A private VPN server is a rented server running WireGuard, OpenVPN or IPsec that only you, and the people you give keys to, connect through. It buys you a fixed exit address, keys and logs on a machine you control, and a way into your own networks. It does not buy anonymity, a list of countries or a way around streaming licences. Installation is covered in WireGuard on Ubuntu and turning a VPS into an OpenVPN gateway.
Own VPN server or subscription: which jobs fit
| Job | Own server? | Why |
|---|---|---|
| Fixed exit IP for allowlists | Good fit | One address that does not change |
| Reaching your servers or home lab | Good fit | Private services stay off the internet |
| Linking two sites | Good fit | WireGuard or IPsec between your networks |
| A team of a few people | Good fit | One key per person |
| Hotel or café Wi-Fi | Good fit | The local network sees encrypted traffic to one address |
| Anonymity | Bad fit | The address maps to your account |
| Streaming from another region | Bad fit | Not promised; some services refuse VPNs |
| Hopping between many countries | Bad fit | One location per server |
| Selling VPN access | Dedicated server | Unmetered ports, extra IPs or a /24 |
Good fits
A fixed exit IP for allowlists. The strongest reason. Lock SSH, an admin panel or a database to one address and the allowlist stays one line long. Keep a second allowed address or another way in, or one outage of the VPN server locks you out of everything.
Remote access to your servers and home lab. Dashboards, Git and staging machines answer only inside the tunnel. A home lab behind carrier-grade NAT cannot accept inbound connections, but it can dial out and hold the tunnel open; the wg(8) manual suggests a 25-second persistent keepalive for a peer behind NAT.
Site-to-site links. WireGuard routes whole subnets between peers, so an office, a home lab and your servers can share one private network. Use IPsec/IKEv2 when the other end is a router that speaks IPsec and not WireGuard.
A team of a few people. Each person gets a key pair and a [Peer] block; when someone leaves, you delete their block.
Hostile Wi-Fi. With a full tunnel up, the hotel network sees encrypted packets to one address. Past your server, traffic is as exposed as it would be from home, and much of it is HTTPS anyway: you have moved your trust from the café to your server's network.
Bad fits, said plainly
Anonymity. Your server's exit address is used by you alone. A whois lookup shows who holds the address block (registries such as the RIPE NCC publish that data), and the host knows which account rents it. That is what makes it good for allowlists and wrong for hiding; VPN or proxy server covers the difference between the tools.
Streaming from another region. We do not promise that any streaming service will play through your server. Netflix's help centre documents a "You seem to be using a VPN or proxy" error (code E106) and says VPNs are not supported for live events or on its ad-supported plans.
Many locations. NexonHost VPS plans run in Germany, the Netherlands and Romania, and every extra location is another server and another bill. A subscription app switches countries with a tap.
How much transfer a tunnel really uses
Two things inflate the count on a full-tunnel VPN.
Every byte crosses the server's port twice: a download enters from the internet and leaves towards your device. If a plan counts inbound and outbound together, a 4 TB quota carries 2 TB of your traffic. Ask how your plan counts; the sums below assume both directions count.
Encapsulation. Each WireGuard data packet adds a 16-byte header and a 16-byte authentication tag, then UDP (8 bytes) and IP (20 bytes for IPv4, 40 for IPv6). On Linux, wg-quick sets the tunnel MTU to the route's MTU minus 80, enough for the IPv6 case, so a 1,500-byte link gives a 1,420-byte tunnel, which is also the kernel module's default. Over IPv4 a full packet carries 1,420 bytes of yours in 1,480 on the wire: 1,480 ÷ 1,420 = 1.042, about 4% extra (more on small packets). Only the leg between server and device is wrapped, so each byte of yours costs 1 + 1.042 = 2.042 bytes of quota.
For a yardstick, Netflix says video uses up to 3 GB an hour per device in HD and up to 7 GB in 4K. On NEX1's 4 TB (4,000 GB):
- 4,000 ÷ 2.042 = about 1,959 GB of your data.
- 1,959 ÷ 3 = about 653 hours of HD a month, about 22 hours a day.
- 1,959 ÷ 7 = about 280 hours of 4K, about 9 hours a day.
Two TVs streaming 4K four hours a day is 2 × 4 × 7 GB × 30 days = 1,680 GB, counted as 1,680 × 2.042 ≈ 3,431 GB: about 86% of the quota before anyone opens a laptop.
