# Running your own VPN on your VPS (WireGuard) Source: https://vpsdime.com/knowledgebase/technical-questions/wireguard-vpn Last reviewed: 2026-07-02 Summary: A personal VPN on your VPS is allowed and one of the best uses of a small plan, what it does and honestly doesn't do (it's privacy from the local network, not anonymity), the ten-minute setup with the wireguard-install script, adding phones by QR code, DNS leak checking, the traffic-counts-twice math, and the OpenVPN fallback for networks that block UDP. ## What this is Your own VPN server: your devices connect to your VPS and route their internet traffic through it, encrypted from the device to the datacenter. A **personal VPN for your own use is [explicitly allowed](https://vpsdime.com/knowledgebase/acceptable-use/whats-allowed)** and is one of the most popular uses of a small plan ([the required TUN/TAP support is already enabled](https://vpsdime.com/knowledgebase/technical-questions/enable-tun-tap)). The line to respect: *personal*, running a VPN or proxy service for other people is not allowed. What it gives you, honestly stated: - **Privacy from the network you're on**: hotel Wi-Fi, airports, ISPs that snoop or throttle, they see only encrypted traffic to your VPS. - **A stable, known exit IP**: useful for IP-allowlisted services ([your own servers included](https://vpsdime.com/knowledgebase/technical-questions/private-networking-between-vpses)) and for a consistent location while traveling. - **Not anonymity.** The VPS's IP is yours, on your account; a self-hosted VPN moves trust from the coffee-shop network to your own server, it doesn't make you anonymous, and commercial "no-logs" theater isn't the product here. ## The ten-minute setup The community-standard [wireguard-install script](https://github.com/Nyr/wireguard-install) (by Nyr) handles server setup, keys, forwarding, and client management: ``` wget https://git.io/wireguard -O wireguard-install.sh bash wireguard-install.sh ``` Accept the defaults (UDP **51820**), name your first client, and it prints a **QR code**, open the WireGuard app on your phone ([iOS](https://apps.apple.com/app/wireguard/id1441195209)/[Android](https://play.google.com/store/apps/details?id=com.wireguard.android)), "Create from QR code", scan, toggle on. Done. For laptops, the script writes a `.conf` file, import it into the [WireGuard client](https://www.wireguard.com/install/) (or `wg-quick up` on Linux). Re-run the script any time to **add a client per device** (one profile per phone/laptop, so a lost device is revoked by deleting *its* client, same logic as [SSH keys](https://vpsdime.com/knowledgebase/getting-started/setting-up-ssh-keys)), or to remove one. Two housekeeping notes: if you run your own [firewall](https://vpsdime.com/knowledgebase/troubleshooting/allow-ssh-in-common-firewalls), allow `51820/udp` (the script handles its own rules on a default setup; our [edge firewall](https://vpsdime.com/knowledgebase/client-area/services/firewall) doesn't block VPN ports). And prefer the script's defaults unless you know why not, it configures DNS through the tunnel correctly, which hand-rolled setups often miss. ## Verify it, including DNS With the VPN on, check two things from the connected device: 1. **Your visible IP** is the VPS's, any "what is my IP" site. 2. **DNS isn't leaking**: [dnsleaktest.com](https://dnsleaktest.com/) (or [browserleaks.com/dns](https://browserleaks.com/dns)) should show resolvers consistent with your tunnel, not your home ISP's. A leak means DNS queries escape the tunnel, the privacy hole people don't notice; the script's default config avoids it, custom configs should set `DNS =` in the client profile. ## The traffic math Routed VPN traffic crosses your VPS **twice**, in from your device, out to the destination, so a gigabyte browsed is roughly two gigabytes against [your monthly allowance](https://vpsdime.com/knowledgebase/acceptable-use/bandwidth-overage). Generous plans make this a non-issue for normal browsing; heavy streaming through the tunnel is where the math starts to matter, watch the [Graphs](https://vpsdime.com/knowledgebase/client-area/services/graphs) the first month. ## When WireGuard won't connect: the OpenVPN fallback Some restrictive networks (corporate guest Wi-Fi, certain hotel setups) block unfamiliar UDP entirely, and WireGuard is UDP-only. The classic workaround is a parallel **OpenVPN** setup via the sibling [openvpn-install script](https://github.com/Nyr/openvpn-install), configured on **TCP port 443**, indistinguishable from HTTPS to most middleboxes, slower than WireGuard, but it connects where nothing else will. Run both; use WireGuard by default and the 443 fallback when a network fights you. ## Still need help? You can [open a support ticket](https://vpsdime.com/open-ticket/). So we can help on the first reply, it's worth mentioning: - the VPS hostname or IP, - the client device, - where it fails (importing the profile, the handshake, or no internet through the tunnel). ## Related questions - "Can I run a VPN on my VPS, and is it allowed?" - "How do I set up WireGuard on my VPS?" - "How do I add my phone to my VPN (QR code)?" - "Does a self-hosted VPN make me anonymous?" - "How much bandwidth does a VPN use (does traffic count twice)?" - "What if a network blocks my WireGuard connection?"