Build Your Own VPN with WireGuard on a Low-Cost VPS

For many use cases—securing traffic on untrusted WiFi, reaching a home network remotely, keeping browsing out of ISP logs—a self-hosted WireGuard VPS at around ₹350 per month handles the job without renewal-price escalations or marketing claims. Commercial VPNs have their place when you need an exit IP in another country or want to obscure your origin from the sites you visit. For a personal privacy tunnel you control, a VPS is often the simpler choice. The setup described below takes under an hour.

About the prices and versions: Entry VPS plans were going for roughly ₹350 to ₹550 a month when this guide was written, before GST, and the commercial VPN range in the comparison table is from the same check. Hosting prices move quickly, so treat them as indicative rather than a quote. The commands follow the WireGuard documentation linked under Sources; check it before assuming a command or option still matches. The latency ranges are typical figures for Indian connections, not a measurement, and yours will differ with distance, ISP and time of day.

The only thing I’m assuming here is that you can paste commands into a terminal. That’s it. Never rented a VPS before? Skim my VPS beginner guide first and then circle back.

should you even bother

Be honest with yourself about the trade-offs before any money leaves your account.

Factor	Self-hosted WireGuard	Commercial VPN
Monthly cost	≈₹350–₹500 (one VPS)	≈₹150–₹500
Who sees your traffic metadata	Your VPS provider	The VPN company
Locations	One (wherever your VPS is)	Dozens of countries
Shared IP crowd to blend into	No, the IP is yours alone	Yes, thousands per server
CERT-In logging rules	Scope is not decided here; check current CERT-In/MeitY material for the setup	Big providers exited India over it
Learning value	Enormous	Zero

How the CERT-In Directions relate to a personal setup like this is covered in the India section further down.

There’s one catch worth sitting with: the anonymity question. A personal VPN buys you privacy from your ISP and from whatever random network you’re on. The exit IP, though, is uniquely yours. So a website can still stitch your visits together over time. If disappearing into a crowd is the actual goal, a shared commercial service does that better, no contest. For pretty much everything else, self-hosting wins on plain transparency.

step 1: rent a small VPS

WireGuard barely sips resources. Barely. The cheapest tier from almost any provider is plenty: 1 vCPU, somewhere between 512 MB and 1 GB of RAM. What genuinely matters is a decent bandwidth allowance, because on some providers every byte you tunnel gets counted twice in their accounting.

• Singapore region is a common choice for Indian users, typically 40 to 90 ms from most Indian cities. Choosing a foreign region doesn’t change which laws apply to you or to what you do over the tunnel.
• Indian regions (Mumbai, Bengaluru) from international or local providers give the lowest latency, around 10 to 40 ms, good if your goal is just securing public WiFi rather than moving your apparent location.
• Entry plans from providers such as DigitalOcean, Vultr, Hetzner (which has its own Singapore cloud location as well as European ones) and Indian hosts cost a few hundred rupees a month before GST. Check the provider’s current price page, because the figure in the note above was compiled before this guide was published. European regions are often cheaper if about 130 ms of latency is acceptable.

Use a current Ubuntu LTS release (26.04 LTS or 24.04 LTS). Add your SSH key while you’re creating the box, and jot down the public IP. One thing I’d never skip: harden the server before you install anything fun on it. My Ubuntu server security checklist walks through SSH keys, fail2ban, and unattended upgrades, ten minutes, tops.

step 2: install wireguard

SSH in and run:

sudo apt update && sudo apt upgrade -y
sudo apt install wireguard -y

Now generate the server’s key pair. The private key stays put on the server. Always. No exceptions, no “just this once”.

sudo sh -c 'umask 077; wg genkey | tee /etc/wireguard/server_private.key | wg pubkey > /etc/wireguard/server_public.key'

step 3: configure the server

Open up /etc/wireguard/wg0.conf in whatever editor you like. Swap SERVER_PRIVATE_KEY for the actual contents of that key file. One gotcha: the interface name. eth0 needs to match your VPS’s main network interface, so check it with ip a if you’re not sure.

[Interface]
Address = 10.8.0.1/24
ListenPort = 51820
PrivateKey = SERVER_PRIVATE_KEY
PostUp = iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

That PostUp line is doing the heavy lifting. Your tunnelled packets get rewritten so they leave with the VPS’s own IP, and that’s the whole difference between a real internet gateway and a glorified private network. Right. Time to turn on packet forwarding and bring the tunnel up:

sudo chmod 600 /etc/wireguard/wg0.conf   # after creating wg0.conf
echo 'net.ipv4.ip_forward=1' | sudo tee /etc/sysctl.d/99-wireguard.conf
sudo sysctl --system
sudo systemctl enable --now wg-quick@wg0
sudo wg show

Open UDP port 51820 in the provider’s cloud firewall if it has one. If you enabled UFW with the security checklist, allow the port and the forwarded traffic too, or handshakes and browsing will fail:

sudo ufw allow 51820/udp
sudo ufw route allow in on wg0 out on eth0

Replace eth0 with your interface name. At this point sudo wg show should print the interface with no peers attached yet, which is exactly what you want.

step 4: add your first device

Every device, or peer in WireGuard-speak, needs its own key pair and its own address inside the 10.8.0.0/24 range. It’s easiest to generate the phone’s keys right on the box itself:

(umask 077; wg genkey | tee phone_private.key | wg pubkey > phone_public.key)

Tack a peer block onto /etc/wireguard/wg0.conf:

[Peer]
# Anurag's phone
PublicKey = PHONE_PUBLIC_KEY
AllowedIPs = 10.8.0.2/32

Then build the phone’s own config file, phone.conf:

