers to establish real-time communications used by applications such as voice and video calling.
Because WebRTC interacts directly with networking functionality, it has historically been an area worth reviewing when using VPNs.
Brave provides controls for WebRTC IP handling.
A privacy-focused browser configuration should prevent non-proxied UDP connections from bypassing the intended VPN route.
Keep Browser Extensions to a Minimum
Installing dozens of privacy extensions can sometimes be counterproductive.
Every extension changes browser behavior.
A highly customized browser can potentially become more unique than a relatively standardized browser.
For everyday privacy, I prefer to let Brave’s built-in protections handle most tracking prevention rather than installing a large collection of overlapping extensions.
A VPN Is Privacy, Not Complete Anonymity
This distinction is important.
A self-hosted WireGuard server provides:
encrypted traffic between your device and VPS
protection on untrusted local networks
a different public Internet IP address
control over the VPN infrastructure
protection from your local network seeing individual destinations in plaintext DNS/traffic patterns, depending on configuration
secure remote networking capabilities
But it does not make someone invisible online.
A dedicated VPS IP address can itself become a persistent identifier.
Logging into Google, Facebook, Amazon, Microsoft or another personal account obviously identifies the user to those services regardless of the VPN.
Browser fingerprinting may also allow unrelated browsing sessions to be correlated.
A self-hosted VPN should therefore be viewed as one layer in a broader privacy strategy.
For More Privacy-Sensitive Browsing
For situations where browser fingerprint resistance is more important, a browser such as Mullvad Browser can be used alongside WireGuard.
The architecture becomes:
Mullvad Browser
|
WireGuard
|
Private VPS
|
Internet
For substantially stronger anonymity requirements, Tor Browser and the Tor network provide an entirely different model designed specifically around making users more difficult to distinguish from one another.
That comes with additional performance and usability tradeoffs.
Why Build Your Own VPN?
The biggest advantage is control.
Instead of trusting an unknown VPN company with your traffic, you control the operating system and VPN configuration yourself.
You know:
where the server is hosted
what software is installed
which ports are exposed
which devices have access
which firewall rules are active
whether logging software has been installed
how the VPN is configured
For developers, IT professionals and business owners, that transparency can be valuable.
The Final Configuration
The completed system consists of:
Debian VPS
1 CPU / 1 GB RAM
WireGuard
UDP 51820
Windows Client
10.66.66.2
iPhone Client
10.66.66.3
SSH
Public-key authentication only
Firewall
Default inbound policy: DROP
Automatic security updates
Enabled
WireGuard auto-start
Enabled
The result is a fast, inexpensive personal VPN that automatically starts with the server and works across both desktop and mobile devices.
Need Help Setting Up a Private VPN?
Self-hosting a VPN is inexpensive, but configuring Linux networking, WireGuard, SSH authentication, firewall rules and client devices correctly requires some technical knowledge.
Company Chicago can help businesses and individuals configure secure VPS infrastructure, private WireGuard VPN servers, remote-access environments and custom networking solutions.
Whether you need a private VPN for secure browsing, remote work, server administration or business access, the system can be configured specifically around your devices and security requirements.
Need help building your own private VPN or secure remote-access system? Contact Company Chicago to discuss your setup.