onionvps

Solution

VPS for a personal VPN server (WireGuard & OpenVPN)

Skiff 1 · $4/moSkiff 2 · $7/mo
Short answer

A personal VPN needs almost no CPU and almost no disk — it needs bandwidth and a jurisdiction you trust. One shared core, 1 GB of RAM and a WireGuard install will saturate a gigabit port. Choose the location by law, not by specification: a $4 Skiff 1 in Panama or Zurich outperforms a large instance in a Fourteen Eyes country for this purpose.

What you need

Specification floor for personal vpn server
ResourceWhat you actually need
vCPU1 shared core is sufficient up to ~900 Mbit/s with WireGuard
RAM1 GB (WireGuard uses under 30 MB)
Disk20 GB
Transfer2 TB covers roughly 8 hours a day of 1080p streaming
NetworkNative IPv6 matters — many VPN clients prefer dual stack

Recommended plans

Skiff

Skiff 1

$ 4 /month
vCPU
1 × shared
RAM
1 GB
Storage
20 GB NVMe SSD
Transfer
2 TB
IPv4 / IPv6
1 / /64 routed
Configure
Skiff

Skiff 2

$ 7 /month
vCPU
1 × shared
RAM
2 GB
Storage
40 GB NVMe SSD
Transfer
3 TB
IPv4 / IPv6
1 / /64 routed
Configure

Recommended locations

Location is usually the decision that matters most for this workload — either because latency dominates, or because jurisdiction does.

🇵🇦

Panama City

Panama No alliance

🇨🇭

Zurich

Switzerland No alliance

🇮🇸

Reykjavík

Iceland No alliance

🇲🇩

Chișinău

Moldova No alliance

🇲🇾

Kuala Lumpur

Malaysia No alliance

Why OnionVPS for this

  • WireGuard runs in kernel space, so it needs a real kernel — a KVM instance, not a container.
  • We keep no connection logs and no netflow records, so there is nothing to hand over about your tunnel.
  • Every instance ships a routed IPv6 /64, which lets you hand each device its own public v6 address.
  • Ports are open by default; we do not filter UDP 51820 or require a justification form.

How to set it up

  1. Deploy a Skiff 1 in a no-alliance jurisdiction

    Panama, Switzerland, Iceland, Moldova or Malaysia. Provisioning takes under a minute.

  2. Install WireGuard

    apt install wireguard on Debian or Ubuntu; the kernel module is already present.

  3. Generate keys and a server config

    wg genkey | tee private.key | wg pubkey > public.key, then write /etc/wireguard/wg0.conf.

  4. Enable IP forwarding and NAT

    Set net.ipv4.ip_forward=1 and add an nftables masquerade rule for the tunnel subnet.

  5. Bring the interface up and add peers

    systemctl enable --now wg-quick@wg0, then add one [Peer] block per device.

Frequently asked questions

Is running your own VPN more private than a commercial VPN?

It removes the provider from the trust equation but replaces the crowd. Your traffic is no longer mixed with thousands of other users, so the exit IP is uniquely yours. Self-hosting wins when your threat model is interception or geo-restriction; a large shared VPN wins when it is traffic correlation.

How much bandwidth does a VPN VPS need?

Budget your real usage plus 15% for protocol overhead. 1080p video is roughly 3 GB per hour, so 2 TB supports about 650 hours a month.

Can I use the VPS as a VPN for my whole household?

Yes. A single shared core handles 20+ concurrent WireGuard peers comfortably; the limit is your uplink, not the instance.