Free VPN Server on Oracle Cloud Free Tier: Step-by-Step Setup Guide 2026

Introduction

In this step-by-step guide, you’ll deploy your own free VPN server on Oracle Cloud Free Tier and connect both your phone and computer. We’ll cover everything from signing up on Oracle to installing WireGuard, creating client configs, testing connections, and fixing common issues. By the end, you’ll have a personal VPN with a dedicated public IP, perfect for safe internet browsing, securing public Wi-Fi, and bypassing restrictions.

This guide is aimed at beginners but also includes advanced sections: IPv6 setup, extra server security, alternative protocols (OpenVPN, IKEv2), automation, and backups. No admin experience needed — just follow the instructions carefully and type commands exactly as shown.

What you should know beforehand: basic browser skills, copying commands into a terminal, and understanding usernames and passwords. No Linux experience required—all commands are provided fully.

Time required: 60–120 minutes. Most of this is initial registration, waiting for verifications, and careful network setup.

Preparation

Before you begin, make sure you have everything ready.

Required Tools and Access

• A personal email you can access.
• A mobile phone for verification codes.
• ID or card for Oracle account verification (needed to activate Free Tier; no charges if you select Always Free).
• A computer with a browser and stable internet connection.
• SSH client: on Windows - built-in OpenSSH via PowerShell or any terminal; on macOS/Linux - standard terminal.

System Requirements

• Oracle Cloud region that supports Free Tier resources.
• For clients: iOS or Android phone and/or PC running Windows/macOS/Linux to connect to the VPN.

What to Download or Install

• WireGuard app for your phone and computer (you’ll download these after generating the configs).
• Optional: QR code generator on the server (we’ll install the qrencode package with a command).

Backups

No need to back up anything yet. After setup, you’ll save client keys and configs. We’ll show you an easy way to store them securely.

Basic Concepts

Key Terms

• VPN — a secure tunnel between your device and the server that encrypts traffic and hides your real IP.
• WireGuard — a modern, fast VPN protocol over UDP. It's simple, secure, and runs on phones and PCs.
• Oracle Cloud Free Tier — Oracle’s free cloud plan allowing you to run small VMs indefinitely.
• VCN — Virtual Cloud Network in Oracle; this is like your private network hosting your servers.
• NSG/Security Lists — cloud firewall rules that control which ports are open externally.
• Public IP — the server’s external address used by clients to connect to the VPN.

How It Works

You create a VM in Oracle, assign it a public IP, install WireGuard, and open UDP port 51820 in your network policies. Your phone and computer get client configs with keys and connect to the server. All traffic goes through the VPN tunnel, is encrypted, and exits the internet with the server’s IP.

Key Points to Understand

• Your firewall runs on two levels: system-level on the server and cloud-level (NSG/security lists). Both must allow the required ports.
• Free Tier resources are limited. Choose a lightweight stack (WireGuard) and only essential services.
• Security: use SSH keys instead of passwords, keep the system updated, and don’t open unnecessary ports.

Step 1: Registering on Oracle Cloud Free Tier and Preparing Your Account

Goal

Create an Oracle Cloud account, activate Free Tier access, and log into the console.

Instructions

1. Go to the Oracle Cloud site and start Free Tier registration. Provide your country, email, and password.
2. Confirm your email via the code sent.
3. Fill in your profile: name, address, phone number. Choose your default region. Tip: You can change the region later when creating resources; pick one where Free Tier capacity is usually available.
4. Link a bank card to verify your account. This is a standard check — no charge if you choose Always Free.
5. Wait for verification and log into the Oracle Cloud Console.
6. Make sure the correct region is selected in the top right (e.g., Frankfurt, Amsterdam, London). If there’s no capacity, try another region.
7. Create a dedicated compartment (logical container) for the VPN: open the navigation menu, go to Identity and Security > Compartments, click Create Compartment. Name it vpn and save.
8. Check your Free Tier quotas: go to Governance and Administration > Limits, Quotas and Usage. Find Compute and confirm Always Free shapes (Ampere A1 or E2 Micro) are available.

