VPN on a $5 VPS in 2026: Step-by-Step Guide — Hetzner and Contabo

Introduction

You’ll get a personal VPN server on a $5 VPS, configured following all security best practices and ready to use on your phone, laptop, and desktop. We’ll set up WireGuard as a fast, modern protocol, optionally add OpenVPN for compatibility, enable a firewall and automatic updates, configure client profiles, and debug routing. By the end, you’ll have a clear management system and fallback instructions for troubleshooting.

This guide is aimed at beginners but includes sections for advanced users: fine-tuning UFW and sysctl, working with IPv6, access segregation, adding OpenVPN, and monitoring options. We’ll proceed step by step, with no skips and checks at every stage.

What you need to know beforehand. Basic skills copying commands and knowing where to run them are enough. We explain terms in simple language. No special Linux knowledge is required, but familiarity with SSH and the apt package manager will help.

How much time you’ll need. Basic installation and verification take about 2-3 hours. With advanced settings and OpenVPN, expect 3-5 hours. Most of the time will be spent on careful checks and transferring profiles to devices.

Preliminary Preparation

Tools and access required. You’ll need an account with a VPS provider—ideally prepare two payment cards in case one payment fails—and a device to manage the server. Windows, macOS, or Linux all work. On Windows, a terminal and SSH client are handy; macOS and Linux already have a terminal. You’ll need stable internet and 30-60 minutes of uninterrupted time for each major step.

System requirements. WireGuard and OpenVPN run well on 1 virtual CPU, 1GB RAM, and 20-40GB disk. If you plan to connect more than 10 clients and stream media heavily, get 2GB RAM. Bandwidth depends on your provider’s plan and the network itself. In most cases, the minimal configurations from Hetzner and Contabo handle home traffic and Full HD video streaming smoothly.

What to install on your computer. On Windows, install an SSH client—modern versions include one as a standard feature. macOS and Linux already have SSH installed. Also install a text editor to edit config files—Notepad or any other will do. For mobile devices, pre-download WireGuard and OpenVPN client apps from official stores but wait to install them until after the server is set up.

Backup preparation. There’s nothing to back up yet, but later we’ll configure VPN config backups. Prepare a folder on your computer to store keys and client configs. Give it a clear name like VPN-configs and avoid syncing it to public cloud storage. Configs may contain private keys.

Basic Concepts

Key terms in plain language. A VPS is a remote virtual server in a data center. You get its public IP and full admin rights. A VPN is an encrypted tunnel between your device and the server. WireGuard is a modern, fast protocol using a key pair and easy to set up. OpenVPN is classic and versatile, often needed for older devices and corporate networks. UFW firewall is a user-friendly interface for managing network rules. SSH is a secure way to connect to the server from a terminal.

How it works. Your device sends traffic through an encrypted tunnel to the VPS. The server replaces your original IP with its own and forwards traffic to the internet. Replies come back to the VPS and return via the tunnel to you. Security relies on cryptography and limiting external access with firewall rules. Proper routing prevents leaks so requests never bypass the VPN and reveal your real provider IP.

What’s important to understand before starting. Two key points: security and repeatability. We’ll keep minimal services on the server, disable unnecessary ones, enable updates and config versioning. You’ll always be able to add new clients, revoke lost profiles, and move the server to another provider. Follow the instructions carefully and verify each intermediate result.

Step 1: Choosing and Ordering a $5 VPS from Hetzner or Contabo

Goal

Get a working VPS with a public IP, Ubuntu LTS installed, and correct SSH credentials.

Step-by-step

1. Log into your chosen provider’s control panel and go to create a new server.
2. Pick a region. The closest to you means lower latency. Popular European options are Germany and the Netherlands. For the US, East or West Coast. For mixed use, choose Central Europe.
3. Select the OS image. We recommend Ubuntu 24.04 LTS. It’s well supported and comes with all necessary packages out of the box.
4. Choose your plan size. For about $5, pick 1 vCPU, 1GB RAM, and 20-40GB disk. Check the actual price in the interface; it may vary due to currency and taxes.
5. Leave network settings as default. Enable IPv6 if available—it helps with compatibility and testing.
6. Create or add an SSH key. If you don’t have one, we’ll generate it next and temporarily allow password login. If your panel offers it, set a strong password and save it in a password manager.
7. Confirm the order and wait for the instance to launch. You’ll see the public IP and hostname; save them in your notes.

