Your own WireGuard VPN in five minutes

Commercial VPNs sell you two things: an encrypted tunnel and a promise about logging. The tunnel is real; the promise you cannot audit. Run WireGuard on your own VPS and there is no promise to trust - it is your server, your keys, and a logging policy you can verify with ls. It takes about five minutes.

Setup

Deploy the smallest KVM plan with Ubuntu or Debian - WireGuard is light enough that the VPN will never be the bottleneck. Then use the excellent community install script:

curl -O https://raw.githubusercontent.com/angristan/wireguard-install/master/wireguard-install.sh
chmod +x wireguard-install.sh
sudo ./wireguard-install.sh

Accept the defaults, add your first client, and the script prints a QR code. Open the WireGuard app on your phone, scan, toggle on - that is the entire onboarding. Add a config per device (phone, laptop, tablet); re-run the script to manage clients.

Open the right door

In the panel firewall, allow UDP on the port the script chose (default 51820). That plus SSH is all this server ever needs open.

What you gain beyond privacy

The underrated part: a VPN is a private network, not just an exit. Services on your VPS - databases, admin panels, Uptime Kuma, AdGuard Home - can bind to the WireGuard interface and become reachable from your devices while staying invisible to the internet. Point your phone's DNS at AdGuard through the tunnel and you get network-wide ad blocking on mobile data, which no browser extension can do.

Fine print

Your traffic exits with your server's IP in our EU datacenter - good for open Wi-Fi safety and consistent geolocation, but it is still one fixed exit, not an anonymity network. For threat models that need more, use Tor. For "the airport Wi-Fi should not see my traffic", five minutes and a tiny VPS solve it permanently.