⚠️ Note: If you see capacity shortages when creating instances, switch regions. This is common in popular regions. Don’t give up on the first try.

Expected Outcome

You’re logged into the Oracle Cloud Console, have created the vpn compartment, selected your working region, and Free Tier resources are accessible.

Common Issues and Fixes

• No email confirmation — check spam and resend the code.
• Card verification fails — try a different card or wait a few hours.
• Free Tier not available — complete profile verification fully and retry from the console.

✅ Check: The top menu shows your active account, selected region, and the vpn compartment in the list.

Step 2: Creating VCN, Subnet, Routes, and Security Rules

Goal

Set up a virtual network so your server can access the internet and clients can reach it.

Instructions

1. Open Networking menu, select Virtual Cloud Networks, and click Create VCN.
2. Choose Create VCN with Internet Connectivity (this auto-creates an internet gateway and route table).
3. Name it vcn-vpn, select compartment vpn, keep CIDR default 10.0.0.0/16, and create it.
4. Inside VCN, create a public subnet: go to Subnets, Create Subnet, name subnet-public, type Public, CIDR 10.0.0.0/24. Choose either an Availability Domain or Regional (Regional recommended).
5. Check that the VCN has an Internet Gateway attached and the Route Table includes 0.0.0.0/0 pointing to this gateway.
6. Create a Network Security Group (NSG) for your VPN: go to Network Security Groups, Create one named nsg-vpn.
7. Add NSG rules: allow UDP 51820 Ingress from anywhere (for WireGuard), allow TCP 22 Ingress from your IP or 0.0.0.0/0 for SSH (best to restrict to your IP), allow UDP 500 and 4500 Ingress (for future IKEv2), allow UDP 1194 Ingress (for future OpenVPN), and allow all Outgress 0.0.0.0/0.
8. If you use Security Lists instead of NSG, add the same rules to the subnet’s Security List.
9. Save your changes and ensure the Public Subnet uses the correct routes and NSG.

Tip: Use NSGs instead of security lists when possible: it’s easier to assign different rules to instances without changing subnet-wide settings.

⚠️ Warning: Don’t open unnecessary ports. For basic WireGuard, only UDP 51820 and SSH 22 are needed. You can add more ports later if required.

Expected Outcome

You will have a VCN with a public subnet, internet gateway, route table, and an NSG allowing UDP 51820 and SSH 22.

Common Issues and Fixes

• No internet from subnet — make sure 0.0.0.0/0 route points to the Internet Gateway.
• Port not open — confirm the NSG includes the rule and that the NSG will be attached to the instance in step 3.

✅ Check: VCN details show Internet Gateway, Route Table with 0.0.0.0/0 route, and NSG with proper rules.

Step 3: Creating an Always Free Ubuntu Virtual Server

Goal

Launch a free VM in Oracle Cloud with a public IP and SSH access.

Instructions

1. Open Compute > Instances, click Create Instance.
2. Name it vpn-wg, select compartment vpn.
3. Choose image Ubuntu 22.04 LTS (for Ampere A1, ensure ARM64 version). Ubuntu 24.04 LTS is fine if available and familiar.
4. Shape: click Change shape. Pick Always Free eligible shapes: VM.Standard.A1.Flex (Ampere A1) or VM.Standard.E2.1.Micro. For A1, assign 1 OCPU and 1–2 GB RAM; E2.micro is automatic. Mark Always Free eligible.
5. Networking: select VCN vcn-vpn and subnet subnet-public. Check Assign a public IPv4 address. Tip: Reserve the public IP as a Reserved Public IP after creation to keep it static across restarts.
6. Choose Network Security Groups: select nsg-vpn.
7. SSH keys: generate key pair on your machine if needed — on Windows PowerShell run ssh-keygen, same for macOS/Linux. Upload your public key in the console or paste contents of ~/.ssh/id_rsa.pub or ~/.ssh/id_ed25519.pub.
8. Boot volume: leave default 50 GB or reduce to 20 GB (does not affect Free Tier, but saves space).
9. Create the instance and wait until its status is Running.
10. Copy the instance’s public IPv4 address shown on its page, e.g. 129.146.XX.XX.
11. SSH in: on Windows PowerShell, run ssh ubuntu@PUBLIC_IP; same on macOS/Linux. If using a custom key, specify it: ssh -i ~/.ssh/id_ed25519 ubuntu@PUBLIC_IP.

