Set Up Your Own VPN Server on a Raspberry Pi 3B (with WireGuard)

A Raspberry Pi makes a great little home VPN server. Once it's set up, your phone or laptop can connect back home from anywhere, whether you're on dodgy café Wi-Fi or you just want to reach something on your home network while you're out.

I've rewritten this guide to use WireGuard. The first version used OpenVPN with the old Easy-RSA 2 commands, which no longer work on current systems. WireGuard is quicker to set up, has far fewer settings to get wrong, and is fast even on a Pi 3B.

Why use a Raspberry Pi for a VPN?

• Cheap: a Pi costs far less than proper server hardware, and you may have one in a drawer already
• Low power: it sips electricity, so it's fine to leave running 24/7
• Yours: you control the whole setup, and there's no monthly subscription
• A great way to learn: you'll pick up real networking skills along the way

One thing to know up front: a home VPN server makes you appear to be at home. That's perfect for safe browsing on public Wi-Fi and for reaching your own devices. It won't let you appear to be in another country. That's what commercial VPNs are for, and I explain the difference in What is a VPN?.

What you'll need

• A Raspberry Pi 3B with a decent power supply
• A microSD card (8 GB or more) with Raspberry Pi OS Lite
• An Ethernet connection to your router (more reliable than Wi-Fi for a server)
• Access to your router's settings for port forwarding
• A phone or laptop to connect from, with the free WireGuard app

STEP 1Set up Raspberry Pi OS

1. Download Raspberry Pi Imager from the Raspberry Pi website.
2. Choose Raspberry Pi OS Lite.
3. In the customisation options, set your own username and password and turn on SSH. The old default pi / raspberry login was removed in 2022, so you must set one here.
4. Write the card, put it in the Pi, connect Ethernet and power it on.
5. Find the Pi's IP address in your router's device list and give it a DHCP reservation so it never changes.

Then SSH in and update everything:

sudo apt update && sudo apt full-upgrade -y

STEP 2Install WireGuard

sudo apt install wireguard qrencode iptables -y

qrencode lets us show the phone's settings as a QR code later, and iptables handles the routing rule.

STEP 3Turn on IP forwarding

This lets the Pi pass traffic from your VPN devices out to the internet:

echo 'net.ipv4.ip_forward=1' | sudo tee /etc/sysctl.d/99-wireguard.conf
sudo sysctl --system

STEP 4Create the keys

WireGuard uses a pair of keys for each device. Run these as root inside the WireGuard folder:

sudo -i
cd /etc/wireguard
umask 077
wg genkey | tee server.key | wg pubkey > server.pub
wg genkey | tee phone.key | wg pubkey > phone.pub

You can look at any key with cat, for example cat server.key. Keep the .key files private. Only the .pub files are safe to share.

STEP 5Create the server config

nano /etc/wireguard/wg0.conf

Paste this in, swapping in your own keys:

[Interface]
Address = 10.6.0.1/24
ListenPort = 51820
PrivateKey = PASTE_CONTENTS_OF_server.key
PostUp = iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
# My phone
PublicKey = PASTE_CONTENTS_OF_phone.pub
AllowedIPs = 10.6.0.2/32

10.6.0.x is a private range just for VPN devices. If your Pi uses Wi-Fi instead of Ethernet, change eth0 to wlan0.

STEP 6Start the server

systemctl enable --now wg-quick@wg0
wg show

wg show should list the wg0 interface and your phone as a peer. enable means it starts again automatically after a reboot.

STEP 7Open a port on your router

Your router needs to send VPN traffic to the Pi. In its settings, look for Port forwarding (sometimes under "Firewall" or "Advanced") and forward:

• Protocol: UDP
• External port: 51820
• Internal IP: your Pi's IP address
• Internal port: 51820

Most home broadband IP addresses change now and then, so set up dynamic DNS to get a name that always points at your home. Many routers have this built in, or you can use a free service like DuckDNS.

STEP 8Set up your phone

Create the phone's config file:

nano /etc/wireguard/phone.conf

[Interface]
PrivateKey = PASTE_CONTENTS_OF_phone.key
Address = 10.6.0.2/32
DNS = 1.1.1.1

[Peer]
PublicKey = PASTE_CONTENTS_OF_server.pub
Endpoint = your-name.duckdns.org:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

AllowedIPs = 0.0.0.0/0 sends all of the phone's internet traffic through home. If you also run Pi-hole on your network, put your Pi-hole's IP address in the DNS line instead and you get ad blocking on the go as well.

Now show it as a QR code:

qrencode -t ansiutf8 < /etc/wireguard/phone.conf

Open the WireGuard app on your phone, tap +, choose Scan from QR code, and point the camera at the terminal. When you're done, type exit to leave the root shell.

STEP 9Test it

1. Turn off Wi-Fi on your phone so it's on mobile data.
2. Switch the tunnel on in the WireGuard app.
3. Visit a site like whatismyip.com. It should show your home IP address.
4. On the Pi, sudo wg show should show a recent "handshake" with your phone.

If it doesn't connect, double-check the port forward, the keys (it's very easy to paste the wrong one) and the Endpoint address.

To add another device, create a new key pair, add another [Peer] section with the next address (10.6.0.3/32), give that device its own config, and restart with systemctl restart wg-quick@wg0.

Keeping it secure

• Update the Pi regularly: sudo apt update && sudo apt full-upgrade -y
• Only forward the one UDP port WireGuard needs
• If a phone is lost, delete its [Peer] section and restart WireGuard
• Never share your private keys or the device config files

Final thoughts

Turning a Raspberry Pi 3B into a VPN server is a fun project and a genuinely useful one. You get safer browsing on public Wi-Fi and access to your home network from anywhere, without paying a monthly fee for the privilege.

Happy VPN-ing!