VPN server hosting
Answer
Self-hosted VPN means running WireGuard or OpenVPN on a server you rent rather than subscribing to a commercial provider. It gives you an exit address nobody else uses and a server whose logging you control. A Incognito VPS SCOUT plan at $4.00 per month is sufficient for several devices.
| Scenario | Minimum |
|---|---|
| 1–5 devices | 1 vCPU, 2 GB RAM, 2 TB transfer |
| 5–20 devices | 2 vCPU, 4 GB RAM, 4 TB transfer |
| Heavy streaming | 2 vCPU, 4 GB RAM, 8+ TB transfer |
| Protocol | WireGuard (recommended) or OpenVPN |
What self-hosting changes, honestly
A commercial VPN puts you in a crowd. Hundreds of users share an exit address, so traffic attributed to that address cannot be attributed to you specifically. That is a real privacy property and self-hosting throws it away — your exit address is used by exactly one person.
What you get in exchange is a server whose logging policy you actually control, an address that is not on every VPN blocklist, and no requirement to trust a provider’s marketing about what it retains. For unblocking a service, avoiding your ISP, or reaching a home network, self-hosting is clearly better. For hiding in a crowd, it is clearly worse. Pick according to which you need.
WireGuard, in about five minutes
WireGuard is roughly 4,000 lines of kernel code against OpenVPN’s hundreds of thousands, it uses modern primitives with no cipher negotiation, and it roams between networks without dropping. It is faster in every benchmark that matters and simpler to configure by a wide margin.
Install wireguard-tools, generate a key pair, write a fifteen-line config with your peer public keys, enable IP forwarding, add a masquerade rule and start the interface. The wg-easy container gives you the same thing with a web UI if you would rather click.
Choosing a location
Latency dominates the experience here. Pick the location closest to you unless you specifically need to appear somewhere else — routing all your traffic through Panama from Berlin will make everything feel broken.
Amsterdam is the default for European users. Bucharest and Sofia for eastern Europe. Panama for anyone in the Americas. If you want an endpoint that also survives national filtering, the censorship-resistance page covers the protocols that currently work.
Frequently asked questions
01 Is a self-hosted VPN more private than a commercial one?
In some ways. You control the logging and the address is not shared. But your anonymity set is one — traffic from that address is unambiguously yours. Commercial VPNs give crowd cover you cannot self-host.
02 Which plan do I need?
SCOUT at $4.00/month handles several devices comfortably; WireGuard is almost free in CPU terms. Move to RELAY if you are routing heavy video for a household.
03 WireGuard or OpenVPN?
WireGuard, unless you need a feature it lacks. It is faster, far simpler to audit, and roams between networks without dropping. OpenVPN remains useful where TCP/443 camouflage is required.
04 Can I use it to watch geo-restricted streaming?
Sometimes. Datacentre address ranges are widely detected by the large streaming platforms, and a fresh address helps but is not a guarantee. We do not sell this as a feature because we cannot control it.
Related