Tip: If SSH fails, temporarily allow port 22 from anywhere in NSG, connect, then restrict NSG to your IP.

Expected Outcome

Your instance is created, running, has a public IPv4, and you’ve logged in as ubuntu over SSH.

Common Issues and Fixes

• Access denied (publickey) — make sure the correct public key was loaded and you're using the matching private key.
• Connection timed out — confirm instance is Running, has public IP, port 22 allowed in NSG/security list, provider isn’t blocking outgoing TCP 22.
• No Always Free shape — switch region and try again.

✅ Check: Running uname -a shows Linux kernel info; ip a lists interfaces and IPs.

Step 4: Basic Security and System Preparation

Goal

Update the OS, create a user, harden SSH, set up a basic firewall, and enable packet forwarding.

Instructions

1. Update the system: sudo apt update && sudo apt -y upgrade. Wait until done.
2. Create a separate admin user (optional but recommended): sudo adduser admin, set a password, then sudo usermod -aG sudo admin.
3. Copy SSH keys to the new user: while logged in as ubuntu, run sudo rsync -a ~/.ssh /home/admin/ && sudo chown -R admin:admin /home/admin/.ssh.
4. Optional: disable password login and allow only keys. Edit SSH config: sudo nano /etc/ssh/sshd_config, set PasswordAuthentication no, PermitRootLogin no, save and reload SSH: sudo systemctl reload ssh.
5. Install UFW firewall: sudo apt -y install ufw. Allow SSH: sudo ufw allow 22/tcp.
6. Do not enable UFW yet. We’ll add WireGuard rules and enable it later to avoid losing access.
7. Enable IP forwarding for NAT: edit sudo nano /etc/sysctl.conf, uncomment or add net.ipv4.ip_forward=1 and optionally net.ipv6.conf.all.forwarding=1. Apply with sudo sysctl -p.
8. Check CPU architecture: uname -m should return aarch64 (Ampere A1) or x86_64 (E2.micro).

Tip: Always back up configs before editing: sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak.

Expected Outcome

System is updated, admin user created (optional), SSH hardened, and IP forwarding enabled.

Common Issues and Fixes

• Lost SSH after changes — use Oracle’s serial console to restore backup config: sudo mv /etc/ssh/sshd_config.bak /etc/ssh/sshd_config && sudo systemctl restart ssh.
• Forwarding not active — confirm sysctl net.ipv4.ip_forward returns 1.

✅ Check: sysctl net.ipv4.ip_forward returns net.ipv4.ip_forward = 1, SSH session is active.

Step 5: Installing and Configuring WireGuard

Goal

Deploy WireGuard server, open required ports, set up NAT, and prepare client configurations.

Instructions

1. Install WireGuard and QR tool: sudo apt -y install wireguard qrencode.
2. Generate server keys: sudo umask 077; wg genkey | sudo tee /etc/wireguard/server.key | wg pubkey | sudo tee /etc/wireguard/server.pub. View public key: sudo cat /etc/wireguard/server.pub. Save it securely for debugging.
3. Choose VPN subnet: recommended IPv4 10.6.0.0/24 and IPv6 fd42:42:42::/64 (optional). Server's tunnel addresses are 10.6.0.1 and fd42:42:42::1.
4. Create server config file: sudo nano /etc/wireguard/wg0.conf. Paste:
   [Interface]
   Address = 10.6.0.1/24
   ListenPort = 51820
   PrivateKey = (paste contents of /etc/wireguard/server.key)
   PostUp = iptables -t nat -A POSTROUTING -s 10.6.0.0/24 -o eth0 -j MASQUERADE; iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT
   PostDown = iptables -t nat -D POSTROUTING -s 10.6.0.0/24 -o eth0 -j MASQUERADE; iptables -D FORWARD -i wg0 -j ACCEPT; iptables -D FORWARD -o wg0 -j ACCEPT
   If your interface isn’t eth0, find it with ip route get 1.1.1.1 and substitute accordingly (e.g., ens3).
5. Open port in UFW: sudo ufw allow 51820/udp. Then enable firewall: sudo ufw --force enable. Check status with sudo ufw status verbose. You should see rules for 22/tcp and 51820/udp.
6. Enable routing in UFW: edit sudo nano /etc/ufw/sysctl.conf, ensure net/ipv4/ip_forward=1 is set. Insert NAT rules into /etc/ufw/before.rules just before COMMIT in *nat table:
   *nat
   :POSTROUTING ACCEPT [0:0]
   -A POSTROUTING -s 10.6.0.0/24 -o eth0 -j MASQUERADE
   COMMIT
   Replace eth0 with your interface. Reload UFW: sudo ufw reload.
7. Enable WireGuard: sudo systemctl enable --now wg-quick@wg0. Check status: sudo systemctl status wg-quick@wg0 should show Active.
8. View interface state: sudo wg show. Interface wg0 should be listed with port 51820 listening.