[Interface]
PrivateKey = PHONE_PRIVATE_KEY
Address = 10.8.0.2/32
DNS = 1.1.1.1

[Peer]
PublicKey = SERVER_PUBLIC_KEY
Endpoint = YOUR_VPS_IP:51820
AllowedIPs = 0.0.0.0/0, ::/0
PersistentKeepalive = 25

The AllowedIPs = 0.0.0.0/0, ::/0 on the phone’s side is shorthand for “shove everything through the tunnel”. Including ::/0 matters on Jio and Airtel, which give out IPv6 addresses widely. Without it, a laptop can send IPv6 traffic outside the tunnel. This server has no IPv6 tunnel address, so IPv6 traffic sent into the tunnel is dropped and apps fall back to IPv4. That DNS line keeps your queries from leaking out to whatever network you’ve connected to. Restart the server tunnel with sudo systemctl restart wg-quick@wg0, then you just need to get this config onto the phone. Easiest path: import it by QR code, which is genuinely the neat bit:

sudo apt install qrencode -y
qrencode -t ansiutf8 < phone.conf

Grab the official WireGuard app from the Play Store or App Store, hit the plus button, and scan the QR code straight off your terminal. Toggle it on. Pull up any what-is-my-IP site and it should be showing the VPS’s address now. Once the phone has imported the config, delete the phone’s private key and config from the server with shred -u phone_private.key phone.conf. The server only needs the phone’s public key, which is already in wg0.conf.

Same dance for your laptop, just use 10.8.0.3/32, and so on down the line. Five family devices sit happily on one tiny VPS without it breaking a sweat.

step 5: actually test it

1. Check your public IP from the device; it must match the VPS.
2. Run a DNS leak test in the browser; only your configured DNS (1.1.1.1 here) should appear, never your ISP’s resolvers.
3. On the server, sudo wg show should list your peer with a recent handshake and rising transfer counters.
4. Switch your phone between WiFi and mobile data mid-video-call. WireGuard’s roaming should survive the hop without dropping.

To see what the tunnel costs you, run the same speed test with it on and off, a few times, at the hours you normally use it. Expect some loss from encryption overhead and the extra distance to the VPS. On mobile data, the network itself is often the limit. This guide doesn’t publish a measured result.

the india-specific stuff nobody mentions

CERT-In’s FAQ on the 2022 Directions (Q34) defines a “VPN service provider” as an entity offering internet proxy-like services to general internet users, and excludes enterprise and corporate VPNs. A private tunnel for your own and your family’s devices isn’t a public VPN service. The FAQ doesn’t address personal setups directly, though, so don’t read this guide as a ruling on your situation. If your VPS provider is covered by the Directions, it keeps your validated subscriber details anyway. My India VPN comparison sets out what the Directions require. This is general information, not legal advice.

One more wrinkle. On mobile networks, UDP over unusual ports sometimes gets flaky during evening congestion; Jio users have reported this pattern. If your handshakes start timing out at night, try moving ListenPort to 443 (UDP) on the server and matching it in the client Endpoint. It tends to slip through where 51820 keeps stalling.

small things that make it nicer

• Back up /etc/wireguard/ somewhere safe. Rebuilding a VPS takes minutes; regenerating and redistributing keys to every family member takes an evening. It contains the server’s private key, so encrypt the backup, for example sudo tar -czf - /etc/wireguard | gpg --symmetric -o wireguard-backup.tgz.gpg.
• Use the app’s split tunnelling to exclude banking and UPI apps, which sometimes sulk at datacentre IPs.
• Point DNS at your Pi-hole if you run one; set the client DNS to your Pi-hole’s WireGuard IP and you get ad blocking everywhere you go. My Pi-hole guide pairs beautifully with this setup.
• Watch your bandwidth quota. Heavy streaming through the tunnel can eat a 1 TB allowance faster than you expect.
• Want a friendlier admin layer? Projects like wg-easy give you a web UI for adding devices, handy when you are managing configs for parents.

FAQ

Can I run this at home instead of on a VPS?

You can, and it’s a lovely way to reach your home network when you’re out. The thing that trips people up on Indian connections is CGNAT. Jio and a lot of Airtel plans simply don’t hand you a publicly reachable IP, so inbound connections just die on the doorstep. There are workarounds, a small VPS acting as a relay, or paying Airtel extra for a static IP, but as a first project a VPS is far less fuss.

Can I use this for region-locked streaming?

No, and that isn’t what this guide is for. Streaming services license content by region, and their terms generally prohibit using a VPN or proxy to reach another region’s catalogue. Build this for privacy on untrusted networks and for access to your own systems.

How is this different from Tailscale?

Tailscale runs on WireGuard under the hood, but it’s solving a different problem: wiring your own devices together with basically zero configuration. It won’t give you an internet exit IP unless you go and set up an exit node. Plain WireGuard on a VPS is the right tool when “exit to the internet from my server” is the goal. For homelab access, Tailscale wins.

What does this actually cost per year?

A ₹350-a-month VPS comes to about ₹4,200 a year. That’s roughly a mid-range commercial VPN’s introductory price, except nothing leaps up at renewal, and the server moonlights as a playground for hosting automation tools or a personal site.

wrapping up

One small VPS, six commands of actual substance, and you own your VPN end to end, with keys no one else has ever laid eyes on. Anonymous, it won’t make you. It will make you informed, which for many people is worth more than a subscription.

Update history: added UFW and IPv6 steps, tightened private-key handling, corrected the Hetzner and Ubuntu details, removed an undated throughput figure and the streaming comparison, and rewrote the CERT-In section.

Sources

• WireGuard quick start — the upstream project’s own setup reference, which is what the key generation and config steps here follow.
• CERT-In Directions under Section 70B (28 April 2022) — primary source for the scoped regulatory qualification above; applicability and later amendments require current CERT-In/MeitY review.