Best VPS for Running a VPN Server

OVHcloud bans VPN servers

OVHcloud's Service-Specific Terms (Section 3.B.4 for VPS, Section 4.B.2.e for Public Cloud) state:

"Anonymization services or public proxy (including VPN, Tor, P2P, IRC) and cardsharing (CCCam or equivalent) are not permitted on the Services."

The enforcement clause is worse:

"OVHcloud reserves the right to proceed with the immediate suspension without notice of any OVHcloud Service on which there is a public service Proxy, IRC, VPN or TOR."

Immediate suspension. Without notice.

Despite this, OVH and its budget brand Kimsufi appear in multiple "best VPS for VPN" comparison articles. Those articles either didn't read the terms or chose to ignore them. If you run a WireGuard or OpenVPN server on OVH and they detect it, your server can be suspended without warning and your data is at risk.

The language says "public proxy (including VPN)" — it does not carve out personal VPN use from commercial VPN services. Whether OVH would enforce against a single-user WireGuard tunnel is debatable, but the terms give them the right to, and building infrastructure on "they probably won't enforce" is a bad bet.

Source: OVHcloud Service-Specific Terms

KVM is required for WireGuard

WireGuard runs as a kernel module. It loads directly into the Linux kernel for maximum performance. This requires full kernel access — which KVM virtualization provides (you get your own kernel) and OpenVZ does not (you share the host's kernel and cannot load modules).

If you try to install WireGuard on an OpenVZ VPS, you'll see something like:

FATAL: Module wireguard not found in directory /lib/modules/...

A userspace alternative called wireguard-go exists and can technically run on OpenVZ, but it requires setting the environment variable WG_I_PREFER_BUGGY_USERSPACE_TO_POLISHED_KMOD to force it — the variable name tells you what the WireGuard developers think of this approach. Recent optimizations have made wireguard-go competitive in throughput on fast hardware, but on a budget VPS where you're choosing OpenVZ to save money, the CPU overhead of userspace processing defeats the purpose.

Every provider recommended in this guide uses KVM. If a provider doesn't state their virtualization type, ask before buying. If a VPS costs $1-3 per year, it's almost certainly OpenVZ or LXC, and WireGuard won't work natively.

The picks

Best budget: BuyVM

BuyVM at $2/month (512MB RAM, 1 vCPU, 10GB SSD) with unmetered bandwidth is the most recommended VPN VPS in self-hosting communities. WireGuard uses negligible resources — 512MB and 1 core is more than enough for a personal VPN tunnel. BuyVM's AUP explicitly allows Tor exit nodes, which is the most permissive policy stance possible; a personal VPN server is well within bounds.

BuyVM has three US locations (Las Vegas, New York, Miami) and one EU location (Luxembourg). Pick the one closest to where you'll be connecting from. The unmetered bandwidth means you don't need to worry about usage caps, which matters if you route all your traffic through the VPN.

Source: BuyVM Acceptable Use Policy

Best mainstream: Vultr

Vultr actively promotes VPN hosting with a dedicated solutions page and one-click deployments for WireGuard (via WarpSpeed) and Pritunl. Starting at $3.50/month for 512MB/1 vCPU/500GB bandwidth. The standout is location coverage: 33 data centers across North America, Europe, Asia, Australia, and South America. If you need a VPN exit point in Singapore, Tokyo, Seoul, or Sydney, Vultr is one of the few budget options with presence there.

Vultr's AUP bans "open proxies" and Tor exit nodes but says nothing against VPN servers. Their dedicated VPN solutions page is an explicit endorsement.

Source: Vultr Use Policy

Best EU bandwidth: Contabo

Contabo has a dedicated WireGuard landing page with a one-click setup script. Starting at $6.60/month for 4 vCPU/8GB RAM/200GB SSD with unlimited bandwidth (fair use). The specs are overkill for VPN — you don't need 8GB RAM for WireGuard — but Contabo's pricing includes enough resources to run other services alongside your VPN.

Contabo has data centers in Germany, UK, US, Japan, Singapore, and Australia. Their unlimited bandwidth policy means no metered transfer caps.

Best price/performance in EU: Hetzner

Hetzner Cloud VPS starting at €5.49/month (CX23: 2 vCPU, 4GB RAM, 40GB NVMe, 20TB traffic). Hetzner doesn't mention VPN servers in their AUP — they prohibit "fake source IPs" and "scanning foreign networks" but running a VPN for personal use is within policy.

