The Complete Guide to Self-Hosted VPN: From VPS Selection to WireGuard Deployment

1. VPS Selection Criteria

Choosing the right VPS is the first step in building your own VPN. Prioritize the following factors:

• Geographic Location: Select a data center close to your physical location or with favorable network routes to reduce latency.
• Bandwidth and Traffic: At least 1Gbps port with unmetered or high-traffic plans is ideal for long-term use.
• Network Quality: Avoid congested lines during peak hours; check third-party reviews or trial periods.
• Cost-Effectiveness: Entry-level plans (1 vCPU, 1GB RAM, 25GB SSD) suffice for WireGuard, costing around $5-10/month.

Recommended providers: DigitalOcean, Vultr, Linode (global routes); Alibaba Cloud International, Tencent Cloud Light (Asia optimized).

2. OS Selection and Initial Setup

Ubuntu 22.04 LTS or Debian 11 are recommended for stability and community support.

1. SSH into your VPS: ssh root@your_server_ip
2. Update the system: apt update && apt upgrade -y
3. Enable firewall: ufw allow 22/tcp && ufw enable
4. Create a regular user and disable root login (security hardening).

3. WireGuard Deployment Steps

WireGuard is known for its simplicity, efficiency, and modern cryptography.

3.1 Install WireGuard

apt install wireguard -y

3.2 Generate Key Pair

wg genkey | tee /etc/wireguard/server_private.key | wg pubkey > /etc/wireguard/server_public.key
chmod 600 /etc/wireguard/server_private.key

3.3 Configure Server

Create /etc/wireguard/wg0.conf:

[Interface]
Address = 10.0.0.1/24
ListenPort = 51820
PrivateKey = <server_private_key>

PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
PublicKey = <client_public_key>
AllowedIPs = 10.0.0.2/32

3.4 Start Service

systemctl enable wg-quick@wg0
systemctl start wg-quick@wg0

3.5 Client Configuration

Install the WireGuard client on your local device and create a similar config:

[Interface]
PrivateKey = <client_private_key>
Address = 10.0.0.2/24
DNS = 1.1.1.1

[Peer]
PublicKey = <server_public_key>
Endpoint = your_server_ip:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

4. Performance Optimization and Security Hardening

• Enable TCP BBR: echo "net.core.default_qdisc=fq" >> /etc/sysctl.conf && echo "net.ipv4.tcp_congestion_control=bbr" >> /etc/sysctl.conf && sysctl -p
• Adjust MTU: Set MTU=1420 to reduce fragmentation based on network conditions.
• Regular Updates: Keep the system and WireGuard up to date.
• Monitor Traffic: Use iftop or vnstat to observe bandwidth usage.

5. Common Troubleshooting

• Connection Timeout: Check if UDP port 51820 is open in the firewall.
• DNS Leak: Ensure a DNS server is specified in the client config.
• Slow Speed: Try switching VPS nodes or enabling BBR.

Related reading

• Multi-Path Redundancy and Intelligent Failover: A Practical Guide to Building High-Availability VPN Architectures