The Whole VPN Business, Built And Handed To You Running
Servers in the regions you want to sell, a panel that creates accounts and takes the money, configuration delivery your customers can follow without emailing you, and the abuse handling process that decides whether your hosting provider keeps those servers switched on. All of it configured, documented and put in your name.
The technical half is the easy half. What ends most small VPN services is the abuse desk, the payment processor and the support inbox, and those are the three things a tutorial will never mention because the person writing it has not run one for a year.
What It Really Costs To Run
A small service with a few hundred customers runs on well under two hundred dollars a month in fixed costs. That figure is not the problem. The problem is the two lines underneath it that move with usage rather than with headcount, and the one that is paid in your evenings.
The Fixed Monthly Bill
A service selling five regions, carrying a few hundred customers.
- Five VPS, one per region $40 to $90
- Extra IPv4 addresses $1 to $3 each
- Billing and provisioning panel $10 to $55
- Domain, mail and certificates about $3
- Monitoring and backups $5 to $20
- Payment processing roughly 3% of revenue
Panel pricing is the published rate at the time of writing. WHMCS starts at $9.99 a month for a hosted licence covering 25 clients and $34.95 for a self hosted licence covering 250, rising to $54.95 at 500. Open source alternatives cost nothing and cost you elsewhere.
Bandwidth Is The Line That Moves
Customers are not billed by the gigabyte and your host bills you that way once you pass the included allowance. One customer moving a terabyte a month can cost more than ten customers pay you, and you will not know which one until you look. This is the single number that decides whether the business works.
Payments Are Riskier Than The Rate Suggests
The percentage is the easy part. Privacy tools sit in a category that mainstream processors review carefully, accounts do get held or closed, and chargebacks on a nine dollar subscription cost more to fight than they return. Have a second route to taking money before you need one.
Your Time Is The Largest Cost
Support tickets, abuse mail, a server going down at the wrong hour and the customer who cannot install anything without a phone call. Price your service as though that time is worth something, because otherwise you have bought yourself a job that pays under minimum wage.
Where The Spreadsheet Usually Goes Wrong
Almost everyone models it on the fixed costs and prices against the big providers. Five dollars a month feels competitive next to the names people recognise, and at fifty customers the maths still looks fine. Then usage lands unevenly, the heaviest few percent of customers consume most of the traffic, and the servers that were comfortable at fifty users need doubling at two hundred.
The version that survives prices for the heavy users rather than the average, keeps a real margin over the bandwidth bill, and treats the abuse handling as an operating cost rather than an emergency. That is the model we build with you before anything gets deployed, because it is much harder to raise prices on existing customers than to start at the right number.
Complaints Arrive, And They Come With A Clock
Every exit address generates complaints, and the volume is manageable. The deadline attached to them is the difficult part, because the person waiting on your reply is your hosting provider, and their patience runs out faster than a customer's does.
Copyright Notices
Automated, generated in bulk by monitoring firms, and tied to a timestamp and your exit address. Individually they are routine. Ignored, they stack up into a file your host uses to justify closing your account, and the first you hear of it is a server that stopped responding.
Spam And Mail Complaints
The most common reason a small service loses servers, and almost entirely avoidable by closing outbound mail ports before the first customer connects. Once your address reaches the public blocklists it stays there long after the cause is gone.
Scanning And Login Attempts
Someone using your exit to hammer other people's logins. It generates reports, and it puts your address on reputation lists, which quietly breaks ordinary browsing for every honest customer sharing that exit. They will not report it as an abuse problem, they will report it as your service being broken.
The Ones That Are Not Routine
A small number of reports concern criminal activity. Those are not a customer service matter, they go to your provider and to the authorities straight away, and the procedure for that belongs in a document written on a calm day rather than invented on the worst one.
The Response Is A Routine, Not A Reaction
Most reports need the same three moves, and having them written down is the difference between fifteen minutes and a ruined afternoon. Your host is not asking you to identify anyone. They are asking whether the address is being managed.
