Run your own VPN with WireGuard

A VPN (virtual private network) does something small and specific, and the adverts dress it up as something it is not. Here is the whole truth in one picture. Normally your laptop talks to a website directly, and whoever runs the network you are on (the coffee shop Wi-Fi, your mobile carrier, your internet provider) can see which servers you connect to. A VPN puts an encrypted tunnel between your device and one server you choose, and sends your traffic through that first. The network around you now sees only one thing: encrypted data going to that one server. It cannot read it or tell what is inside.

An encrypted tunnel means exactly that: a private channel where every packet is scrambled with a key, so only the two ends can read it. Everything between them sees noise. That server then passes your traffic on to the real website, so to the website your connection now appears to come from the server's address, not your home one.

So a VPN genuinely gives you two things: it encrypts the hop from your device to your server (which is what protects you on untrusted Wi-Fi), and it changes your apparent IP address to the server's. That is real and useful. But be clear about the limits, because this is where the marketing lies:

• A VPN is not anonymity. Your traffic still comes out of the server and goes to the real site in the normal way. You have not disappeared; you have moved. If you log in to your accounts, you are still you.
• Trust does not vanish, it moves. Before, your internet provider could see which servers you visit. With a VPN, the provider of that VPN server can see it instead. You have swapped who you trust. A commercial VPN is asking you to trust *their* company, a business you cannot inspect. That is the single best reason to run your own: when you run the server, the party you are trusting is you.
• It does not make you safe to break the law, and it does not hide you from a serious, lawful investigation. This mission is about privacy on untrusted networks and reaching your own machines, not about evading anything. Servers keep logs; the tunnel is not a cloak.
• It does not block ads, trackers or fingerprinting by itself. Those live in the web pages you load, and they travel straight through the tunnel. Other lessons on this track handle those.

WireGuard is the tool we use to build the tunnel. It is modern, very small (a few thousand lines of code, where older VPNs are hundreds of thousands), fast, and built into the Linux kernel. Small matters for security: less code means fewer places for bugs to hide, and it is why WireGuard has become the standard the newer commercial VPNs are built on anyway. You are about to use the real thing directly.

The lawful reasons to run your own are good ones: encrypt your traffic on hotel and cafe Wi-Fi so the local network cannot snoop on the hop; reach your home computer, files or devices securely when you are out; and stop trusting a VPN company you know nothing about. That is what you will build.