On NEX plans the quota, not the port, is the limit: 4 TB at 10 Gbps takes 4 × 10¹² × 8 ÷ 10¹⁰ = 3,200 seconds, under an hour. On UNEX1 it is the port: 1 Gbps × 2,592,000 seconds in a 30-day month ÷ 8 = 324 TB a month at line rate. An HD stream at 3 GB an hour averages 24,000 megabits ÷ 3,600 seconds ≈ 6.7 Mbps, so the port carries about 1,000 ÷ (6.7 × 1.042) ≈ 140 wrapped streams. Whether one vCPU can encrypt that much we have not benchmarked; test with your own traffic.
NEX1, NEX2 or UNEX1
| Plan | CPU / RAM | Transfer | Price a month |
|---|---|---|---|
| NEX1 | 1 vCPU / 2 GB | 4 TB, 10 Gbps port | €9 (€8.10 annual) |
| NEX1 + 2 TB pack | 1 vCPU / 2 GB | 6 TB | €14 |
| NEX2 | 2 vCPU / 4 GB | 8 TB, 10 Gbps port | €18 (€16.20 annual) |
| UNEX1 | 1 vCPU / 2 GB | Unmetered, 1 Gbps port | €18 (€16.20 annual) |
For one to three people browsing, working and watching some video, NEX1 at €9 a month fits by the arithmetic above; a 2 TB pack makes it €14. Past 6 TB, a 10 TB pack makes €9 + €15 = €24, more than UNEX1 at €18, which takes the question off the table. NEX2 costs the same €18 if you want a second vCPU and 8 TB on a 10 Gbps port.
Site-to-site links that carry backups belong on unmetered. A relay counts traffic twice too: a nightly 50 GB backup is 50 × 30 × 2 = 3,000 GB a month before overhead, three-quarters of NEX1's quota.
Ports, protocols and the firewall
| Protocol | Default port | Open on the firewall |
|---|---|---|
| WireGuard | None; random if unset, 51820 in examples | The UDP port you set |
| OpenVPN | 1194, UDP by default | UDP 1194, or the port you choose |
| IPsec IKEv2 | UDP 500, and 4500 for NAT traversal | UDP 500 and 4500; ESP (IP protocol 50) without NAT |
WireGuard's ListenPort is optional and random if unset, so set one. OpenVPN's 1194 is its IANA assignment, and it can also run over TCP where UDP is blocked. IKEv2's ports come from RFC 7296; without NAT in the path, traffic normally travels as ESP (RFC 4303).
Every NexonHost VPS comes with full root access, so you install WireGuard, OpenVPN or strongSwan from the distribution's own packages. Open only the VPN port and SSH; the new server security checklist covers the rest of the first hour.
DDoS protection on the VPN endpoint
A VPN endpoint is a public UDP port and can be flooded like any other address. Every NexonHost VPS includes 20 Gbps / 1 Mpps of Layer 3/4 network mitigation, which covers that UDP traffic, upgradable to 100 Gbps / 10 Mpps for €150 a month. Ask any provider, us included, what happens when an attack exceeds the tier you pay for.
The website DDoS protection proxy cannot help here: it is an HTTP(S) proxy for websites and does not carry WireGuard, OpenVPN or IPsec.
Keep the fixed IP clean
A fixed address is useful only while other services trust it. If a peer's key leaks, or the server is compromised and used for brute-force logins, the address can land on blocklists: Spamhaus's Exploits Blocklist lists addresses showing signs of compromise, including brute-force attacks, and its listings expire only some time after the behaviour stops. Services that consult such lists may then refuse the address your allowlists depend on.
So: one key per device, delete a lost phone's [Peer] block the same day, SSH with keys only, and patch. Look the address up on public blocklists before you build anything around it.
A private VPN server from NexonHost
The VPN hosting page sets out the plans, the protocols and a working WireGuard config. A private VPN server on NEX1 is €9 a month (€8.10 a month on annual billing) with 4 TB of transfer, one IPv4 address included and 20 Gbps / 1 Mpps of DDoS protection; UNEX1 is €18 a month with an unmetered 1 Gbps port. Both have SSD storage and are provisioned automatically in Germany, the Netherlands or Romania. Start on a one-month term and measure your own traffic before committing to a year.