Acknowledge Inside The Window
Almost every abuse desk works on a fixed deadline, and silence is treated as refusal. A short reply on the day, sent from a monitored address, prevents most suspensions on its own.
Fix Something Real
Close the port, apply the rate limit, cut the key, isolate the exit. Whatever the report describes, the answer has to include a change rather than an explanation, because a change is what stops the second report arriving.
Reply With What You Did
Short, factual, no argument about the merits. Providers keep a history on every customer, and a file full of prompt replies describing concrete action is what buys you the benefit of the doubt on the day something genuinely goes wrong.
The Part You Are Not Warned About
You usually cannot identify the customer, and you still have to answer. A service built not to keep records is a service that cannot name anyone when asked, which sounds like a problem and is actually the whole point. What you can do is show that the address is controlled, that outbound abuse is limited by design, and that reports get acted on the same day. That is the answer, and it is accepted far more often than operators expect.
The other half is who you rent from. Some providers tolerate this traffic and price accordingly, some suspend on the second notice, and the ones with the cheapest monthly rate are frequently the least forgiving. Picking the host is an abuse decision before it is a price decision, and we make that choice with you first, because moving a live service to a new provider is the most expensive week you will ever have.
What Gets Handed Over
A service that already works, in your name, with the controls switched on before the first customer arrives. Not a pile of scripts and a good luck message.
The Exit Servers
One per region you decided to sell, built the same way so they can be rebuilt or replaced from a script rather than from memory. Hardened, patched automatically, monitored, and sized for what you expect rather than for what the marketing page of the host suggests. Adding a seventh region later is a job of minutes because the first six were built to be repeatable.
The Panel
Signup, plans, renewals, cancellations and provisioning, wired so that a customer who pays gets their access without you touching anything. This is the piece that decides whether you have a business or a hobby with invoices, because manual provisioning stops being possible somewhere around the fortieth customer and you will not notice the ceiling until you hit it.
Payments, Plus A Second Route
A primary processor connected properly, with failed payment handling and renewal reminders so revenue does not leak quietly. Alongside it, a second way to take money that is ready before you need it, because the week your account gets reviewed is the week you find out how much you rely on one company staying comfortable with your category.
Customer Delivery
Configuration files, QR codes and setup instructions written for people who do not know what a protocol is, covering the platforms your customers actually use. Every question this answers in advance is a support ticket you do not receive, and support volume is the cost that decides whether the service is worth running.
Abuse Controls, On From Day One
Outbound mail closed, rate limits in place, per key limits set, a monitored abuse address that reaches a human, and prepared replies for the report types that arrive most often. These take an hour to set up before launch and rescue you repeatedly afterwards, which is the opposite of how most services discover them.
The Paperwork
Terms of service, an acceptable use policy and a privacy notice drafted around what your setup genuinely keeps rather than copied from a competitor who keeps something different. We draft them, and you should still have somebody qualified in your jurisdiction read them before you publish, which is advice we would rather give you now than have you wish we had.
The Runbook
Written instructions for the things you will actually do. Add a region, rebuild a server, rotate an address that has been blocked, suspend a key, answer an abuse notice, restore from backup. Plain language, in your own document, so the business does not depend on us being available.
And What We Do Not Do
We do not run it for you unless you ask us to. The default is that everything ends up in your accounts, on your cards, under your name, and we walk away once you can operate it. If you would rather keep us on for the maintenance and the abuse mail, that is a separate arrangement and a monthly figure, not something quietly baked into the build.
We also will not promise you customers. Building the service is a known quantity and takes weeks. Selling it is the hard part, it is a different job entirely, and any offer that bundles the two is selling you the easy half and hoping the other half sorts itself out.
Tell Us What You Want To Sell, And Where
The regions, the kind of customer you have in mind, and whether there is already a brand behind it. That is enough for us to come back with a build plan and a monthly cost model, so the decision gets made with the numbers in front of you rather than after the first invoice arrives from a host.
Talk about your build