The Hetzner gotcha: Hetzner enforces strict source IP validation on their network. If your VPN is misconfigured and sends packets with the tunnel's internal IP as the source address over the external interface (instead of properly NAT/masquerading), Hetzner's automated systems will deactivate your server. The fix is straightforward — ensure your iptables MASQUERADE rule is correct — but it's a trap if you're following a generic WireGuard tutorial that doesn't account for Hetzner's requirements.

Budget alternative: RackNerd

RackNerd publishes official WireGuard setup tutorials on their blog. Deal plans starting around $11/year (1 vCPU, 768MB RAM, 1TB bandwidth) are sufficient for a personal VPN. All RackNerd VPS plans use KVM. The bandwidth cap (1-3TB depending on plan) is the main constraint — if you route all traffic through the VPN, monitor your usage.

Full comparison

"Promoted" means the provider actively markets VPN hosting with dedicated pages and one-click tools. "Allowed" means the AUP doesn't prohibit it. "Silent" means no mention in either direction. "Banned" means explicit prohibition in the terms.

WireGuard vs OpenVPN: which to run

For most people setting up a personal VPN on a VPS, WireGuard is the better choice. It's simpler to configure (a single config file vs OpenVPN's certificate infrastructure), uses less CPU, and establishes connections faster. The entire WireGuard codebase is roughly 4,000 lines of code compared to OpenVPN's 100,000+, which means a smaller attack surface.

Choose OpenVPN instead if:

• You need TCP transport. WireGuard is UDP-only. Some corporate firewalls and hotel WiFi networks block all non-TCP traffic. OpenVPN can run over TCP port 443, making it indistinguishable from HTTPS traffic to a basic firewall.
• You're in a country that blocks VPN protocols. China, Iran, and Russia actively detect and block WireGuard's UDP traffic pattern. OpenVPN over TCP/443 with tls-crypt is harder to fingerprint. For heavy censorship environments, consider obfuscation tools like AmneziaVPN (obfuscated WireGuard fork).
• You need per-user authentication. OpenVPN has built-in certificate-based authentication with per-user revocation. WireGuard uses static key pairs — removing a user means regenerating keys on the server, not revoking a certificate.

For everything else — personal use, family tunnel, securing coffee-shop WiFi — WireGuard is faster, lighter, and easier to maintain.

Gotchas nobody warns about

UDP throttling

Some providers throttle UDP traffic while leaving TCP uncapped. Since WireGuard is UDP-only, this directly caps your VPN throughput. A documented case from May 2026: GreenCloudVPS was found throttling inbound UDP to approximately 360 Mbps while TCP remained at full port speed. The user confirmed WireGuard throughput was capped despite the VPS nominally having a 1 Gbps port. This is invisible until you benchmark — the provider won't advertise it. (Source: LowEndTalk, May 2026)

Hetzner source IP enforcement

Hetzner validates that all outbound packets from your server use the assigned IP as the source address. A VPN server with incorrect NAT configuration sends packets with the internal tunnel IP (e.g., 10.0.0.1) as the source, which Hetzner's systems flag as IP spoofing. The server gets deactivated automatically. Always verify your iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE rule is active and persistent across reboots.

NAT VPS won't work

Budget "NAT VPS" products ($1-3/year) share a single IPv4 address among multiple customers. You get a subset of port numbers, not a dedicated IP. WireGuard needs a specific UDP port (default 51820) that may not be in your allocated range. Even if it is, the shared IP introduces routing complications. A VPN server needs its own dedicated IPv4 — any standard VPS plan provides this.

WireGuard is detectable

WireGuard's UDP packet format has a recognizable pattern. ISPs and governments performing deep packet inspection can identify and block it. If you're using a VPN specifically for privacy in a restrictive network environment, WireGuard alone isn't sufficient. You'd need an obfuscation layer (AmneziaVPN, Shadowsocks tunnel) or fall back to OpenVPN over TCP/443.

The "personal vs commercial" line

Most providers that allow VPN servers draw a distinction between running a VPN for yourself (or your team) and operating a commercial VPN service for the public. Running a multi-user VPN service that's sold to strangers falls under "open proxy" prohibitions at most providers, even those that allow personal VPN use. If you're building a commercial VPN product, you need a provider that explicitly supports it, or a dedicated/colocation arrangement.

FAQ