<\/span><\/h4>\r\n\r\n\r\n\r\nbash
sudo apt install wireguard
umask 077
wg genkey | tee privatekey | wg pubkey > publickey<\/pre>\r\n\r\n\r\n\r\n<\/span>Option 2: OpenVPN (robust and widely used)<\/span><\/h4>\r\n\r\n\r\n\r\nbash
sudo apt install openvpn easy-rsa
make-cadir ~\/openvpn-ca
cd ~\/openvpn-ca
.\/easyrsa init-pki
<\/code><\/pre>\r\n\r\n\r\n\r\nFollow the interactive steps to build CA, server, and client certificates.<\/p>\r\n\r\n\r\n\r\n
<\/span>C. Configure VPN Server<\/span><\/h3>\r\n\r\n\r\n\r\n<\/span>WireGuard<\/span><\/h4>\r\n\r\n\r\n\r\n\r\n- Create
\/etc\/wireguard\/wg0.conf<\/code>:<\/li>\r\n<\/ul>\r\n\r\n\r\n\r\nini
[Interface]
Address = 10.0.0.1\/24
PrivateKey = (your privatekey)
ListenPort = 51820
[Peer]
PublicKey = (client's publickey)
AllowedIPs = 10.0.0.2\/32<\/pre>\r\n\r\n\r\n\r\n
\r\n- Enable forwarding:<\/li>\r\n<\/ul>\r\n\r\n\r\n\r\n
bash
sudo sysctl -w net.ipv4.ip_forward=1
sudo ufw allow 51820\/udp
sudo systemctl enable wg-quick@wg0
sudo systemctl start wg-quick@wg0
<\/code><\/pre>\r\n\r\n\r\n\r\n<\/span>OpenVPN<\/span><\/h4>\r\n\r\n\r\n\r\n\r\n- Generate
server.conf<\/code>, configure port, protocols, and routes.<\/li>\r\n\r\n\r\n\r\n- Set
push \"redirect-gateway def1 bypass-dhcp\"<\/code><\/li>\r\n\r\n\r\n\r\n- Configure DNS:<\/li>\r\n<\/ul>\r\n\r\n\r\n\r\n
bash
push \"dhcp-option DNS 1.1.1.1\"
push \"dhcp-option DNS 1.0.0.1\"<\/pre>\r\n\r\n\r\n\r\n
\r\n- Enable forwarding and start service:<\/li>\r\n<\/ul>\r\n\r\n\r\n\r\n
bash
sudo ufw allow 1194\/udp
sudo systemctl enable openvpn@server<\/pre>\r\n\r\n\r\n\r\n<\/span>Configure Your Client Devices<\/span><\/h2>\r\n\r\n\r\n\r\n<\/span>WireGuard (macOS\/Linux)<\/span><\/h3>\r\n\r\n\r\n\r\nbash
[Interface]
PrivateKey = (client key)
Address = 10.0.0.2\/24
DNS = 1.1.1.1
<\/code>[Peer]
PublicKey = (server publickey)
Endpoint = your.vps.ip:51820
AllowedIPs = 0.0.0.0\/0
PersistentKeepalive = 25
<\/code><\/pre>\r\n\r\n\r\n\r\nUse wg-quick up wg0-client.<\/p>\r\n\r\n\r\n\r\n
<\/span>OpenVPN (Windows\/macOS\/Linux)<\/span><\/h3>\r\n\r\n\r\n\r\n\r\n- Generate
.ovpn<\/code> with embedded certs.<\/li>\r\n\r\n\r\n\r\n- Import into the OpenVPN client and connect.<\/li>\r\n<\/ul>\r\n\r\n\r\n\r\n
<\/span>Verify & Enhance Your Setup<\/span><\/h2>\r\n\r\n\r\n\r\n\r\n- Check VPN is active:<\/li>\r\n<\/ul>\r\n\r\n\r\n\r\n
bash
wg show (WireGuard)
sudo systemctl status openvpn@server
<\/code><\/pre>\r\n\r\n\r\n\r\n\r\n- Confirm the IP change at
ipleak.net<\/code>, dnsleaktest.com<\/code>.<\/li>\r\n\r\n\r\n\r\n- Use WireGuard\u2019s peer log or OpenVPN\u2019s
status.log<\/code>.<\/li>\r\n<\/ul>\r\n<\/span>Tips for Privacy & Security<\/span><\/h2>\r\nRunning your own VPN on a VPS already puts you ahead of most users, but a few smart practices can make it even more secure and reliable.<\/p>\r\n
<\/span>Enable Auto-Start at Boot<\/span><\/h3>\r\nMake sure your VPN service starts automatically when the server reboots. This ensures your VPN is always active, even after updates or unexpected restarts, so you\u2019re never left unprotected.<\/p>\r\n
<\/span>Rotate Keys Periodically<\/span><\/h3>\r\nJust like passwords, VPN keys shouldn\u2019t live forever. Rotating keys every few months reduces the risk of compromised credentials and keeps your setup fresh and secure, especially if multiple devices or users connect.<\/p>\r\n
<\/span>Lock Down Your Firewall<\/span><\/h3>\r\nA strong firewall is essential. Allow only the ports your VPN actually needs, block everything else, and restrict access to configuration files. This minimizes the attack surface and protects sensitive data from unauthorized access.<\/p>\r\n
<\/span>Use Modern, Strong Encryption<\/span><\/h3>\r\nUse proven encryption algorithms such as AES-256-GCM or ChaCha20-Poly1305. These encryption algorithms provide top-notch security with minimal performance impact and are highly recommended for a modern VPN configuration.<\/p>\r\n
<\/span>Use Privacy-Focused DNS Servers<\/span><\/h3>\r\nConfigure your VPN to use a DNS service like Cloudflare (1.1.1.1) or Quad9 (9.9.9.9) to prevent ISP-level DNS tracking. This will prevent DNS leaks and ensure that your browsing activity remains private.<\/p>\r\n
<\/span>Keep the Server Updated<\/span><\/h3>\r\nMake sure that your VPS operating system and VPN software are kept up to date. Security updates will patch vulnerabilities before they are exploited, and this is one of the easiest ways to ensure that you remain secure.<\/p>\r\n
<\/span>Limit User Access<\/span><\/h3>\r\nYou should only set up VPN profiles for trusted devices or individuals. If a device is lost or no longer in use, you should remove its access privileges immediately.<\/p>\r\n
<\/span>Monitor Logs and Connections<\/span><\/h3>\r\nAlthough you do not need to monitor activity logs, it is important to monitor connection logs to identify any suspicious activity early on, such as failed connection attempts or unknown clients.<\/p>\r\n
By implementing these best practices, your VPS VPN will always be secure, private, and reliable.<\/p>\r\n\r\n\r\n\r\n