I Set Up My Own VPN on a Free-Tier Cloud Server — What I Learned
Commercial VPN apps are convenient, but I wanted to understand what is actually happening with my traffic — and a small cloud server I control myself is the cleanest way to learn. Recently I set up a WireGuard VPN on a free-tier cloud instance. The server itself took minutes; the lessons took longer. Here is what I would tell a friend before they start.
Why WireGuard
WireGuard is the default choice now for good reasons: it is small, fast, audited, and the clients on phones and laptops are official and simple. Setting it up means creating keys, writing one short config file per device, and opening a single UDP port. One device, one config — never share a config between two devices, or they will fight over the same identity.
Get a fixed IP first
Cloud instances often get a new public IP every time they restart. A VPN config points at an address, so a changing address means a broken VPN after every reboot. Binding a static IP before installing anything saves a round of confusion later. The same fixed address is also what a small website on the same machine needs for its DNS records.
The two traps that cost me an evening
First, IPv6. My first config tunnelled only IPv4 traffic, while the phone happily sent its IPv6 traffic outside the tunnel — straight into networks where it could not reach the services I was testing. The VPN looked "connected" and mostly worked, which made the fault hard to see. Second, file names. After regenerating keys a few times I had several config files all called the same thing, and imported an old, revoked one. Everything looked right; the server simply (and correctly) ignored the unknown key. A WireGuard app showing a green switch only means the tunnel is up on the phone — the server's handshake log is the ground truth.
Free tier is real, but read the meter
Free plans are genuinely useful for this: a small instance is far more than a personal VPN needs. But the allowance is finite. Traffic quotas, region choices and expiry dates differ wildly between providers, and some "free" regions are locked behind paid upgrades. My rule: never add a payment method "just to unlock" something on a free plan, and know your monthly traffic number before you start streaming video through the tunnel.
Would I do it again? Yes. A self-hosted VPN is not automatically more private than a good commercial one — the cloud provider can see your server — but it is yours: one user, one exit point, no shared IP reputation, and a machine that can also host a small website. As a learning project, it is hard to beat.