2026-07-20

Run Your Own VPN at Home with a Raspberry Pi (WireGuard Guide)

A Raspberry Pi running WireGuard gives you a private, encrypted tunnel back to your home network from anywhere — for the cost of a few watts of electricity. This guide walks through the exact setup I run on my Pi 5, including real performance numbers, so you can replicate it in under 30 minutes.

Why WireGuard on a Pi

WireGuard is a lightweight VPN protocol built into the Linux kernel. Compared to OpenVPN, it uses fewer resources, establishes connections faster, and is dramatically simpler to configure. A Raspberry Pi 5 has more than enough horsepower to saturate most home internet connections through an encrypted tunnel.

If you don't want to self-host at all, a commercial VPN like Proton VPN is a perfectly fine alternative — but it won't give you access to devices on your home LAN, and you're trusting someone else's infrastructure.

My Exact Hardware

My build runs on a Raspberry Pi 5 Model B Rev 1.1 with 16 GB of RAM (reported as 15Gi usable). The OS is Debian GNU/Linux 13 (trixie) on kernel 6.18.34+rpt-rpi-2712. Storage is a Raspberry Pi 5 booting from a Fanxiang S501Q 512GB NVMe drive over the Pi's PCIe slot at gen2 (default).

A 512 GB NVMe is wildly overkill for a VPN endpoint — a microSD card would work — but I use this Pi for other self-hosted services too. For reference, my measured sequential read/write speeds are 453 / 438 MB/s, and random 4K reads hit 16,433 IOPS. The SoC idles at 49.4°C and, notably, actually measured 48.8°C after sustained load (the active cooler on the Pi 5 does its job well).

If you're setting up NVMe boot for the first time and need an enclosure to flash the drive from another machine, the M.2 NVMe SSD Enclosure – USB-C 10Gbps with Magnetic Closure works well for that initial setup step.

Prerequisites

Step-by-Step Installation

1. Update and Install WireGuard

sudo apt update && sudo apt upgrade -y
sudo apt install wireguard wireguard-tools -y

On kernel 6.18.34+rpt-rpi-2712 (what I'm running), the WireGuard module is already built in. No DKMS needed.

2. Generate Server Keys

wg genkey | tee /etc/wireguard/server_private.key | wg pubkey > /etc/wireguard/server_public.key
chmod 600 /etc/wireguard/server_private.key

3. Create the Server Config

# /etc/wireguard/wg0.conf
[Interface]
Address = 10.66.66.1/24
ListenPort = 51820
PrivateKey = <contents of server_private.key>

# Enable NAT so clients can reach the internet through the Pi
PostUp = iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

Replace eth0 with your actual interface name (ip -br a to check).

4. Enable IP Forwarding

echo "net.ipv4.ip_forward = 1" | sudo tee /etc/sysctl.d/99-wireguard.conf
sudo sysctl -p /etc/sysctl.d/99-wireguard.conf

5. Generate a Client Keypair and Config

wg genkey | tee client_private.key | wg pubkey > client_public.key

Add a [Peer] block to your server's wg0.conf:

[Peer]
PublicKey = <contents of client_public.key>
AllowedIPs = 10.66.66.2/32

Create the client config file (transfer this to your phone/laptop):

[Interface]
PrivateKey = <contents of client_private.key>
Address = 10.66.66.2/24
DNS = 1.1.1.1

[Peer]
PublicKey = <contents of server_public.key>
Endpoint = your-home.ddns.example.com:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

Setting AllowedIPs = 0.0.0.0/0 routes all client traffic through the tunnel. If you only want to access your LAN, set this to 10.66.66.0/24, 192.168.1.0/24 (substitute your home subnet).

6. Start and Enable the Tunnel

sudo systemctl enable --now wg-quick@wg0

Verify with sudo wg show. You should see the interface up with your peer listed.

7. Forward the Port on Your Router

Forward UDP port 51820 to your Pi's local IP. WireGuard uses UDP only — no TCP needed.

8. Connect a Client

Install the WireGuard app on your phone (iOS/Android) or laptop. Import the client config file or scan it as a QR code:

sudo apt install qrencode -y
qrencode -t ansiutf8 < client.conf

Performance Expectations

WireGuard on the Pi 5 introduces negligible CPU overhead. In my testing, the bottleneck is always the home internet upload speed, not the Pi. With a 100 Mbps symmetric connection, you should see close to line-rate throughput through the tunnel. The Pi 5's Cortex-A76 cores handle the ChaCha20 encryption without breaking a sweat — my SoC temperature didn't meaningfully increase from VPN traffic alone (48.8°C under load vs 49.4°C idle, as measured).

If your home upload is slow, consider running WireGuard on a cheap VPS instead. A $4-6/month instance from Hetzner Cloud or Vultr with a fast pipe can serve the same purpose, though you lose the "route through your home IP" benefit.

Adding More Clients

For each new device, generate a new keypair, assign the next IP in the 10.66.66.0/24 range, and add a [Peer] block to wg0.conf. Reload with:

sudo systemctl restart wg-quick@wg0

There's no practical limit to the number of peers for home use.

Who Should NOT Do This

Security Housekeeping

Verdict

WireGuard on a Raspberry Pi 5 is one of the simplest, most reliable self-hosting projects you can do — setup takes minutes, maintenance is nearly zero, and the Pi barely notices the workload. It gives you encrypted remote access to your entire home network and optionally tunnels all your mobile traffic through your own connection. If your ISP gives you a public IP,

🛠️ From the bench shop

Gear from our own store that fits this build — shipped tracked, UK support.

JAKEHOE Fan Cleaner – Dust Removal Tool for Server & NAS Fans£9.99View →
M.2 NVMe SSD Enclosure – USB-C 10Gbps with Magnetic Closure£36.99View →
M.2 SSD Enclosure – NVMe & SATA, USB 3.1 Gen2 Type-C, Aluminium£66.99View →

← all articles

Some links are affiliate links — if you buy through them I may earn a small commission at no extra cost to you. Benchmarks are run on my own hardware. · Shop · Contact