Create Your Own VPN Server Setup Guide 2026: WireGuard vs OpenVPN for Self-Hosted VPNs

Photo of author
Jake Colins

The best self-hosted VPN for most people in 2026 is WireGuard. It is fast, clean, and easy to run on a tiny VPS. OpenVPN is still useful when you need older device support, strict network compatibility, or very mature enterprise features. If you want a simple private tunnel for travel, coffee shops, home labs, or remote work, start with WireGuard.

TLDR: Use WireGuard if you want speed and simple setup. Use OpenVPN if you need maximum compatibility with old routers, old phones, or locked-down networks. For example, a $5 per month VPS can usually handle 5 to 10 personal devices, and WireGuard often uses 15% to 30% less CPU than OpenVPN in common home setups. If your goal is “secure my laptop at hotels,” WireGuard wins.

Why build your own VPN server?

A self-hosted VPN gives you a private tunnel to a server you control. Your phone, laptop, or tablet connects to that server. Your traffic then exits from that server’s internet connection.

This is useful when you want:

  • Safer public Wi Fi at airports, cafes, and hotels.
  • Remote access to home services like NAS, cameras, or dashboards.
  • A fixed IP address from a VPS provider.
  • Less mystery than using a random free VPN app.

To be clear, your self-hosted VPN does not make you invisible. Your VPS host can still see that your server is sending traffic. Websites can still track logins, cookies, and browser fingerprints. But it does protect your traffic from snoops on bad local networks.

WireGuard vs OpenVPN in plain English

WireGuard is the sleek scooter. Small engine. Very quick. Easy to park. It uses modern crypto and has a tiny code base compared with OpenVPN. That means fewer moving parts.

OpenVPN is the sturdy old truck. It has been around for years. It works almost everywhere. It has many knobs and switches. Sometimes too many. Honestly, it feels like OpenVPN asks you three questions when one would do.

Feature WireGuard OpenVPN
Speed Usually faster Good, but often slower
Setup Simple More steps
Battery use Often better on phones Can use more power
Compatibility Great on modern systems Excellent on old systems
Best for Personal VPNs, phones, laptops Legacy gear, strict networks

What you need before setup

You do not need a monster server. A tiny VPS is enough.

  • A VPS with Ubuntu 24.04 LTS or newer.
  • 1 CPU core.
  • 512 MB to 1 GB RAM.
  • A public IPv4 address.
  • SSH access.
  • Basic comfort with copy and paste. Yes, that counts.

Popular VPS sizes cost around $4 to $8 per month. Pick a region near you. If you live in Berlin, do not choose a server in Los Angeles unless you enjoy lag as a lifestyle choice.

Quick WireGuard setup

This is the clean path. It suits most people.

  1. Update the server.
    sudo apt update && sudo apt upgrade -y
  2. Install WireGuard.
    sudo apt install wireguard -y
  3. Create server keys.
    wg genkey | tee server_private.key | wg pubkey > server_public.key
  4. Create a config file.
    sudo nano /etc/wireguard/wg0.conf

Add a basic config like this. Replace the private key with your real one.

[Interface]
Address = 10.8.0.1/24
ListenPort = 51820
PrivateKey = SERVER_PRIVATE_KEY
PostUp = iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

Now turn on IP forwarding.

echo "net.ipv4.ip_forward=1" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

Start WireGuard.

sudo systemctl enable wg-quick@wg0
sudo systemctl start wg-quick@wg0

Open the firewall port.

sudo ufw allow 51820/udp

Now add a client. Your phone or laptop also needs a private key and public key. The server stores the client public key. The client stores the server public key. It is like trading secret club badges, but less weird.

WireGuard client example

A simple client config looks like this:

[Interface]
PrivateKey = CLIENT_PRIVATE_KEY
Address = 10.8.0.2/32
DNS = 1.1.1.1

[Peer]
PublicKey = SERVER_PUBLIC_KEY
Endpoint = YOUR_SERVER_IP:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

Import it into the WireGuard app. On mobile, you can use a QR code. On desktop, import the file. Tap connect. If it works, celebrate with a snack. If it does not, check your keys. It is almost always the keys.

Quick OpenVPN setup

OpenVPN takes more effort, but it is still a solid choice.

The easiest route is using a trusted install script or a package like OpenVPN Access Server. For a manual setup, you install OpenVPN, create a certificate authority, create server and client certificates, configure routing, and open a port.

That is a lot of certificate juggling. It drives me crazy that one typo in a certificate name can eat 20 minutes like a tiny gremlin.

Basic install:

sudo apt update
sudo apt install openvpn easy-rsa -y

Then you create keys with Easy RSA, build a server config, and export a client .ovpn file. Most client apps can import that file. OpenVPN commonly uses UDP 1194, but it can also run over TCP 443. That is handy on networks that block unusual ports.

When to choose OpenVPN

Pick OpenVPN if you need:

  • Old router support with built-in OpenVPN clients.
  • TCP mode for restrictive networks.
  • Certificate-based access with familiar admin flows.
  • Proven compatibility across many older platforms.

OpenVPN is slower in many cases. Still, “slower” does not mean bad. For email, admin panels, SSH, and basic browsing, it is fine. For gaming or heavy video use, WireGuard usually feels smoother.

Security tips for both

  • Disable password SSH login. Use SSH keys.
  • Turn on automatic security updates.
  • Use a firewall. Only open the VPN port and SSH.
  • Keep client keys private. Treat them like passwords.
  • Remove lost devices fast. Delete their peer or certificate.
  • Check logs. Weird login attempts happen all the time.

Also, do not run random “one click VPN” scripts from mystery forums. Read the script first. If that sounds boring, good. Security is often boring. Boring is safe.

Which one should you install in 2026?

For most personal users, install WireGuard. It is fast, modern, and simple. It is great for phones, laptops, tablets, and home lab access.

Install OpenVPN when you need older device support or when you must blend into networks that block UDP traffic. It is also useful if your workplace already uses OpenVPN workflows.

Here is the simple rule:

  • Want easy and fast? Choose WireGuard.
  • Need old gear support? Choose OpenVPN.
  • Want both? Run both on the same VPS with different ports.

Final recommendation

Start with WireGuard on a small VPS. Add your laptop first. Then add your phone. Test it on mobile data, hotel Wi Fi, and your home network. Keep the config backed up somewhere safe.

If WireGuard gets blocked on a strict network, add OpenVPN later as a backup. That gives you speed when life is normal and a fallback when some grumpy airport Wi Fi decides to be difficult.

A self-hosted VPN is not magic. But it is useful. It makes public networks safer. It gives you clean remote access. And once it works, it quietly does its job. That is the best kind of server.