⚠️ Note: Providers may restrict certain traffic types or activities. Check the usage policies for your country and provider. Don’t use VPNs for illegal actions.

Tip: If you’re unsure between Hetzner and Contabo, choose based on data center proximity and panel usability. Moving your config later is easy if you keep your setup files safe.

✅ Check: Server created, IP visible, status active. Panel shows Ubuntu 24.04 LTS image and SSH access enabled.

Common Issues and Solutions

• Server won’t start. Cause: temporary provider issues. Fix by canceling and creating again or picking another region.
• No IPv6. Cause: plan or location doesn’t support it. Fix: continue with IPv4, it’s not critical.
• Payment failed. Cause: bank restrictions. Fix: use another card or supported payment method.

Step 2: First SSH Connection and Basic System Check

Goal

Connect to the VPS, confirm availability, check system version, and verify network interfaces.

Step-by-step

1. Open a terminal on your computer. On Windows, this might be Windows Terminal. On macOS and Linux, open the standard Terminal.
2. Run ssh username@server_IP. If you haven’t created a user, use default root or ubuntu depending on the image; the provider panel shows this info.
3. At first login, confirm the server’s key fingerprint. This is normal. When prompted, accept to continue.
4. Enter the password if asked. If using keys, access will be granted immediately if the key is correct.
5. Check OS version by running cat on the release version file in /etc. Verify it is Ubuntu 24.04 LTS.
6. Check network interfaces using ip a. You should see interfaces like eth0 or ens3 with an external IPv4 address. If IPv6 is enabled, there will be addresses with colons.

Tip: Enable command history in your notes right away. After each major step, copy commands used into a local file to simplify troubleshooting and reconfiguration.

✅ Check: Successfully logged in via SSH, saw the command prompt, verified Ubuntu version, and confirmed presence of network interfaces with IPv4 and IPv6 if available.

Common Issues and Solutions

• SSH won’t connect. Cause: port closed or wrong IP. Fix: verify IP and port, restart instance from provider panel, check firewall rules aren’t blocking access.
• Timeout on login. Cause: network problems or wrong username. Fix: confirm username and that server is running.
• Wrong key fingerprint. Cause: server recreated on same IP. Fix: clear known_hosts entry on local machine.

Step 3: Security Basics — Updates, Users, SSH Keys, and Firewall

Goal

Protect the server from common attacks, disable password login, enable UFW, and prepare the system for VPN installation.

Step-by-step

1. Update packages. Run apt update followed by apt upgrade with confirmation. Wait until done.
2. Install basic utilities: sudo, ufw, htop, curl, qrencode. qrencode helps transfer configs to phones via QR codes. If curl isn’t present, install it—it’s useful for diagnostics.
3. Create a separate user with sudo rights. Add the user, assign a strong password, and add to the sudo group.
4. Generate an SSH key pair on your local machine if you don’t have one. Use SSH client commands accordingly on Windows/macOS/Linux. Store your private key securely.
5. Copy the public key to the server for the new user via ssh-copy-id or manual copy. Ensure the server’s key file contains your key.
6. Disable password login for SSH. Edit the SSH server config to set PasswordAuthentication to no, and confirm key-based login is allowed.
7. Restart the SSH service. Check that your connection stays alive. Keep your current session open until testing new logins in a second window.
8. Open a new terminal and connect to the server as the new user via key. Confirm access works.
9. Enable and configure UFW firewall. Allow port 22 for SSH, set default rules to deny incoming and allow outgoing traffic. Enable UFW and check connectivity.

⚠️ Warning: Never close your only active SSH session before confirming a new connection works. Losing access means using your provider’s console to recover.

Tip: Restrict SSH access by IP if you have a static home address. Add a UFW rule allowing SSH only from your IP and remove the general SSH allow rule.

