Run Your Own WireGuard VPN Server on a Raspberry Pi

Your own VPN — no subscription, no third party

Commercial VPNs are useful, but you’re ultimately trusting someone else’s infrastructure with your traffic. Running WireGuard on your Raspberry Pi flips that on its head: you own the server, you control the keys, and you can tunnel securely back into your home network from anywhere — a coffee shop, a hotel, an airport — without paying a penny per month.

WireGuard is the modern choice for this. It’s fast, lean, uses state-of-the-art cryptography, and the configuration is refreshingly simple compared to older VPN protocols like OpenVPN. It’s also baked into the Linux kernel, which means the Pi handles it natively without any additional overhead.

What you’ll need

• A Raspberry Pi (Pi 3B or newer recommended for comfortable performance)
• A static IP address or a dynamic DNS service (more on this below)
• Access to your router to forward a UDP port
• About 30 minutes

The easiest way: PiVPN

You could configure WireGuard entirely by hand, but PiVPN does the heavy lifting for you and is a much more sensible starting point. Install it with:

curl -L https://install.pivpn.io | bash

The installer will ask whether you want WireGuard or OpenVPN — choose WireGuard. It’ll generate all the necessary keys, configure the server, and set it up to start automatically on boot. It also creates a clean CLI for adding and removing client devices later.

Port forwarding

For devices outside your home to reach your Pi, you need to forward a port on your router to your Pi’s local IP address. WireGuard uses UDP, and the default port is 51820. Head into your router’s port forwarding settings and create a rule: UDP port 51820 → your Pi’s local IP.

Give your Pi a static local IP while you’re in there — you don’t want the DHCP lease shifting and breaking everything.

Dealing with a dynamic home IP

Most home broadband connections don’t come with a static public IP. The address your ISP gives you can change at any time. The fix is a dynamic DNS (DDNS) service — it gives you a hostname (something like yourhome.duckdns.org) that automatically updates when your IP changes. DuckDNS is free and works well. PiVPN will ask for your public IP or hostname during setup — use your DDNS hostname here.

Adding client devices

Once your server is running, adding a phone or laptop is simple:

pivpn add

This generates a config file and — usefully — a QR code you can scan directly with the WireGuard mobile app. Install WireGuard on your phone, scan the code, and you’re connected. The whole process takes about two minutes per device.

What you actually get

With your Pi’s VPN running, connecting from your phone or laptop tunnels all your traffic through your home connection. That means:

• Your traffic is encrypted end-to-end from your device to your Pi
• You can access devices on your home network remotely — NAS drives, local servers, other Pis
• If you’re also running Pi-hole, your VPN clients get ad blocking automatically
• You bypass geographic restrictions tied to your home country

Performance

WireGuard is genuinely fast. A Pi 4 can comfortably saturate most home broadband connections as a VPN endpoint — the bottleneck will almost certainly be your ISP’s upload speed rather than the Pi itself.

This is part two of our “Things to do with your old Raspberry Pi” series. Next week: ditching Google Drive and building your own private cloud with Nextcloud.