VPN and Networking on a VPS: WireGuard, Proxies, DNS and SSH

Running your own VPN or network service means you own the box your traffic passes through. You pick the software, hold the keys and decide what gets logged. This section covers the network side of a VPS: tunnels, proxies, name servers and the SSH access that ties them together.

What will you find in this section?

This section collects practical, command-level guides, added over time, for the services people most often put on a public server. Topics include:

  • WireGuard and OpenVPN servers for one person or a whole team.
  • Tailscale exit nodes and self-hosted Headscale control servers.
  • Reverse proxies with Caddy, nginx and Traefik, plus frp and self-hosted alternatives to ngrok and Cloudflare Tunnel.
  • Authoritative DNS, and remote Pi-hole or AdGuard Home.
  • SSH hardening, jump hosts and bastion servers.

Each guide answers one question and covers setup on Debian or Ubuntu, sizing the server, which ports to open and what to check when something doesn’t connect.

Why run network services on a Boise VPS?

Most of these workloads need little CPU or RAM. What matters is the network path and how transfer is billed.

Our network uses Lumen (AS3356) and Cogent (AS174) as upstreams, with Cisco routers, an Arista switch fabric and every hypervisor bonded across two switches. Latency from Boise is 14 ms to Salt Lake City, 22 ms to Portland and 23 ms to Seattle. Treasure Valley businesses see under 5 ms.

Transfer is an allowance. If you go over it, the port is throttled, never billed, and extra transfer is $1.50/TB. 1 Gig is standard; 10 Gig is a $15/mo add-on. An extra IPv4 is $5/mo if a service needs its own address. The NVMe VPS is $5/GB RAM, from $10/mo, so a small tunnel or proxy box costs little, and you can dial it in as your setup grows.

Part of the ADTAQ blog.

Topics in VPN and Networking

  • WireGuard

    Setting up a personal or team WireGuard VPN server on a VPS.

    No guides yet

  • OpenVPN

    Running an OpenVPN server on a VPS and connecting clients to it.

    No guides yet

  • Tailscale

    Tailscale exit nodes and self-hosted Headscale control servers on a VPS.

    No guides yet

  • Reverse Proxy

    Caddy, nginx and Traefik reverse proxies, frp, and self-hosted alternatives to ngrok and Cloudflare Tunnel.

    No guides yet

  • DNS

    Authoritative DNS servers and remote Pi-hole or AdGuard Home on a VPS.

    1 guide

  • SSH

    SSH hardening, jump hosts and bastion servers for reaching your machines securely.

    No guides yet

Latest in VPN and Networking

Frequently asked questions.

A VPS is a common place to run a personal or team VPN because it has a public IP address and stays online when your laptop doesn't. WireGuard and OpenVPN both run on small Linux servers, and you hold the keys and decide what gets logged. A VPN on a VPS gives your traffic the server's IP address. It doesn't make you anonymous.

Yes, VPN traffic counts toward your transfer allowance like any other traffic on the server. On ADTAQ, going over the allowance means the port is throttled, never billed, and extra transfer is $1.50/TB if you want more. A full-tunnel VPN sends all of a client's traffic through the server, so it uses more transfer than a split tunnel that only routes private subnets.

WireGuard is a lean VPN protocol built into the Linux kernel that runs over UDP and gives each peer a public-key pair. OpenVPN is older, runs over UDP or TCP and uses TLS with certificates. Tailscale builds a mesh network on top of WireGuard with a coordination server. Headscale is a self-hosted open-source version of that server, and a VPS can serve as a Tailscale exit node.