Tip: Prefer iptables as shown for now; if you use nftables, adjust PostUp/PostDown accordingly and check UFW compatibility.

⚠️ Warning: Never share your private server key (/etc/wireguard/server.key), as it grants full VPN access.

Expected Outcome

WireGuard is running; UDP 51820 is open in UFW and NSG; NAT is set up; wg0 interface is active.

Common Issues and Fixes

• Service won’t start — check server.key permissions (should be 600), wg0.conf syntax, and correct interface name in NAT rules.
• Port closed — verify sudo ss -lunp | grep 51820 and NSG/UFW settings.
• No internet through tunnel — check MASQUERADE rules, IP forwarding, and route tables.

✅ Check: sudo wg show lists interface wg0 with ListenPort 51820; curl ifconfig.me on server shows its external IP.

Step 6: Adding Clients, Generating Configs, and Connecting

Goal

Create client configs for your phone and computer, add them to the server, and connect to your VPN.

Instructions

1. Identify your server’s public IP or hostname. Use the IPv4 found on the instance page. If you reserved the IP, it’s static. If not, reserve one in IP Addresses and attach it.
2. Generate client 1 keys (e.g., for phone): wg genkey | tee client1.key | wg pubkey | tee client1.pub. Save these securely.
3. Assign VPN address: 10.6.0.2/32 for client1. Next client gets 10.6.0.3/32, and so on.
4. Edit server config sudo nano /etc/wireguard/wg0.conf and add at the end:
   [Peer]
   PublicKey = (client1.pub contents)
   AllowedIPs = 10.6.0.2/32
   Save and apply changes with sudo wg syncconf wg0 <(sudo wg-quick strip wg0) or simply restart WireGuard: sudo systemctl restart wg-quick@wg0.
5. Create client config file: nano client1.conf with:
   [Interface]
   PrivateKey = (client1.key contents)
   Address = 10.6.0.2/32
   DNS = 1.1.1.1
   [Peer]
   PublicKey = (server.pub contents)
   AllowedIPs = 0.0.0.0/0
   Endpoint = PUBLIC_IP:51820
   PersistentKeepalive = 25
   Save the file. Tip: If you only want access to a corporate subnet, specify it in AllowedIPs (e.g., 10.10.0.0/16) instead of 0.0.0.0/0.
6. Generate a QR code for your phone: qrencode -t ansiutf8 < client1.conf to view in terminal, or save to PNG: qrencode -o client1.png < client1.conf.
7. Install the WireGuard app on your smartphone from the app store, open it, tap to add a tunnel, choose Scan from QR code, and scan the terminal QR or from client1.png. Save the profile.
8. On your PC, install the WireGuard client, choose Import from file, select client1.conf, and activate the tunnel via the switch.
9. Add client 2 (e.g., laptop) similarly: generate client2.key/client2.pub, assign 10.6.0.3/32, add [Peer] to wg0.conf, create client2.conf, and import it.

Tip: QR codes are easiest for iOS and Android; config files work best on Windows/macOS/Linux.

