Commercial VPN services (NordVPN, ExpressVPN, ProtonVPN) cost $5-15/month and route your traffic through their servers. A personal WireGuard VPN on a $4.60/mo Hetzner VPS gives you the same benefits (encrypted tunnel from your device to somewhere else on the internet) at pocket-money cost, with the tradeoff that you're the only user (which is a feature for privacy, not a bug).

Prices as of 2026-09-22.

Why do this

• Encrypted tunnel from your device to your VPS.
• Exit from your VPS's IP address — useful for geo-restricted content or hiding your home IP.
• Faster than commercial VPNs (WireGuard is faster than OpenVPN by design; and you don't share with 10,000 other users).
• Cheap. $4.60/mo Hetzner VPS.
• Privacy from your ISP. Your ISP sees encrypted traffic to your VPS; not the websites you visit.

Not:

• Anonymity from the VPS host. Hetzner logs your VPN traffic, in principle.
• Traffic obfuscation for hostile-country contexts. Wireguard's protocol is detectable.

The stack

• A VPS. Hetzner CX22 at $4.60/mo is fine. Or any $5 VPS.
• WireGuard on both the VPS (server) and your device (client).

Total cost: $4.60/month.

Total setup time: 15 minutes.

Step 1: Provision a VPS

Hetzner Cloud Console → Create Server → CX22, Ubuntu 24.04 LTS. Choose a region — the closer to your physical location, the faster the VPN.

Step 2: Install WireGuard

SSH into the VPS as root:

```bash

apt update

apt install wireguard qrencode

```

Step 3: Generate keys

```bash

cd /etc/wireguard

umask 077

Server keys

wg genkey | tee server_private.key | wg pubkey > server_public.key

Client keys (one for each device you'll connect from)

wg genkey | tee client1_private.key | wg pubkey > client1_public.key

```

Step 4: Create the server config

/etc/wireguard/wg0.conf:

```

[Interface]

Address = 10.0.0.1/24

ListenPort = 51820

PrivateKey = <contents of server_private.key>

PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]

PublicKey = <contents of client1_public.key>

AllowedIPs = 10.0.0.2/32

```

Enable IPv4 forwarding:

```bash

echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.conf

sysctl -p

```

Open port 51820 in your firewall:

```bash

ufw allow 51820/udp

```

Start WireGuard:

```bash

systemctl enable --now wg-quick@wg0

```

Verify:

```bash

wg show

Should show wg0 with a peer configured

```

Step 5: Create the client config

Get your VPS's public IP: curl ifconfig.me.

Create client1.conf on your VPS (this file gets copied to your client device):

```

[Interface]

Address = 10.0.0.2/24

PrivateKey = <contents of client1_private.key>

DNS = 1.1.1.1

[Peer]

PublicKey = <contents of server_public.key>

Endpoint = <your VPS public IP>:51820

AllowedIPs = 0.0.0.0/0

PersistentKeepalive = 25

```

AllowedIPs = 0.0.0.0/0 routes ALL your traffic through the VPN. For split-tunnel (only certain networks), narrow this.

Step 6: Connect from your device

On macOS / iOS / Android

Download the WireGuard app from the App Store / Play Store. Import the client1.conf file. Toggle on.

iOS/Android tip: generate a QR code from your VPS:

```bash

qrencode -t ansiutf8 < client1.conf

```

Scan with the WireGuard mobile app.

On Linux

```bash

apt install wireguard

cp client1.conf /etc/wireguard/

wg-quick up client1

```

To disconnect: wg-quick down client1.

On Windows

Download the WireGuard installer from wireguard.com. Import the config file. Click "Activate".

Step 7: Verify

Before the tunnel: curl ifconfig.me on your device should show your ISP's IP.

After the tunnel: same command should show your VPS's IP.

DNS leak test: dnsleaktest.com should show only Cloudflare's 1.1.1.1 (which we configured as DNS).

Adding more devices

Repeat client key generation for each device:

```bash

cd /etc/wireguard

wg genkey | tee client2_private.key | wg pubkey > client2_public.key

```

Add to /etc/wireguard/wg0.conf:

```

[Peer]

PublicKey = <contents of client2_public.key>

AllowedIPs = 10.0.0.3/32

```

Reload: systemctl restart wg-quick@wg0.

Create client2.conf with the same shape as client1.conf but Address = 10.0.0.3/24 and its own private key.

Bandwidth cost

Your VPN traffic uses your VPS's bandwidth allowance. Hetzner CX22 includes 20 TB/month. Streaming 4K Netflix through the VPN for 8 hours/day for a month: ~180 GB. You're not going to hit 20 TB with normal personal use.

Advantages over commercial VPN

• Faster. Not sharing your server with 10,000 other users.
• Cheaper. $4.60 vs $10-15.
• Full control. You choose the exit country by choosing your VPS region.
• You know who's logging. Hetzner is your host; a paid VPN has vendor logging you can't audit.
• Privacy from ISP. Same as any VPN.

Disadvantages

• You're the exit node. Traffic from the VPN's IP looks like it's from your VPS. If you do abusive things through the VPN, your VPS gets flagged.
• No traffic obfuscation. WireGuard's protocol is detectable — countries that block VPNs will block WireGuard.
• Setup requires technical skill. Commercial VPN apps are one-tap; this takes 15 minutes.
• Single exit country. Commercial VPNs let you switch servers instantly.

Related guides

• How to secure a VPS — general VPS hardening.
• Cheapest VPS under $10 in 2026 — the $4.60 Hetzner in context.
• Best hosting for a Docker / self-hosted stack — WireGuard fits in a self-hosted stack.