wireguard vps
Private VPN and proxy endpoints
Your own exit, in a jurisdiction you picked on purpose.
What we would deploy
€9.73/mo
€13.90−30% annual
A commercial VPN is somebody else's server with somebody else's logging policy. Running your own gives you an endpoint nobody shares, an address nobody has burned, and a jurisdiction you chose deliberately rather than inherited from a marketing page. WireGuard on a two-core machine will saturate a gigabit link without breaking a sweat.
Why this configuration
PULSE is more than enough: WireGuard is cheap in CPU terms and the bottleneck is the uplink, not the silicon. Pick Zurich, Reykjavik or Chisinau if jurisdiction is the point; pick whatever is nearest if latency is.
What we would deploy
Sizing
WireGuard is kernel-side and cheap. One PULSE core moves roughly 1-2 Gbit/s of ChaCha20-Poly1305, and a 50-user team VPN rarely peaks above 300 Mbit/s. Two cores and 2 GB is the honest starting point. Go to four cores only when you are saturating a gigabit or terminating hundreds of tunnels. RAM barely matters — a peer costs kilobytes. Size instead on peak concurrent throughput and on how many exit jurisdictions you need, since each is a separate box.
Owning the exit
A commercial VPN gives you an exit shared with thousands of strangers, and their behaviour becomes your reputation. Your own server gives you one address that only your traffic leaves from. That is better for access and worse for anonymity in a crowd, which is the trade to make consciously. Practical consequences: you control the PTR, you can hold a static address across rebuilds, and you can run split routing so only the subnets you name traverse the tunnel. You also own the logging decision. Set journald and the firewall to record nothing you would not want to hand over.
Choosing the jurisdiction
The exit country decides which law applies to the traffic and which content you can reach. Pick it deliberately. CrestVPS runs 36 cities in 33 countries, so an exit can sit in Zurich, Stockholm or Singapore as easily as Frankfurt, and the price is the same shape everywhere. No KYC means signup is an email address and no identity document is ever requested. It does not mean the server floats free of law. Each machine sits in a named country, valid legal process from that jurisdiction is answered, and the volumes are published in a transparency report twice a year.
What goes wrong
- Leaving MTU at 1500. WireGuard adds 60 bytes of overhead over IPv4 and 80 over IPv6. Set the interface to 1420 or lower, or large TLS flows blackhole while pings succeed.
- Forgetting IPv6. The host has a v6 address, the tunnel carries only v4, and the client quietly prefers v6 outside the tunnel. Route both families or disable v6 on the client.
- Terminating every user on one exit IP. Shared exits attract CAPTCHAs and blocks from the sites your team uses daily. Split heavy automation onto its own address and keep the human traffic clean.
Tune the machine
- Addressing and transit — IPv6 /48 delegation · €3
- Everything else — No-log recursive resolver + DoH · Included
- Storage and encryption — LUKS2 full-disk encryption · €5
More
Built for specific jobs
Game server hosting
Tick rate is a single-thread problem. Everything else is noise.
Trading and low-latency VPS
Distance to the matching engine, and nothing between you and the wire.
Seedboxes and bulk storage
Terabytes that stay cheap and a port that stays open.
Kubernetes worker nodes
Cheap per core, dense, and identical every time.
AI inference and fine-tuning
A whole GPU, passed through, on a commitment that makes the maths work.
Hosting resellers
Your brand on the panel, our hardware underneath.