Setting Up a Home VPN Server

Why Run Your Own VPN

A home VPN server lets you:

• Access home resources remotely — Reach your NAS, printer, cameras, and other local devices from anywhere.
• Secure public Wi-Fi — Route all traffic through your home internet when on cafe or hotel Wi-Fi, encrypting everything in transit.
• Use your home IP — Appear to be at home for banking, streaming services, and geo-restricted content.
• No subscription fees — Unlike commercial VPN services, your home VPN costs nothing beyond your existing internet connection.

WireGuard vs OpenVPN

WireGuard is the recommended choice for home use. It is faster, simpler to configure, and lighter on mobile device batteries.

Setting Up WireGuard on Linux

On a Raspberry Pi, old laptop, or any Linux machine on your network:

# Install WireGuard
sudo apt install wireguard

# Generate server keys
wg genkey | tee /etc/wireguard/server_private.key | wg pubkey > /etc/wireguard/server_public.key
chmod 600 /etc/wireguard/server_private.key

# Generate client keys
wg genkey | tee client_private.key | wg pubkey > client_public.key

Server Configuration

# /etc/wireguard/wg0.conf
[Interface]
PrivateKey = <server_private_key>
Address = 10.0.0.1/24
ListenPort = 51820
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
PublicKey = <client_public_key>
AllowedIPs = 10.0.0.2/32

# Enable IP forwarding
echo "net.ipv4.ip_forward=1" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

# Start WireGuard
sudo systemctl enable --now wg-quick@wg0

Client Configuration

[Interface]
PrivateKey = <client_private_key>
Address = 10.0.0.2/24
DNS = 1.1.1.1

[Peer]
PublicKey = <server_public_key>
Endpoint = your-home-ip:51820
AllowedIPs = 0.0.0.0/0  # Route all traffic through VPN
PersistentKeepalive = 25

Port Forwarding

Your router must forward the WireGuard port to the VPN server:

Router → Port Forwarding → Add Rule:
  External Port: 51820
  Internal IP:   192.168.1.x (VPN server)
  Internal Port: 51820
  Protocol:      UDP

Dynamic DNS

Most home internet connections have a dynamic public IP that changes periodically. Use a Dynamic DNS (DDNS) service to maintain a hostname that always points to your current IP:

• DuckDNS (free) — myhome.duckdns.org
• No-IP (free tier) — myhome.ddns.net
• Cloudflare (free with domain) — Update A record via API script

Many routers have built-in DDNS support. Configure it in the WAN settings.

Router-Level VPN

Some routers run WireGuard natively, eliminating the need for a separate server:

• UniFi (Ubiquiti) — Built-in WireGuard VPN server
• pfSense / OPNsense — Full WireGuard support
• Asus RT — WireGuard support on newer models
• GL.iNet — WireGuard built into travel routers

Router-level VPN is the simplest option because it requires no additional hardware and gives VPN clients access to the entire home network.