WireGuard On A Box You Rent, Running In Ten Minutes
You rent the server, we install and harden WireGuard on it, and you get back a config file and a QR code for every device you own. The whole machine does one job, the keys are generated on it and handed to you, and the setup takes about as long as reading this page.
It is the least complicated thing on this site and the one we run ourselves. Cheap enough to leave running on a spare VPS, fast enough that you forget it is on, and simple enough that a single file is the entire configuration.
What No Logs Actually Means
Nothing on the server records where you go. A few things are held in memory while it runs, because the protocol needs them to work, and there are limits that no configuration on the machine can do anything about. All three parts are below, because a claim like this is worth nothing without them.
What The Server Does Not Keep
- The sites and services you connect to. There is no destination log, and one is never created.
- Your DNS lookups, which we point at a resolver configured to keep nothing.
- The contents of anything, which the encryption puts out of reach in any case.
- A session history. There is no record of when you connected yesterday or last month.
- Anything at all on our side. We do not hold a copy of your keys after handover.
What It Does Hold, And Why
- The time of the most recent handshake for each key, used to decide when to rekey.
- The address your device is currently connecting from, used to send replies back.
- A count of bytes moved by each key, which is how the interface reports itself.
All of it lives in memory rather than on disk, all of it is the current state rather than a history, and all of it disappears when the service restarts. WireGuard cannot route your traffic without knowing where to send the answer, so anyone promising a tunnel that holds nothing at all is describing something that does not work.
The Part No Configuration Can Change
Your hosting provider sits underneath all of this. They know the server exists, they have your billing details, and their network equipment sees the traffic entering and leaving the machine regardless of what runs on it. Any legal process arrives at their door, not ours and not yours. That is true of every self hosted setup, including the ones sold as private, and it is the reason we help you pick a host and a jurisdiction rather than treating that choice as an afterthought.
There is a second honest limit worth stating. Your traffic exits from an address used only by you, which is exactly what makes it reliable and consistent, and also means there is no crowd to blend into. This setup keeps your activity away from the network you are sitting on, your internet provider and whoever else is on the cafe WiFi. If your goal is being one of thousands of people behind the same address, a single private server is the wrong tool and we would rather say so here than after you have paid.
What Goes On The Server
Six things, and then the machine is left alone. WireGuard is a small piece of software, so most of the work is in the settings around it, which is also where the do it yourself attempts usually come apart.
WireGuard, And Nothing Else
Installed from the distribution repositories on Debian or Ubuntu so it updates with the rest of the system, running in the kernel rather than as a userspace process. No control panel, no web interface, no management agent. A server with one job has very little that can break or be attacked.
Everything Closed Except Two Ports
One UDP port for the tunnel and one for your own administrative access. Everything else is dropped rather than refused, so a scan of the address finds a machine that barely answers. Rented servers get scanned within minutes of being created, which is not a threat so much as weather.
Key Based Login Only
Password authentication switched off, direct root login disabled, and administrative access by key. This is the single change that removes almost all of the automated attacks a public server sees, and it costs nothing except doing it before the machine goes live rather than after.
Forwarding, NAT And The Right MTU
Traffic has to leave the server wearing the server's address, which takes forwarding and address translation set up correctly. The MTU value matters more than it sounds. Set it wrong and the tunnel connects, small requests work, and larger pages hang forever, which is the exact symptom that sends people back to a paid app.
Lookups Go Down The Tunnel
Your device is told which resolver to use while connected, so name lookups travel inside the tunnel instead of going to whatever the local network hands out. Without this the traffic is encrypted while the list of everywhere you are going is still being read by the network you are sitting on.
A Key And A File For Each One
Keys are generated on the server, one set per device rather than one shared between them, and you get a config file and a QR code for each. Adding a phone later is two commands, and we leave those written down in plain language so you are not searching for them a year from now.
Where The Ten Minutes Actually Goes
Most of it is waiting for packages to download and typing in the names of your devices. The install itself is genuinely quick, which is the honest reason this service is cheap compared to everything else on the site.
The part that is worth paying for is the handful of decisions around it, the firewall rules, the MTU value, the DNS setting and the key handling. Those take minutes when you have done them a hundred times and an entire frustrating evening when you have not, and getting any one of them wrong produces a tunnel that looks connected and does not quite work.
Where WireGuard Fits, And Where It Does Not
It is the best daily driver available and it is the wrong choice on a restrictive network. Both halves are below, because the second one decides whether this is the page you want or whether one of the others suits you better.
Speed You Stop Noticing
The code is small and it runs in the kernel, so the overhead is low enough that the tunnel is rarely the slow part of your connection. What your server is paying for in bandwidth usually matters more than the encryption does.
It Survives Changing Networks
Walk out of the house and your phone moves from wifi to mobile data. The tunnel picks up where it left off instead of dropping and asking to reconnect, because there is no session to rebuild, only a key that is still valid.
It Can Stay On All Day
An idle tunnel sends almost nothing, so leaving it running on a phone barely registers in the battery figures. That matters more than raw speed, because a VPN you switch off half the time is protecting you half the time.
It Runs On UDP, So Some Networks Kill It
Hotels, offices and campus networks often allow the web ports and little else. WireGuard has no fallback mode to switch into, so on those networks it connects and quietly stops passing traffic, which is a worse experience than failing loudly.
The Handshake Is Easy To Recognise
It was designed to be small, fast and simple to audit, not to be difficult to identify. On networks that inspect traffic properly, and behind national level filtering, that clarity works against it.
One File Per Device, Added By Hand
There is no account system, no dashboard and no invitation email. That is a virtue for a person or a household and it turns into real work somewhere past ten people, when adding and removing staff becomes a job somebody has to own.
If One Of Those Is Your Situation
For hotel and office networks that block UDP, the answer is a second protocol on the same server, which is what the private VPN server setup covers. For anything inside China, WireGuard on its own is the wrong starting point and the Debian server built for those conditions is the page to read. For a team past a handful of people, key management is the whole problem and the company setup with a dedicated address handles it. And if what you actually want is your own home address while you travel rather than a server address, that is the travel router and home IP setup.
Tell Us Your Host And How Many Devices
That is the whole brief. If you already rent a server we work on the one you have, and if you do not, we pick a provider and a region with you first. The build takes about ten minutes, the config files and QR codes come back the same day, and the machine is yours from the moment the keys change hands.
Request your setup