✅ Check: You can log in as the new user by key, password login is disabled, UFW active showing allowed SSH and blocked other incoming connections.

Common Issues and Solutions

• Lost SSH after config change. Cause: config error. Fix: use provider console to revert and carefully retry changes.
• UFW blocking SSH. Cause: missing allow rule on port 22. Fix: add allow rule and enable UFW again.
• Key addition fails. Cause: incorrect permissions on .ssh directory or authorized_keys. Fix: ensure proper permissions and ownership.

Step 4: Install and Configure WireGuard on the Server

Goal

Install WireGuard, generate server keys, configure the tunnel, and enable routing and NAT for internet access through the VPS.

Step-by-step

1. Install WireGuard: apt install wireguard. Wait for completion.
2. Create a keys directory with strict permissions. Use a umask to restrict access and create files for server’s private and public keys.
3. Generate WireGuard keys for the server. Save the private key confidentially, and derive the public key. Never share the private key.
4. Set IP subnets for the VPN. Use 10.8.0.0/24 for IPv4 and fd86 for IPv6 ULA. Server will have 10.8.0.1 and corresponding IPv6 address as interface wg0.
5. Create WireGuard config file at /etc/wireguard/wg0.conf. Define the Interface section with Address 10.8.0.1/24 and local IPv6, ListenPort 51820 UDP, PrivateKey, and SaveConfig true. Add PostUp and PostDown rules for NAT masquerading and packet forwarding (usually via iptables). Adjust PostUp rules to allow forwarding and masquerading over your main outgoing interface, like eth0 or ens3, and mirror in PostDown for cleanup.
6. Enable packet forwarding system-wide. Create a file in /etc/sysctl.d/ with net.ipv4.ip_forward=1 and net.ipv6.conf.all.forwarding=1. Apply with sysctl --system.
7. Open WireGuard port 51820 UDP in UFW. Confirm UFW status.
8. Bring up WireGuard interface: wg-quick up wg0. Confirm no errors. Enable autostart: systemctl enable wg-quick@wg0.
9. Verify interface wg0 appears with ip a showing 10.8.0.1 and IPv6 ULA addresses.

Tip: If your server’s main interface isn’t eth0 but something else, adjust PostUp/PostDown rules accordingly. Find the default interface with ip route show default.

✅ Check: wg show shows interface wg0 with no peers, UFW allows UDP 51820, and ip a shows 10.8.0.1 on wg0. Packet forwarding is active.

Common Issues and Solutions

• wg-quick fails. Cause: typos in config. Fix: check syntax, empty lines, and file permissions.
• Forwarding not enabled. Cause: sysctl changes not applied. Fix: rerun sysctl --system and verify.
• Port not reachable externally. Cause: UFW blocking or provider firewall. Fix: add UFW rule and configure provider’s firewall panel.

Step 5: Create WireGuard Client Profiles and Connect Devices

Goal

Generate client keys, register clients on the server, prepare configs for phones and laptops, connect and verify traffic.

Step-by-step

1. Generate client key pairs on the server or locally. Server centralizes easier. Create /etc/wireguard/clients and subfolders named by clients, e.g., phone or laptop.
2. Create private and public keys for each client and save with strict permissions.
3. Assign client IP addresses in the VPN network, e.g., 10.8.0.2 for the first client plus matching IPv6 ULA. Remember these values.
4. Edit server wg0.conf, add a Peer section for each client. Include client PublicKey, AllowedIPs (10.8.0.2/32 plus IPv6/128). Save config. If SaveConfig is true, you can add peers dynamically with wg set and save.
5. Create client config file. Under Interface, specify client PrivateKey, Address(es), and DNS servers like 1.1.1.1 plus IPv6 resolver. Under Peer, set server PublicKey, Endpoint (server IP and port 51820), PersistentKeepalive 25, and AllowedIPs 0.0.0.0/0 and ::/0 to route all traffic through the tunnel.
6. Restart wg0 or reload server config to apply new peers.
7. Export client config to the device. For phones, generate a QR code from the config text. Open WireGuard app and import via QR. For laptops, copy config via SCP to a secure folder.
8. Activate the tunnel on the client. In WireGuard app, enable the profile, confirm status shows connected with a recent handshake time.