Expected Outcome

Clients connect successfully to WireGuard server. On phone/PC, toggling the tunnel turns the VPN on, routing traffic securely through it.

Common Issues and Fixes

• Handshake fails — verify keys are correct, UDP port 51820 allowed in NSG and UFW, Endpoint address is accurate, and client has internet.
• Connected but no internet — check MASQUERADE NAT, forwarding, and ensure AllowedIPs = 0.0.0.0/0 on client for full tunnel.
• Connection drops often — set PersistentKeepalive = 25 on client and check that your ISP doesn’t block UDP traffic.

✅ Check: On server, sudo wg show shows your client’s last handshake and data transfer. On client, open any website; your IP should match the server’s IP.

Verifying the Result

Checklist

• Oracle instance is Running with a public IP.
• VCN and subnet are configured with 0.0.0.0/0 route to Internet Gateway.
• NSG/security lists allow UDP 51820 and SSH 22.
• WireGuard is running and wg0 is active.
• Clients connect and traffic flows through VPN.

How to Test

1. On server: sudo wg show shows recent handshake information.
2. On client: check your IP online; it should display your Oracle server’s IP.
3. Test speed — WireGuard typically delivers good throughput even on Free Tier.

Success Indicators

• Client connects within 1–2 seconds without errors.
• Traffic counters on server increase as you load web pages.
• Stable connection over 10–15 minutes without drops.

Common Issues and Solutions

• Issue: Client won’t connect. Cause: Port 51820 blocked in NSG or UFW. Fix: Check NSG rules and sudo ufw status, allow port with sudo ufw allow 51820/udp.
• Issue: Connected but no internet. Cause: Missing NAT or disabled IP forwarding. Fix: Verify sysctl net.ipv4.ip_forward and MASQUERADE iptables rules; restart WireGuard.
• Issue: Server not listening on port. Cause: Syntax error in wg0.conf. Fix: Validate config file, remove extra spaces and invalid chars, recreate with a clean template.
• Issue: Lost SSH access after enabling UFW. Cause: Port 22 not allowed before enabling. Fix: On instance console run sudo ufw allow 22/tcp && sudo ufw reload.
• Issue: Connection drops over mobile network. Cause: ISP’s NAT aggressively blocks UDP. Fix: Set PersistentKeepalive=25, try ports 53/udp or 443/udp, update NSG and UFW accordingly.
• Issue: Public IP changes randomly. Cause: IP not reserved. Fix: Create Reserved Public IP in Oracle and bind it to your instance.
• Issue: Access blocked in some countries. Cause: Geo-restrictions on destination. Fix: Switch instance region closer to your audience.
• Issue: Low speed. Cause: Distant region, overloaded channel, weak Wi-Fi. Fix: Use a nearby region, test with wired or 5 GHz Wi-Fi, close background downloads.
• Issue: Permissions error on keys. Cause: Wrong file permissions. Fix: Run sudo chmod 600 /etc/wireguard/server.key, owner should be root.
• Issue: Client can’t see local network. Cause: Missing routes. Fix: Add local subnet to client’s AllowedIPs and configure server routes accordingly.

Additional Features

Advanced Security Settings

• Install Fail2ban to protect SSH: sudo apt -y install fail2ban, configure jail for sshd.
• Restrict SSH access by IP in NSG — keep only your home or office IP.
• Change SSH port: set a custom port in /etc/ssh/sshd_config and update NSG/UFW rules.

IPv6

If your Oracle region supports IPv6, add to the server’s [Interface] section: Address = fd42:42:42::1/64 and assign /128 IPv6 to clients. Add ::/0 to AllowedIPs for full IPv6 tunnel. Check sysctl net.ipv6.conf.all.forwarding=1. Add NAT66 only if needed—often routing alone suffices.

Alternative Protocols

• OpenVPN: better compatibility with legacy devices but heavier. Install openvpn, create server profile, open UDP port 1194. Remember NAT and forwarding.
• IKEv2 (strongSwan): native support on iOS/macOS/Windows, high quality, but certificate setup is complex. Open UDP 500 and 4500, configure strongSwan and client profiles.

