How to Host a VPN Server on a Dedicated Server
Running a VPN server on a dedicated server gives you something commercial VPN services cannot provide: full visibility and control over your VPN infrastructure. You know exactly where data is processed, who has access to the server, and what logs are kept. For businesses handling sensitive traffic, this distinction matters enormously.
This guide covers how to host a VPN on a dedicated server using WireGuard – the modern standard for high-performance self-hosted VPN. We compare WireGuard vs OpenVPN so you can make an informed choice before committing.
Why Host Your Own VPN on a Dedicated Server
Commercial VPN services route your traffic through shared infrastructure operated by a third party. You trust that company’s logging policies, jurisdiction, and security practices. A self-hosted VPN server on dedicated hardware removes that dependency. Your traffic flows through hardware you control, in a data center you chose, under a privacy policy you wrote.
For corporate use cases – remote employee access, securing communications between distributed offices, routing traffic through a specific country – a dedicated VPN server is the standard architecture. It scales cleanly, integrates with directory services, and gives your security team full audit capability.
“Self-hosting your VPN on dedicated hardware is the only way to make a provable statement about your data path. With commercial VPNs, you trust their audit reports. With your own dedicated server, you are the auditor.” – Unihost Security Team
WireGuard vs OpenVPN: Which to Choose
WireGuard is the correct choice for most new deployments in 2026. It is faster, simpler to configure, uses modern cryptography (ChaCha20, Curve25519), and has a dramatically smaller code base – approximately 4,000 lines versus OpenVPN’s 70,000+. Fewer lines means fewer potential vulnerabilities.
OpenVPN remains relevant when you need TCP-based VPN tunneling to traverse restrictive firewalls, or when your environment has legacy hardware that does not support WireGuard’s modern cipher suite.
| Criterion | WireGuard | OpenVPN |
|---|---|---|
| Protocol | UDP only (default) | UDP and TCP |
| Speed | Very fast – kernel-level | Slower – user-space TLS |
| Setup complexity | Simple, minimal config | More complex, CA management |
| Cryptography | Modern fixed suite (ChaCha20) | Configurable (older defaults possible) |
| Code size | ~4,000 lines | ~70,000 lines |
| Best for | New deployments, high throughput | Firewall traversal, legacy environments |
Server Requirements for VPN Hosting
A VPN server on dedicated hardware does not require significant compute power. The dominant resource is network bandwidth, not CPU. For 20-50 remote users connected simultaneously, a 1 Gbps uplink server with a modern CPU handles the load comfortably.
- CPU: Any modern 4-core processor. WireGuard runs in the Linux kernel > and is exceptionally efficient.
- RAM: 4-8 GB is adequate for up to 100 concurrent VPN clients.
- Storage: 20-50 GB SSD. VPN servers have minimal storage > requirements.
- Network: 1 Gbps minimum. Unmetered bandwidth preferred to avoid cost > unpredictability.
- OS: Ubuntu 22.04 LTS or Debian 12 recommended. WireGuard is in the > Linux kernel since 5.6.
Step-by-Step Setup (WireGuard)
- 1. Install WireGuard: apt update && apt install wireguard -y
- 2. Generate server keys: wg genkey | tee > /etc/wireguard/server_private.key | wg pubkey > > /etc/wireguard/server_public.key
- 3. Create /etc/wireguard/wg0.conf with server interface, ListenPort > 51820, and NAT iptables rules
- 4. Enable IP forwarding: echo ‘net.ipv4.ip_forward=1’ >> > /etc/sysctl.conf && sysctl -p
- 5. Start and enable: systemctl enable –now wg-quick@wg0
- 6. For each client: generate keypair, add [Peer] block to server > config with client public key
- 7. Open firewall port: ufw allow 51820/udp
- 8. Distribute client config file with server public key, endpoint > IP:51820
Security Best Practices
- Disable password authentication for SSH; use key-based > authentication only.
- Run ufw with a default-deny policy; open only ports you explicitly > need.
- Keep kernel and WireGuard tools updated – WireGuard patches are > kernel updates.
- Rotate WireGuard keys periodically – regenerate keypairs every 90 > days for sensitive deployments.
- Use a separate dedicated server for VPN rather than co-hosting with > application servers.
FAQ
Q: Can I run a VPN on a dedicated server?
A: Yes, and it is the recommended approach for business use. A dedicated server gives your VPN exclusive hardware resources, eliminates the noisy neighbor problem, provides a stable IP address, and gives your security team full visibility into the server environment.
Q: WireGuard or OpenVPN – which is better?
A: WireGuard is better for most use cases in 2026. It is faster, simpler to configure, and uses modern cryptography by default. OpenVPN is preferable when you need TCP tunneling to traverse restrictive firewalls or when your compliance requirements specify particular cipher suites.
Q: What specs do I need for a VPN server?
A: Network bandwidth is the primary resource, not CPU. For 20-50 concurrent users doing normal remote work, a server with a 4-core CPU, 8 GB RAM, and 1 Gbps unmetered uplink is more than sufficient. Scale based on number of concurrent users and their bandwidth consumption.
Q: How many users can one VPN server handle?
A: On a 1 Gbps uplink, a WireGuard server can handle hundreds of concurrent users for typical office traffic. The practical limit is bandwidth. 100 concurrent users at 5 Mbps each = 500 Mbps – within a 1 Gbps uplink. For 500+ high-bandwidth users, consider a 10 Gbps uplink or multiple VPN servers with load balancing.
