Running Your Own VPN Server: Picking the Country and the Plan

Running your own VPN server is a different proposition from buying a subscription. You get a fixed address that is yours, accounts you control, and a machine that is not shared with thousands of strangers whose behaviour ends up attached to your IP. What you give up is convenience, because nobody else patches it and there is no app to install on a smart television.

This covers the two decisions that actually matter, which country and which plan, plus the setup outline and the honest limits.

Why people run their own

• A fixed, clean address. Commercial VPN exit addresses are widely flagged, so banks, ticketing sites and business tools challenge or block them. A machine used by you and three colleagues does not carry that reputation.
• Remote access to your own systems. The common case is not anonymity at all, it is reaching an office network, a database or a management interface without exposing it to the internet.
• Accounts you control. One key per person and per device, revoked when a laptop is lost or someone leaves.
• Knowing what is logged. On your own server, what is recorded is whatever you configure and nothing else. That is a statement about control, not a promise that a VPN makes you anonymous.

Choosing the country

We run virtual machines in seven cities. The five below and Sofia in Bulgaria are inside the EU and the EEA, and the seventh is Ashburn in the US East region.

Two practical notes. Put the exit near the things you connect to, not near yourself, because your own hop to the server is paid once while every request afterwards runs from the server. And a VPN cannot make a distant service feel local: routing traffic through Vienna to reach a server in Vienna helps, routing it through Vienna to reach one in Sydney does not.

Choosing the plan

A VPN server is one of the lightest things you can run. Encryption is cheap on modern processors, and the work is proportional to traffic rather than to the number of configured users.

An Ion in Bucharest is €4.50 a month and in Vienna or Frankfurt €6.00, before VAT where it applies. Traffic is unmetered on every plan, so a month of video calls does not produce a surprise line on the invoice. Per city figures for the whole range are in our price by location breakdown.

Two extras are worth knowing about. Additional IPv4 addresses are €1.50 each per month, up to ten on one machine, which is how you give a specific person or a specific service its own exit address. And extra disk comes in 50 GB units at €4 per unit, which a VPN will never need but a file share behind it might.

Renting one for a trip

Every plan can also be taken by the hour, at the monthly price divided by 720 plus the location fee divided by 720. An Ion is €0.0084 an hour in Vienna, so a week away is 168 hours and €1.41. Two rules apply: deleting the server is what stops the charges, because a powered off machine still holds its disk and its address, and anything you keep permanently belongs on a monthly cycle, since 720 hourly units cost exactly one month.

Setting it up

An evening at most, and less if you have done it before.

1. Order the plan and pick the city. Choose Debian 12 or 13, or Ubuntu 24.04 LTS. All of them are in our image list, along with AlmaLinux, Rocky, Fedora, openSUSE, Arch and FreeBSD. Note that our KVM VPS range is Linux and FreeBSD only. Windows Server runs on our Windows RDP plans in Ashburn, in the US, and on bare metal in Europe.
2. Harden the box first. Key based SSH, no password logins, updates applied, and a firewall that allows the VPN port and your own SSH source and nothing else. The walkthrough in setting up a firewall is exactly the configuration you want.
3. Install WireGuard. It is in the standard repositories of every image above, it is a handful of lines of configuration, and it is the sensible default in 2026. Generate one key pair per device rather than sharing one.
4. Enable forwarding and address translation so traffic from the tunnel leaves through the server's address, then decide what the tunnel is allowed to reach. Full tunnel for everything, or split tunnel for only your own networks.
5. Add a resolver. Handing out a resolver on the server side stops DNS queries leaking around the tunnel, which is the most common way a working VPN still reveals what you are doing.
6. Test from a network you do not control, on a phone connection for example, and check both the address you present and the resolver you use.
7. Keep it patched. This is the part a subscription was doing for you. Automatic security updates plus a monthly look at the logs is the minimum. Our notes on server security cover the rest.

The honest limits

• Your own server is not anonymity. The machine is rented in your name and paid with your payment method. It gives you control and a clean address, and it is the wrong tool if your threat model requires you not to be identifiable.
• One machine is one point of failure. If the VPN is how your team reaches production, build a second one in another city. Our piece on pairing two locations explains the arrangement.
• Streaming platform access is not something we can promise. Providers detect and block datacenter ranges continually, and any host claiming otherwise is guessing.
• Selling VPN access is allowed. A VPN for yourself, your family or your team is a normal use of a server, and so is a commercial VPN service. You may sell subscriptions to your own paying customers from any VPS or dedicated server, with no special licence, no special product and no written approval from us. The only things ruled out are an open proxy that anyone can use without logging in, and using the tunnel to attack or spam anyone. Answer the abuse reports we forward to you and you are fine. The rules are in the acceptable use policy, and they are short.

Running a commercial VPN service on Voxa

Plenty of our customers sell VPN access to the public, and the servers are a good fit for it. What you need to know before launch:

• It is permitted on the plan you already have. Personal, team and commercial VPN use are all covered by the same terms. You do not need to upgrade, change product or ask us first.
• Traffic is unmetered in both directions. There is no transfer cap, no fair use threshold, no slowdown after a certain volume and no overage charge. The port speed of the plan is the only ceiling: 100 Mbps on Ion, rising to 300 Mbps on Titan. Sustained VPN traffic around the clock is normal use.
• Authenticate your users. WireGuard keys, VLESS or REALITY credentials, OpenVPN certificates: anything that keeps the service to your paying members. An unauthenticated open proxy is the one setup we do not allow.
• Scale out by city. Add a server in each country your customers want, and move busy exits onto a dedicated server when one VPS port is no longer enough.
• Want to sell servers rather than VPN access? The white label reseller programme lets you resell our servers under your own brand at wholesale prices.

Where to start

For most people the answer is an Ion in the country that matters to them, on a monthly cycle, with WireGuard and one key per device. That is €4.50 to €6.00 a month, depending on the country, for an exit address nobody else is using. Plans and cities are on the VPS page, and the private network use case page has the short version if you want to compare it with the rest of the range.