Your Own WireGuard VPN Server, Pre-Installed

WireGuard is a modern VPN protocol built into the Linux kernel: small, fast and simple to configure. wg-easy wraps it in a web interface. Choose the WireGuard app and a plan, pay, and we build the VPS (KVM, Ubuntu 24.04 LTS) and install wg-easy, currently version 15.5.0, in about three minutes after boot. You get:

• A WireGuard server listening on UDP port 51820, opened in the firewall for you.
• The wg-easy admin page on HTTPS at an address like yourname-x7k2.devoster.app, with a Let's Encrypt certificate.
• Your admin login already created. Sign in as admin with a generated password shown in the Devoster dashboard, where you can also reset it. wg-easy's setup screen is never exposed to the internet.
• Managed updates. We test new wg-easy versions and apply them in a nightly window you choose, or on Update now, with a VPS snapshot first and an automatic rollback if it doesn't come back healthy. Auto-update can be turned off.

The app is free; you pay the VPS plan, with 10% off yearly. Like every Devoster VPS it has a dedicated IPv4, a 1 Gbps port with unlimited bandwidth, DDoS protection and full root. Browse the other ready-made servers on the One-Click Apps page.

Every device gets its own WireGuard key pair, which wg-easy creates for you:

• Phone: install the official WireGuard app (iOS or Android), create a client in wg-easy and scan its QR code. The tunnel is ready.
• Laptop or desktop: install WireGuard for Windows, macOS or Linux, download the client's configuration file from wg-easy and import it.
• Lost a device? Disable or delete that one client in wg-easy; the others keep working.

wg-easy also shows which clients are connected and how much each has sent and received, and supports two-factor login for the admin page, which is worth enabling. By default a device sends all its traffic through the tunnel; you can narrow a client to specific networks if you only want to reach your own servers.

A VPN server you own is a different thing from a commercial VPN subscription, and it helps to be clear about which problems it solves.

Good uses:

• Untrusted Wi-Fi. In hotels, airports and cafes, your traffic is encrypted to your own server before it touches the local network.
• A fixed IP for allowlists. Allow only your VPN's dedicated IPv4 into admin panels, databases or SSH on your other servers, and reach them from anywhere.
• Private access to your own services. Keep dashboards and internal tools off the public internet and reach them through the tunnel.
• A US connection when you travel. Your traffic leaves from Utah, USA.

What it doesn't do:

• It is not anonymity. The IP is a single address assigned to your account, and Devoster's acceptable use rules apply to everything that leaves it.
• It is a datacenter IP. Some streaming, banking and shopping sites treat datacenter addresses differently from home connections, so we don't promise access to any particular service.
• One location. All traffic exits in Utah. For other countries you would need servers there.

• UDP 51820. WireGuard runs over UDP only. Most home and mobile networks allow it, but some corporate, school or hotel networks block outgoing UDP, and then the tunnel cannot connect from there.
• Mail ports are blocked. Outbound mail ports are blocked by default on Devoster VPS plans, and that applies to traffic through the tunnel too. Webmail and mail apps that sync over HTTPS work; a mail app that sends through an SMTP server may not, unless you ask for its submission port to be opened.
• Speed. The server has a 1 Gbps port with unlimited bandwidth. What you actually get depends on your own connection, the distance to Utah and the plan's CPU, since encryption costs a little CPU for every packet.

The admin page is on HTTPS and the WireGuard port is the only extra port opened. You still have root over SSH, so read our VPS hardening checklist: a VPN server is only as private as the machine it runs on.

WireGuard and wg-easy are light: the memory they use is small, and the work is mostly encrypting packets, which scales with how much traffic goes through the tunnel at once.

Bandwidth is unlimited on every plan, so the choice is about CPU, not data caps. You can upgrade from the panel later.