A commercial VPN service belongs on dedicated servers: from €129 a month with a 1 Gbps unmetered port, 40 Gbps / 4 Mpps of Layer 4 mitigation, and extra IPs or a /24, in 12 cities. Your users' traffic leaves from your addresses, and the Terms of Services make you responsible for all activity through your account (section 9.1); agree capacity, IP space and abuse handling with sales before launch.
Prices as of 19 October 2026, in EUR excluding VAT; check the product page.
Sources
- How to control how much data Netflix uses — Netflix Help Center, retrieved 19 October 2026: data used per hour, per device: HD up to 3 GB, 4K up to 7 GB.
- Netflix says, 'You seem to be using a VPN or proxy' — Netflix Help Center, retrieved 19 October 2026: error code E106; VPNs not supported for live events or on ad-supported plans.
- wg(8) — WireGuard tools manual page, retrieved 19 October 2026: ListenPort optional and chosen randomly if not specified; PersistentKeepalive, with 25 seconds suggested for a peer behind NAT; example config with ListenPort 51820.
- wg-quick(8) — WireGuard tools manual page, retrieved 19 October 2026: MTU determined automatically from the endpoint addresses or default route when not set.
- wg-quick linux.bash — WireGuard tools source, retrieved 19 October 2026: tunnel MTU set to the route MTU minus 80, with 1,500 as the fallback.
- device.c — WireGuard Linux kernel module source, retrieved 19 October 2026: default interface MTU = 1,500 minus (minimum message length + UDP header + the larger of the IPv6 and IPv4 headers).
- send.c — WireGuard Linux kernel module source, retrieved 19 October 2026: padding to a multiple of 16 is capped at the MTU, so a full-size packet is not padded further.
- Protocol & Cryptography — WireGuard, retrieved 19 October 2026: data message header of message type, three reserved bytes, a 4-byte receiver index and an 8-byte counter (16 bytes); AEAD_LEN adds 16 bytes.
- Quick Start — WireGuard, retrieved 19 October 2026:
listen-port 51820in the example. - Reference manual for OpenVPN 2.6 — OpenVPN, retrieved 19 October 2026:
--portdefault 1194, the IANA assignment;--protodefault udp, with tcp-client and tcp-server modes. - Service Name and Transport Protocol Port Number Registry — IANA, retrieved 19 October 2026: openvpn 1194, isakmp 500, ipsec-nat-t 4500.
- RFC 7296 — Internet Key Exchange Protocol Version 2 (IKEv2), IETF, retrieved 19 October 2026: IKE runs over UDP ports 500 and 4500; section 2.23, NAT traversal on port 4500.
- RFC 4303 — IP Encapsulating Security Payload (ESP), IETF, retrieved 19 October 2026: ESP is protocol value 50.
- RFC 768 — User Datagram Protocol, IETF, retrieved 19 October 2026: minimum UDP length eight bytes (the header).
- RFC 8200 — Internet Protocol, Version 6 (IPv6), IETF, retrieved 19 October 2026: section 8.3, minimum IPv4 header 20 octets, IPv6 header 20 octets longer (40).
- RIPE Database — RIPE NCC, retrieved 19 October 2026: registration information for networks in the RIPE NCC service region.
- Exploits Blocklist (XBL) — Spamhaus, retrieved 19 October 2026: lists IPs exhibiting signs of compromise, including participation in brute-force attacks; listings expire once the behaviour is no longer detected.
- NexonHost store, retrieved 19 October 2026: NEX1, NEX2 and UNEX1 specifications and prices, one IP included ("1 IP is default"), traffic packs, VPS DDoS tier and upgrade, VPS regions, dedicated entry build, port and DDoS tier. NexonHost Terms of Services, section 9.1: the user is responsible for all activity carried out through their account.
- Computed: 1 + 1.042 = 2.042; 4,000 ÷ 2.042 ≈ 1,959 GB; 1,959 ÷ 3 ≈ 653 h and ÷ 7 ≈ 280 h; 2 × 4 × 7 × 30 = 1,680 GB, × 2.042 ≈ 3,431 GB (86% of 4,000); 4 × 10¹² × 8 ÷ 10¹⁰ = 3,200 s; 1 Gbps × 2,592,000 s ÷ 8 = 324 TB; 24,000 Mb ÷ 3,600 s ≈ 6.7 Mbps, 1,000 ÷ (6.7 × 1.042) ≈ 140; €9 + €5 = €14; €9 + €15 = €24; 50 × 30 × 2 = 3,000 GB.
