Skip to content

Solutions · VPN

A VPS for a WireGuard VPN

WireGuard is a kernel module and a few kilobytes of config; a one-core machine saturates its uplink before it runs out of CPU. What a personal VPN really consumes is transfer, every byte in and out again, which is why U1-1 at $6.90 with no traffic meter is the pick, and why a metered plan is a bill waiting to happen. wg-easy puts a web UI and QR codes on top; C1-2-55 at $18.90 arrives with it running.

Deploy U1-1Deploy C1-2-55 with WireGuard (wg-easy) installed

What it needs

Software from the docs, sizes labelled by source

The software and the security posture come from the project's own documentation. Where the project publishes no hardware figure, the sizes say whose they are.

From wg-easy's compose file and docs

  • Docker, then ghcr.io/wg-easy/wg-easy:15 with NET_ADMIN, SYS_MODULE and net.ipv4.ip_forward=1; the kernel provides WireGuard.
  • Ports: 51820/udp for the VPN — the only one that must be public — and 51821/tcp for the web UI, which should not be.
  • First start can be unattended with INIT_ENABLED, INIT_USERNAME, INIT_PASSWORD, INIT_HOST, INIT_PORT, INIT_DNS; afterwards the UI is where clients are made.
  • Traffic doubles: a gigabyte downloaded through the VPN is a gigabyte in and a gigabyte out of the server.

Sizes (bandwidth, not cores)

Sizing by workload
WorkloadvCPURAM
One person, phones and laptopsCPU is irrelevant; buy unmetered or count the terabytes.11 GB
A household or a small teamSame. Dozens of peers cost nothing; the streaming does.12 GB
Site-to-site or an officeStill bandwidth. Pick the city for latency to the office.22 GB

The plans that fit

4 machines, priced live

Cheapest and unmetered first. Prices are today's, per month, read from the catalogue.

  • U1-1$6.90/mo

    1 vCPU · 1 GB · 15 GB disk · Unmetered

    Unmetered, Istanbul, the pick. 1 vCPU, 1 GB, and no traffic meter: a VPN that cannot surprise you. Paste the compose file yourself (three commands).

    Deploy
  • C1-1-25$9.90/mo

    1 vCPU · 1 GB · 25 GB disk · 1 TB

    1 TB a month, in 36 cities. The same machine wherever you want the exit to be; 1 TB of transfer is plenty for browsing and thin for video. Paste the compose yourself.

    Deploy
  • C1-2-55$18.90/mo

    1 vCPU · 2 GB · 55 GB disk · 2 TB

    Arrives with wg-easy running. 1 vCPU / 2 GB / 2 TB on a supplier that runs our preset: admin password in a root-only file, UI on loopback, QR codes ready.

    Deploy installed
  • U1-2$8.90/mo

    1 vCPU · 2 GB · 25 GB disk · Unmetered

    Unmetered, 2 GB, Istanbul. The pick with twice the memory, for a VPN that also runs a DNS filter or a second service.

    Deploy

“Deploy installed” opens the configurator with our WireGuard (wg-easy) start-up script already in the start-up box, in full, before you buy. It runs once, as root, while the server is built, and only on suppliers whose platform runs start-up scripts; on the other rows the install is the same commands, pasted by you.

The install

Four steps, from wg-easy's docs

With the preset, the first three are done when the server arrives and the admin password is waiting in /root/WIREGUARD-NEXT-STEPS.txt.

  1. Docker. curl -fsSL https://get.docker.com | sh
  2. The compose file. mkdir -p /etc/docker/containers/wg-easy, download the project's docker-compose.yml there, and bind the UI port to loopback: "127.0.0.1:51821:51821/tcp". The preset also sets the INIT_* variables so no setup wizard is exposed.
  3. Start it and open the port. docker compose up -d, then ufw allow 51820/udp. Nothing else needs to be public.
  4. Make a client. From your laptop ssh -N -L 51821:127.0.0.1:51821 root@your-server, open http://127.0.0.1:51821/, add a client, scan the QR code with the WireGuard app. Connected.

Honestly

What we would actually buy

A VPN is a bandwidth bill with a tiny server attached. Buy the one without the meter.

For a personal VPN

U1-1 · $6.90/mo

1 vCPU, 1 GB, no traffic meter, $6.90 a month, in Istanbul: every phone and laptop you own, video included, and the bill never moves. It is the cheapest machine we sell and it is the right one for this. If the exit must be in another country, C1-1-25 at $9.90 is in 36 cities with 1 TB a month, which is browsing money, not streaming money. Neither runs our preset; the install is three commands.

Deploy U1-1C1-1-25 in another city

Questions

What people ask before they buy one.

What VPS do I need for WireGuard?
The smallest one. WireGuard lives in the kernel and moves hundreds of megabits on a single core; memory use is negligible. The resource that matters is transfer, because every byte you pull through the VPN enters the server and leaves it again. So the honest sizing question is not cores or RAM but whether the plan is unmetered or how many terabytes it includes.
Why does the page recommend an unmetered plan over a cheaper-looking metered one?
Because a VPN is the workload where transfer arithmetic bites. An evening of HD video is 3–5 GB; through a VPN that is 6–10 GB of server transfer. A 1 TB plan is fine for browsing and thin for a household that streams. The unmetered machine costs $6.90 and the question never arises.
What does the start-up preset do?
It installs Docker with Docker's own script, writes wg-easy's compose file with the web UI bound to 127.0.0.1 only, sets the project's unattended-setup variables with a random 24-character admin password and this server's address as the endpoint, starts it, and opens only 51820/udp on the firewall. The password is written to /root/WIREGUARD-NEXT-STEPS.txt, readable by root alone. No setup wizard is ever reachable from the internet.
Is the web UI exposed?
Not with the preset: it listens on loopback and you reach it over an SSH tunnel. wg-easy's own compose publishes 51821 on all interfaces and expects you to put HTTPS and a password in front; binding it to loopback is the simpler way to the same place. The VPN port 51820/udp is public by necessity — that is what clients connect to — and WireGuard is silent to anyone without a valid key.
Which city should the server be in?
Close to you for speed, or in the country whose internet you want to appear from. Latency is what you feel: pick the city with the lowest ping from where you sit, and if the purpose is an exit in a specific country, that decides it. C1-1-25 is the same shape in 36 cities.
Can I run something else on it?
A DNS filter (Pi-hole, AdGuard Home) beside wg-easy is the classic pairing and fits on 1–2 GB. Anything heavier deserves its own machine; the point of the VPN box is that it is small, boring and always up.

Keep reading

Related