Tip: Use clear, descriptive names when generating profiles, like phone-ivan or macbook-work. It makes auditing and revoking keys easier.

✅ Check: Server wg show lists the peer with public key, last handshake time, and traffic counters. Client profile is active and shows connected status.

Common Issues and Solutions

• Client won’t connect. Cause: wrong Endpoint or blocked port. Fix: verify server IP, ensure UDP 51820 allowed in UFW, restart service if needed.
• Connection exists but no internet. Cause: missing NAT or incorrect forwarding rules. Fix: check sysctl and PostUp scripts; verify correct outgoing interface.
• Import to phone fails. Cause: encoding issues or incomplete config. Fix: open config in a simple text editor and verify all sections and keys are present.

Step 6: Traffic Testing and Protection Against DNS and IPv6 Leaks

Goal

Ensure all traffic routes through VPN, avoid DNS leaks, and properly handle IPv6 so apps don’t leak outside the tunnel.

Step-by-step

1. Check routing on the client. On computers, open terminal and view routing table; default route should be via WireGuard interface. On phones, confirm status icon in app and successful requests.
2. Ensure DNS queries use specified servers. If configured, client will resolve DNS through the tunnel. Check client DNS settings match VPN config.
3. Verify no IPv6 leaks. If IPv6 enabled on client, AllowedIPs must include ::/0 so IPv6 traffic goes through VPN. If your provider doesn’t offer IPv6, ensure client isn’t sending IPv6 traffic outside.
4. Test opening a few websites and streaming video. Evaluate stability, latency, and speed. Speed depends on server location, plan, and current network load.
5. Check server counters: wg show should show real-time increases in bytes sent and received during active client use.

Tip: To check for leaks, you can temporarily disable the physical network interface on the client and rely only on VPN, but it’s easier to carefully review routes and app behavior. Some apps can bypass VPN via internal proxy settings—check those.

✅ Check: Internet works on client with privacy intact, server traffic counters increase, routes go via WireGuard, and logs show no errors.

Common Issues and Solutions

• High latency and slow speeds. Cause: distant region or overloaded plan. Fix: switch server region or upgrade plan.
• DNS leaks. Cause: system resolver ignoring VPN DNS. Fix: specify DNS again in config or enable DNS enforcement client-side.
• IPv6 leaks. Cause: missing ::/0 in AllowedIPs. Fix: add and restart tunnel.

Step 7: Alternative Setup — Installing OpenVPN on the Same VPS

Goal

Install OpenVPN as a backup or compatible protocol for devices without WireGuard support.

Step-by-step

1. Install packages: apt install openvpn easy-rsa. This installs the OpenVPN server and key/certificate tools.
2. Initialize key infrastructure. Create a PKI directory, set up a root CA, generate root certificate with a strong password and defaults, then create server and client certificates, sign them with the root, and create Diffie-Hellman parameters.
3. Create OpenVPN server config file server.conf. Specify UDP port 1194, protocol udp, dev tun, client pool 10.9.0.0/24, push default route redirect-gateway def1, push DNS servers, paths to keys and certs, allow multiple clients with client-config-dir if needed for individual client settings, enable keepalive, and disable compression for security.
4. Open port 1194 UDP in UFW. Add allow rule and check firewall status.
5. Set up IP forwarding and NAT for OpenVPN. Forwarding enabled earlier covers OpenVPN. Add masquerade rules for 10.9.0.0 subnet if WireGuard’s PostUp doesn’t cover it. Alternatively, create separate NAT block in UFW for both 10.8.0.0 and 10.9.0.0.
6. Start OpenVPN service and enable autostart. Check status for errors and listening port.
7. Create client .ovpn profile combining client parameters, server remote IP and port 1194, protocol udp, dev tun, and inline ca, cert, key, and tls-auth contents for easy mobile import.
8. Import the profile to devices using the official OpenVPN app and connect. Verify routing and internet access.

