Your own VPN server instead of a VPN service: when it pays off

Anyone shopping for a VPN runs into subscription services with big promises within seconds. In reality there are three routes to an encrypted connection: a commercial VPN service, a WireGuard server you set up yourself on a VPS or a ready-configured Dedicated Private VPN Server. This article explains what a VPN does and what it does not do, and which route fits which situation.

What a VPN really does, and what it does not

A VPN builds an encrypted tunnel between your device and the VPN server. Everything your device sends is unwrapped again only on that server, and from there it travels out to the internet like any other traffic. Three things follow from that:

• Encryption as far as the server. On hotel Wi-Fi, in a café or on a mobile network, nobody between you and the server can see which destinations you are calling up. Beyond the server, your traffic is exactly as protected as it would be without a VPN: encrypted with HTTPS, not encrypted with plaintext protocols.
• A different visible IP address. Websites and services see the address of the VPN server, not the one your own line uses. That helps with access lists built on fixed addresses (allowlisting) and in networks that block certain destinations.
• No promise of anonymity. Whoever runs the VPN server sees all of your traffic at the point where it leaves the tunnel. The moment you log in somewhere, it is clear who you are anyway, and browsers can be recognized again without an IP address. A VPN moves trust elsewhere, it does not remove the need for it.

So the decisive question is not "VPN yes or no", but rather: who do you trust with the endpoint, and what may that trust cost?

Three routes to a VPN

1. A commercial VPN service

You buy a subscription, install the app and pick a country. Server and IP address are shared with many other customers. The address is therefore often known as a VPN address and gets blocked by some services, while bandwidth and latency move with the current load. What the provider logs is nothing you can check yourself, so you depend on its assurances and usually on external audits. The upside is convenience: many countries, no maintenance, set up in minutes.

2. Your own WireGuard server on a VPS

You rent a KVM root server, install WireGuard, generate key pairs and hand out the profiles to your devices. The guide Set up a WireGuard VPN on your own server shows how that works on Debian and Ubuntu. You get a dedicated IPv4 address, full control over configuration and logs, and you pay from €9.99 per month. In exchange, updates, firewall and hardening are your job: securing SSH with keys, automatic security updates and a cleanly configured firewall are part of the deal. If you enjoy doing that yourself, or the server is needed for other services anyway, this route works out well.

3. A ready-made Dedicated Private VPN Server

The Dedicated Private VPN Server from KernelHost is the middle route: a server of your own on which WireGuard already runs preconfigured and hardened. You scan a QR code or import the profile file, and the device is connected, on iOS, Android, Windows, macOS and Linux. Included are a dedicated IPv4 address plus a /64 IPv6 subnet that nobody shares with you, root access, port forwarding and your own firewall rules, as well as a configurable DNS filter that blocks ads, trackers and known malicious sites at name resolution. DDoS protection with real-time filtering is included in every plan.

The comparison at a glance

The VPN plans from KernelHost

All prices are per month including VAT, PrePaid with no minimum term and no automatic renewal. The number of devices can be extended in every plan, and all connections are symmetric. A full overview of the sites: Server locations.

Typical use cases

• Home office and remote access. You reach a NAS, a home server or a company system without opening their ports to the internet. The fixed IP of the VPN server goes into the access list, and the devices connect through the tunnel from anywhere. For one person Basic is enough, for a small team Gaming or Unlimited.
• Travel and public Wi-Fi. In a hotel, at the airport or abroad, all your traffic runs encrypted as far as the server in Europe, with your own IP address and with no strangers sharing it.
• Gaming with a stable IP. A dedicated address does not change and can be entered on your own game servers and in admin panels. Attackers see the protected server IP instead of your home line. The Gaming plan delivers up to 1 Gbps and is built for low latency in Europe (depending on your network).
• Streaming and large downloads. If you move large volumes of data all the time, take a plan with unlimited traffic. Keep in mind that a VPN server carries every byte twice, once in and once out: 500 GB of downloads add up to roughly 1 TB of traffic on the server.
• Teams with several devices. Families, small companies and clubs attach 10, 20 or more devices to one server, each with its own profile that can be removed individually.

Limits and honest caveats

• Geoblocking. Whether a streaming service releases content over a particular address is the service's decision. We promise nothing here, not least because some platforms recognize datacenter addresses for what they are.
• A dedicated IP is identifiable. You are the only one using that address. For allowlisting that is exactly the advantage, for anonymity it is the opposite: everything that runs over the address can be traced back to the server and therefore to the contract holder.
• Legal responsibility. You are accountable for what passes through your tunnel. A server of your own is not a free pass, and legitimate requests from the authorities are answered in line with applicable law.
• Speed. The bandwidth of the plan is the ceiling at the server. What actually arrives at your end is limited by your own line, by the path to the datacenter and by how much processing power your device has for the encryption. A 1 Gbps tunnel only helps you with a line to match.

A worked example: three user profiles

One person, three devices (laptop, phone, tablet). On a monthly subscription a VPN service usually costs around €10, and clearly less only if you pay years in advance. The Basic plan costs €4.99 with monthly payment, including your own IP and 250 Mbps. The self-managed VPS sits at €9.99 plus the time for setup and upkeep, and it only pays off if you need the server anyway.

A family or small team, ten devices. With many VPN services the device count usually stops at 5 to 10, and after that you need a second subscription. The Gaming plan covers 10 devices at up to 1 Gbps, the Unlimited plan covers 20 devices at 500 Mbps with unlimited traffic, and both cost €14.99. That works out at €1.50 and 75 cents per device and month respectively.

A heavy user with 500 GB a month. On the server that comes to roughly 1 TB of traffic, so it is a case for unlimited traffic rather than fair use: the Unlimited plan delivers 500 Mbps with no volume cap for €14.99. If you want the same throughput on a server of your own, take an Unlimited Traffic VPS from €14.99 and set up WireGuard yourself, at the same price but with your own work on top.

Conclusion: which route suits whom

• VPN service: if you want to hop between many countries all the time, do not need a fixed IP and can live with a shared address.
• Your own VPS with WireGuard: if you run a server anyway, are comfortable with Linux administration and want control down to the last line of configuration.
• Dedicated Private VPN Server: if you want your own fixed IP address with nobody else on it, need to connect several devices or a whole team and want the setup finished in minutes. From €4.99 per month, PrePaid, with no minimum term.

KernelHost GmbH is based in Vienna, Austria, and the datacenter is maincubes in Frankfurt am Main, Germany. What is left to say: a VPN does not make you invisible. It only decides who you entrust your traffic to. With a server of your own, the answer is: yourself.