How to set up a VPN on a VPS: four practical options

Which VPN setup should you choose?

A VPS can run your own VPN endpoint: your laptop or phone connects to the server, which forwards traffic to the internet. The easiest method depends on whether you want a dashboard, user accounts, or direct control over configuration. These are practical differences, not a universal speed ranking.

For a first personal VPN, start with Tailscale if account-based access fits your needs. Choose wg-easy if you prefer a WireGuard configuration file that works in the standard WireGuard apps. Choose OpenVPN Access Server for its user-management workflow. The manual WireGuard route is best suited to readers comfortable administering Linux networking.

• Tailscale exit node on Linux or Windows →
• WireGuard with the wg-easy dashboard →
• OpenVPN Access Server setup →
• Manual WireGuard on Ubuntu and Debian →

Choose a VPS that fits the VPN you will run

Start with the operating system supported by your chosen software. A fresh Ubuntu LTS or supported Debian server is a straightforward Linux starting point. For a Windows VPS, use a method that explicitly supports your Windows version; installing a Linux VPN package on Windows is not an equivalent setup.

• Confirm administrative access and the ability to change firewall and forwarding settings. Keep console access available in case a firewall change interrupts SSH or Remote Desktop.
• For conventional WireGuard or OpenVPN, check the public endpoint, required inbound ports and outbound connectivity. A shared address or NAT-only VPS may need additional port mapping.
• Choose a location near your usual client networks, then measure actual performance. Distance, routing, CPU allocation and congestion all affect the result.
• Check data-transfer allowance, port speed and overage terms separately. A fast port does not mean unlimited transfer.
• Check the hosting terms and application requirements. Size resources for your expected connected devices and workload; a single memory figure cannot guarantee VPN throughput.

• Compare VPS plans and operating systems →
• Explore server countries and cities →
• Read the VPS buying checklist →

The setup path, from server to phone

1. Choose one method and follow its matching guide. Use a fresh server for a first deployment rather than mixing multiple VPN tools and firewall managers.
2. Update the server and keep your existing administrative access working. Install the VPN software from its official source.
3. Configure the correct public server address. The loopback address 127.0.0.1 only reaches the device it is entered on; it is not your remote VPN endpoint.
4. Create separate credentials or a separate peer for each device. Keep private keys, QR codes and exported profiles private.
5. Install the matching client: WireGuard for WireGuard profiles, OpenVPN Connect for Access Server profiles, or Tailscale for an exit node. Import the profile or sign in and select the exit node.
6. Verify the traffic path, then document how to disable a device or recover access. Test reconnecting after a server restart.

Windows, macOS, Android and iPhone can connect to these approaches through their respective client applications. The server operating system and the client operating system do not need to match. A Linux VPS can serve a Windows laptop and an iPhone at the same time, subject to the software configuration and available capacity.

A connected icon is only the first check

A VPN handshake proves the peers can communicate; it does not prove that all internet traffic is using the VPS. A split tunnel deliberately routes only selected destinations. A full tunnel routes general internet traffic through the VPN, with behavior that also depends on IPv6, DNS and client exclusions.

• Check your public IPv4 address before and after connecting. For a working IPv4 full tunnel, the connected result should match the VPS’s outbound address.
• Check IPv6 separately. It should use the intended tunnel path or be deliberately blocked; do not assume an IPv4-only server automatically prevents direct client IPv6.
• Test name resolution and your chosen DNS behavior. Browser secure DNS can use a different resolver from the operating system.
• Disconnect or interrupt the tunnel and check whether your applications reconnect directly. Do not describe a setup as a kill switch unless you have configured and tested that behavior.
• Try normal browsing and a representative download from your usual network. Test again from mobile data if that is where you will use it.

Keep the VPN useful after the first connection

Schedule server and VPN updates, store backups securely, and remove credentials for lost or retired devices. Record the VPN port, server endpoint, firewall rules and recovery procedure. Protect administrative dashboards with restricted access rather than making them public for convenience.

If the tunnel connects but browsing fails, investigate forwarding, NAT, DNS and IPv6 before reinstalling everything. If it does not connect at all, start with the public endpoint, listening port, firewall and credentials. Each setup guide below includes a troubleshooting table for its particular method.

Common questions