Tip: Keep OpenVPN client profiles separate from WireGuard and label files clearly, like phone-wg.conf and phone-ovpn.ovpn.

✅ Check: OpenVPN service is active, logs show successful start, client connects getting an IP from 10.9.0.0 pool, and internet works through the server.

Common Issues and Solutions

• OpenVPN won’t start. Cause: incorrect cert paths or file format. Fix: verify config and file permissions.
• Client misses routes. Cause: missing push directives. Fix: add push redirect-gateway def1 and push DNS options.
• Port conflicts. Cause: port in use by another process. Fix: pick another port or free the current one.

Step 8: Maintenance — Monitoring, Backups, and Recovery

Goal

Ensure stable VPN operation, automatic updates, config backups, and a solid recovery plan.

Step-by-step

1. Enable system auto-updates. Install unattended-upgrades, enable it, and check status. This reduces vulnerabilities.
2. Set up backup of configs. Archive WireGuard and OpenVPN files including keys and client profiles. Copy archive to your local machine and encrypted storage. Don’t keep sole copies on the server.
3. Maintain a change log. Whenever adding clients or changing firewall rules, log the date and summary.
4. Configure uptime monitoring. At minimum, regularly check WireGuard port and SSH accessibility. Use system timers to monitor service health and restart on failure.
5. Prepare a recovery plan. Steps to redeploy a new server with the same provider: reinstall WireGuard, deploy configs and keys from backup, open ports, and verify access. Store the plan with your config archive.
6. Regularly review logs. Check systemd logs for wg-quick and openvpn, plus UFW status to catch anomalies early.

Tip: Protect backup archives with passwords and store in a secure container. Test that you can decrypt them on another device before you actually need them.

✅ Check: Auto-updates enabled, backups created and tested, clean logs, services active after reboot, and clear recovery plan documented.

Common Issues and Solutions

• Auto-updates restarted services. Cause: kernel or network package update. Fix: schedule maintenance windows and manually control major updates.
• Backups out of date. Cause: forgot to redo after changes. Fix: automate periodic archive creation.
• Monitoring missed downtime. Cause: lack of port checks. Fix: add explicit UDP 51820 availability tests and log results.

Result Verification

Checklist — What Should Work

• SSH login by key for a separate user without passwords.
• UFW active, ports 22 and 51820 (optionally 1194) allowed.
• WireGuard running, wg0 interface visible with 10.8.0.1 address.
• Client profile connects, handshake occurs, traffic counters increase.
• Default route goes via VPN; no DNS or IPv6 leaks.
• Backups created and tested for readability.

How to Test

• Toggle client profile on/off and confirm internet only works when profile is active if default routes are set.
• Access a region-restricted site to verify traffic routes through chosen server location.
• Verify persistent connections after rebooting server and client.

Success Indicators

• Connections establish within seconds.
• Streaming video buffers normally without extra delays.
• No error messages in WireGuard or OpenVPN logs.

Common Errors and Fixes

• Client connected but no internet. Cause: missing NAT or forwarding disabled. Fix: add masquerading for outgoing interface, enable sysctl forwarding, restart wg-quick.
• Client can’t connect. Cause: UDP 51820 blocked by UFW. Fix: allow UDP 51820 or temporarily disable strict firewall on host.
• Handshake occurs but no traffic. Cause: AllowedIPs on client missing full routing. Fix: add 0.0.0.0/0 and ::/0 to client profile.
• Sudden disconnects. Cause: provider deprioritizes UDP traffic. Fix: add PersistentKeepalive 25 and consider changing region or VPS provider.
• Address conflicts. Cause: internal device network overlaps VPN subnet. Fix: choose a different VPN subnet like 10.10.0.0/24 and reconfigure addresses.
• OpenVPN profile won’t import. Cause: missing inline certs or wrong file paths. Fix: embed certificates inline and check format.
• Lost SSH access. Cause: overly strict UFW rules or port changed without updating rules. Fix: restore access via provider console and fix firewall rules.

