Commercial VPN services bundle two different things: encrypting your traffic on untrusted networks, and masking your location behind a shared pool of IPs to get around geographic restrictions. A self-hosted VPN gives you the first, fully and for a few dollars a month in server costs — but not the second, since the traffic still exits from a server that's identifiably yours, not a shared pool. If your goal is "encrypt my traffic on coffee shop Wi-Fi," this is a complete solution.
01Get a cheap VPS
Any provider works — DigitalOcean, Linode, Hetzner, Vultr all offer VPS instances for around $4-6/month, which is more than enough for personal VPN traffic. Choose a location close to where you'll actually be using it, for lower latency.
02Install WireGuard
WireGuard is the modern standard for this — simpler to configure and faster than older options like OpenVPN.
sudo apt update && sudo apt install wireguard03Generate server keys
wg genkey | sudo tee /etc/wireguard/server_private.key | wg pubkey | sudo tee /etc/wireguard/server_public.key04Create the server config
sudo nano /etc/wireguard/wg0.conf[Interface]
PrivateKey = [contents of server_private.key]
Address = 10.0.0.1/24
ListenPort = 51820
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADEEnable IP forwarding so the server can route your traffic onward to the internet:
echo "net.ipv4.ip_forward=1" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p05Add a client (your phone or laptop)
Generate a key pair for the client the same way as Step 3, then add a peer block to wg0.conf:
[Peer]
PublicKey = [client's public key]
AllowedIPs = 10.0.0.2/32On the client side, use the official WireGuard app (available for iOS, Android, Windows, macOS) and create a matching config pointing at your server's public IP and port 51820.
06Start it and open the firewall port
sudo wg-quick up wg0
sudo systemctl enable wg-quick@wg0
sudo ufw allow 51820/udp07Test it
Connect from your client device and check your IP at any "what's my IP" site — it should show your VPS's IP address, confirming traffic is routing through the server.