Obfuscation and DPI Circumvention

If your network uses strict DPI, move WireGuard to port 443/udp or use UDP obfuscators. Some clients allow port renaming and external tunnels.

Custom DNS and Ad Blocking

Set up a lightweight DNS relay or Pi-hole on the same instance. Use its address as the DNS in client configs. Keep in mind memory consumption.

Backups and Keys

• Export /etc/wireguard and save securely: sudo tar czf wg-backup.tgz /etc/wireguard.
• Store private client and server keys in a password manager.

Automation and Infrastructure as Code

• cloud-init: attach user-data when creating instances to auto-deploy WireGuard.
• Terraform: describe VCN, subnet, NSG, instance, and IP as code to speed up recovery and cross-region transfers.

Monitoring

• Install prometheus-node-exporter or lightweight netdata for load graphs (consider Free Tier resource limitations).
• Regularly check systemctl status and logs with journalctl -u wg-quick@wg0.

Tip: Set a monthly reminder to check for updates: sudo apt update && sudo apt -y upgrade.

Tip: If running multiple instances in different regions, use consistent NSG rules and wg0.conf templates for easier management.

DIY Alternative for Quick Setup

If you need a personal VPN immediately without console setup or debugging, consider vpn.how. It’s a private VPN server service with dedicated IPs—not shared access—with support for WireGuard, OpenVPN, IKEv2, L2TP, SSTP protocols. Server locations include Moscow, Saint Petersburg, Amsterdam, Frankfurt, London, New York, San Jose, Chicago, Singapore, Sydney, Madrid, Helsinki, Stockholm, Warsaw, Copenhagen, Stavanger. Payments accepted from Russian cards (Tinkoff, Ozon), SBP, USDT/BTC. Plans start at ₽490/day or ₽2490/month with discounts for long terms. After payment, the server is ready in about 5 minutes with no logging. DIY gives full control but requires hours configuring, monitoring, and backing up. Ready solutions save time and effort for quick launch.

FAQ

• Which Oracle region offers the best speed? — The region closest to you geographically. Test ping and bandwidth. Frankfurt and Amsterdam are good for Europe; New York or San Jose for the US.
• Can I change WireGuard’s port? — Yes. Update ListenPort in wg0.conf, adjust NSG and UFW rules, and update Endpoint in client configs accordingly.
• Can multiple clients connect simultaneously? — Yes. Generate separate keys for each, assign unique /32 addresses, and add new [Peer] entries on the server.
• Can I route only some traffic via VPN? — Absolutely. Set specific IP prefixes in AllowedIPs (like corporate networks), while other traffic goes direct.
• What if I lose my public IP? — Check instance status. Reserve and bind a public IP to avoid changes after restarts.
• How to set up DNS-over-HTTPS inside the tunnel? — Run a local resolver that routes DNS over DoH/DoT and set its IP as DNS in client configs.
• Is IPv6 worth using? — Yes, if supported by clients and ISPs. It improves connectivity quality but requires routing and firewall setup.
• How do I remove a client? — Delete its [Peer] section from wg0.conf and restart the service. Remove client’s config file as well.
• How many clients can Free Tier handle? — Depends on load. Typically 5–20 simultaneous clients with moderate traffic work well.
• How to fully uninstall WireGuard? — Disable and stop service: sudo systemctl disable --now wg-quick@wg0, delete /etc/wireguard, remove UFW rules, and reboot.

Conclusion

You’ve completed the whole process — from Oracle Cloud Free Tier registration to launching a fast, secure WireGuard VPN. You created a virtual network, set firewall rules, spun up your free VM, installed and configured WireGuard, generated client configs, and connected devices successfully. Now you have a personal VPN with control at every level: cloud network settings through client profiles. Next, you can enhance features with IPv6, alternative protocols, custom DNS, monitoring, and backups. For scaling, consider automating with cloud-init or Terraform to quickly spin up replicas in other regions and ensure failover. For quick VPN access without console work, managed services like vpn.how save time, while the DIY approach gives maximum control and independence. Wishing you safe and speedy internet!