Additional Features

Advanced Settings

• Split tunneling. Route only certain subnets through VPN by specifying precise prefixes in AllowedIPs rather than 0.0.0.0/0 and ::/0, e.g., office network or specific services.
• Access policies. Segment clients by subnet so they don’t see each other. Assign AllowedIPs per client for just server addresses and needed routes.
• IPv6 tunneling. If your VPS has real IPv6, assign client addresses from that prefix and route traffic without NAT, improving transparency and sometimes performance.
• Switching iptables to nftables. Modern systems move to nftables. Rewrite PostUp/PostDown accordingly for simpler and clearer rules.
• Changing WireGuard port. Using a non-standard port can improve resistance to aggressive traffic shaping by your provider. Remember to update UFW and client configs.

Optimization

• MTU tuning. For some networks, reducing tunnel MTU to around 1380 improves stability. Set MTU in Interface section and test.
• No compression for WireGuard. It’s fast without compression. For security, avoid compression in OpenVPN too; modern links are fast enough.
• Multiple regions. If you travel often, deploy a second server in another region and keep two profiles on your client to switch as needed.

What Else You Can Do

• Add two-factor SSH authentication for extra server protection.
• Configure connection logging at the firewall level without storing user activity inside the tunnel to keep VPN logs minimal.
• Automate adding clients with scripts to simplify routine and reduce errors.

FAQ

How to choose a region for minimal latency? Pick the data center closest to where you mostly are. For Europe, central or northern regions work well. For the US, East or West Coast based on distance.

How many clients can $5 VPS support? Usually 5-10 clients handle typical home usage fine. 4K video streaming on multiple devices requires stronger resources.

Do I need a static home IP? No. Static IPs help restrict SSH by IP but are not required. WireGuard works over any internet, including cellular.

Can access to some sites be limited via VPN? Yes. Configure client rules with specific AllowedIPs to route only selected subnets through VPN; other traffic goes direct.

How to quickly revoke a lost client profile? Remove its Peer section from the server config and save, or use wg set to remove the public key immediately.

What if internet stops working after updates? Check if default interface name changed, verify PostUp/PostDown reference the right interface. Review UFW rules and reapply sysctl.

Can WireGuard and OpenVPN run on the same VPS? Yes, on different ports with careful routing they coexist peacefully. Make sure IP pools don’t overlap.

Which DNS to specify in profiles? Use fast public resolvers by IP. Choose reliable ones that don’t require hostname in configs to avoid syntax errors.

How to move server to another provider? Deploy a new VPS, install WireGuard, copy configs and keys, open needed ports, and update client Endpoints with the new IP.

Is it safe to store client configs on phones? Keep phones screen-locked and don’t share configs via messengers. Prefer importing via QR code directly from the server and avoid saving files in public folders.

Conclusion

We covered the full path from choosing a VPS at Hetzner or Contabo to setting up your personal VPN server with WireGuard and optional OpenVPN. You secured SSH access, enabled firewall, generated keys, created client profiles, verified routes to block leaks, enabled auto-updates, and arranged backups. The result is a personal, predictable, and manageable VPN without shared IP address space, flexible to scale or transfer providers as needed.

If you want results immediately without command-line hassle, consider a ready-made personal VPN service like vpn.how. They offer dedicated IPs, multiple protocols including WireGuard, OpenVPN, IKEv2, L2TP, SSTP, data centers in cities like Moscow, Saint Petersburg, Amsterdam, Frankfurt, London, New York, San Jose, Chicago, Singapore, Sydney, Madrid, Helsinki, Stockholm, Warsaw, Copenhagen, Stavanger, support common Russian payment methods including bank cards, SBP, and cryptocurrency, with affordable plans and quick server setup after payment—all with no logs. It’s a practical choice when you have no time for DIY and need fast, managed VPN access.

You can later expand your setup with telemetry, nftables, real IPv6 prefixes, multi-server infrastructure, and profile load balancing. Most importantly, you now have a solid foundation and a clear action plan for any scenario.

⚠️ Note: Always use VPNs in compliance with your country’s laws and service provider rules. Act responsibly and legally.

Tip: Regularly check connection protocols on all devices and remove unused profiles. This reduces attack surface and simplifies management.