Your own WireGuard or Tailscale server, with unlimited traffic.

Step 1: order, pick Ubuntu 24.04, log in

Order an S-2 and choose Ubuntu 24.04 (or Debian 13; the packages are the same). The server is up 30 to 60 seconds after payment. Log in over SSH and update first.

ssh root@YOUR_VPS_IP
apt update && apt upgrade -y

Step 2: install WireGuard and generate keys

WireGuard lives in the kernel. The package brings the tools. Generate a keypair for the server and one for each client; keep private keys readable by root only.

apt install -y wireguard
umask 077
wg genkey | tee /etc/wireguard/server.key | wg pubkey > /etc/wireguard/server.pub
wg genkey | tee client1.key | wg pubkey > client1.pub

Step 3: write wg0.conf and enable forwarding

The server config below hands out 10.8.0.0/24 and masquerades traffic out of the public interface. Check the interface name with ip route first; on our Ubuntu images it is not always eth0.

# /etc/wireguard/wg0.conf
[Interface]
Address = 10.8.0.1/24
ListenPort = 51820
PrivateKey = <contents of server.key>
PostUp = iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
# client1
PublicKey = <contents of client1.pub>
AllowedIPs = 10.8.0.2/32

echo 'net.ipv4.ip_forward=1' > /etc/sysctl.d/99-wireguard.conf
sysctl --system
systemctl enable --now wg-quick@wg0
wg show

Step 4: open the firewall

ufw blocks inbound by default once enabled. Allow SSH first, then UDP 51820. For a VPN that forwards traffic, also set DEFAULT_FORWARD_POLICY="ACCEPT" in /etc/default/ufw.

ufw allow OpenSSH
ufw allow 51820/udp
ufw enable

On the client, use the server's public key, endpoint YOUR_VPS_IP:51820, AllowedIPs = 0.0.0.0/0, ::/0 for a full tunnel, and a DNS = line so name lookups also go through the tunnel.

Step 5: or install Tailscale instead

Tailscale wraps WireGuard with key exchange and NAT traversal. The installer script comes from the project itself. Enable forwarding before advertising an exit node, then approve the node in the admin console.

curl -fsSL https://tailscale.com/install.sh | sh
echo 'net.ipv4.ip_forward = 1' > /etc/sysctl.d/99-tailscale.conf
echo 'net.ipv6.conf.all.forwarding = 1' >> /etc/sysctl.d/99-tailscale.conf
sysctl -p /etc/sysctl.d/99-tailscale.conf
tailscale up --advertise-exit-node

If you would rather not depend on the hosted control plane, Headscale is an open source implementation of it. It runs on the same S-2 next to tailscaled and clients point at it with tailscale up --login-server.

Step 6: publish Home Assistant through the VPS

On the home box, run a WireGuard client with PersistentKeepalive = 25 so the tunnel survives CGNAT, or run Tailscale with --advertise-routes=192.168.1.0/24 as a subnet router. On the VPS, install Caddy from the repository the project documents and put it in front. It fetches the certificate for you. Point an A record at the VPS first.

# /etc/caddy/Caddyfile
ha.example.com {
    reverse_proxy 10.8.0.2:8123
}

Home Assistant needs trusted_proxies set to the VPS tunnel address in its configuration, otherwise it rejects the proxied requests.