Your own VPN on a VPS in 2026: cost, protocols, blocking
A self-hosted VPN on a VPS costs about $3 to $7 a month in 2026. Which protocols survive DPI in Russia, Iran and China, and which get blocked fast.
A self-hosted VPN server on a rented VPS costs roughly $3 to $7 a month in 2026. That is an estimate based on public pricing from major hosting providers. The protocol matters more than the price. In Russia, Iran and China, plain WireGuard and OpenVPN are identified by filtering systems almost instantly, while VLESS with Reality and AmneziaWG still work in most cases. The main threat has shifted from the protocol to the address: censors increasingly cut off entire hosting subnets.
Below is a breakdown: pricing, hardware, protocols, blocking by country, setup and the legal side. Figures without a precise source are marked as an estimate. Hosting prices and filtering rules change faster than price lists get updated.
How much does your own VPN server cost in 2026
For a personal VPN serving 1 to 5 people, the cheapest virtual server is enough. CPU and memory barely get used. The real costs are traffic and a public IPv4 address.
| Provider | Minimum plan for a VPN | Monthly price (estimate) | Included traffic | Payment from Russia |
|---|---|---|---|---|
| Hetzner (Germany, Finland) | 2 vCPU, 4 GB RAM | €4-5 | 20 TB | foreign card or reseller only |
| DigitalOcean | 1 vCPU, 512 MB-1 GB RAM | $4-6 | 0.5-1 TB | foreign card, PayPal |
| Vultr | 1 vCPU, 1 GB RAM | $5-6 | 1-2 TB | cryptocurrency |
| Contabo | 4 vCPU, 8 GB RAM | €5-6 | 32 TB | foreign card, PayPal |
| Russian-language hosts with EU locations | 1 vCPU, 1-2 GB RAM | 250-700 RUB | 1-10 TB or unmetered | rubles, SBP |
| Oracle Cloud Free Tier | up to 4 ARM cores, 24 GB RAM | 0 | 10 TB | foreign card for verification |
The numbers are rounded and show the price range, not an exact November 2026 price list. Hetzner and DigitalOcean revised pricing in 2024 and 2025, and the next change can land at any time.
A gap of $1 to $3 between providers decides little. Three things decide a lot: how much traffic is included, what IPv4 costs, and whether payment is possible at all.
What gets added to the server price
Public IPv4 has become more expensive across the market. Since February 2024, Amazon Web Services charges $0.005 per hour for every public IPv4 address, about $3.60 a month on top of the server. Hetzner bills the primary IPv4 in its cloud as a separate line, around €0.50-0.60 a month. An IPv6-only server is cheaper, but nearly useless for a VPN used from Russia: more than half of home and mobile connections there do not get IPv6 (estimate).
Traffic overage at US clouds costs about $0.01 per gigabyte, at Hetzner about €1 per terabyte in European locations. For a family VPN this is rarely a problem. One torrent client without a speed cap can burn through a DigitalOcean monthly allowance in a few days.
The third cost is payment itself. Russian bank cards have not worked with foreign hosting providers since 2022. What remains is cryptocurrency, resellers charging 5-15% commission (estimate), and Russian-language hosts that accept rubles and run servers in the Netherlands, Finland, Germany or Kazakhstan.
How much traffic a VPN uses
| Activity | Traffic (estimate) |
|---|---|
| YouTube 1080p, one hour | 1.5-3 GB |
| YouTube 4K, one hour | 7-15 GB |
| Instagram or TikTok, one hour of feed | 0.5-1 GB |
| Messenger voice call, one hour | 30-60 MB |
| Video call, one hour | 0.5-1.5 GB |
| Regular browsing, one hour | 50-150 MB |
A family of four watching video through the VPN for a couple of hours a day uses 300-600 GB a month (estimate). A 1 TB plan covers that with room to spare. If only messengers and a few blocked sites go through the server, usage drops to 20-50 GB.
What VPS specs does a VPN need
The minimum configuration is enough: 1 vCPU, 512 MB to 1 GB of RAM, 10 GB of disk, Ubuntu 22.04 or 24.04. WireGuard and AmneziaWG barely touch the CPU, a single core pushes 300-900 Mbit/s (estimate). Xray with Reality handles TLS in user space and needs more: 200-500 Mbit/s per core (estimate). With 5 users, hitting a CPU limit is close to impossible. The bottleneck is usually the server port and the route to the user’s ISP.
Location matters more than specs. It determines latency and the odds of getting caught in restrictions.
| Server location | Ping from Moscow (estimate) | Comment |
|---|---|---|
| Helsinki, Finland | 15-25 ms | closest EU point |
| Amsterdam, Netherlands | 35-50 ms | one of the largest traffic exchanges |
| Frankfurt, Germany | 35-55 ms | many hosts, frequent subnet restrictions |
| Kazakhstan | 40-80 ms | outside the EU, has its own filtering |
| US East Coast | 110-140 ms | noticeable lag in games and calls |
Nearby Europe wins on latency but has a downside. Subnets of popular European clouds get restricted in Russia more often than others. A small data center in the same Finland sometimes works more reliably than a big cloud.
Which VPN protocol to choose in 2026
A VPN protocol handles two things: encryption and how the traffic looks. Every modern option handles encryption fine. The problem is appearance. Deep packet inspection (DPI) systems look for telltale signs, and if a protocol gives itself away, the connection drops within seconds.
| Protocol | Speed | Russia | Iran | China |
|---|---|---|---|---|
| WireGuard | very high | blocked by signature | blocked | blocked |
| OpenVPN | medium | blocked by signature | blocked | blocked |
| IPsec/IKEv2 | high | unstable | blocked | blocked |
| Shadowsocks 2022 | high | partly works | partly works | detected |
| VLESS + Reality | high | works on most networks | works with outages | works with outages |
| Trojan | high | partly works | partly works | partly works |
| Hysteria2 | very high on lossy networks | UDP often cut | partly works | partly works |
| AmneziaWG | very high | works on most networks | partly works | rarely |
The statuses are an estimate based on reports from users and censorship researchers. Within one country the picture varies by operator and region. A home ISP in Moscow and a mobile operator in Dagestan can behave differently on the same day.
Why WireGuard and OpenVPN no longer work in Russia
WireGuard is fast and simple, but it does not hide. The first handshake packet has a fixed size of 148 bytes and a recognizable header. OpenVPN leaves a distinctive signature at the start of a session. For DPI, that is a license plate on the bumper.
In Russia, filtering is done by TSPU boxes, technical means of countering threats, which operators must install under the 2019 sovereign internet law. Mass blocking of VPN protocols began in 2023 and reached major mobile operators by 2024. On most networks, WireGuard and OpenVPN connections to foreign addresses last a few seconds before dropping.
VLESS and Reality: how the disguise works
VLESS is a lightweight protocol from the Xray project. Reality is a way to disguise it, introduced in 2023. A server running Reality impersonates a real, large website. DPI sees an ordinary TLS 1.3 connection to a well-known domain, such as a major IT vendor’s site. If the filtering system probes the server itself, it gets a response from the real website.
The upside for the owner: no need for a domain or certificate. The downside: setup is harder than WireGuard. Clients such as v2rayN, Hiddify, v2RayTun or Streisand look unfamiliar to someone used to a one-button commercial VPN.
AmneziaWG: WireGuard in disguise
AmneziaWG is a WireGuard fork from the open-source Amnezia project. It changes packet headers, sends junk packets before the handshake and varies their sizes. The signature DPI uses to spot WireGuard disappears. Speed is nearly identical to the original. The Amnezia app installs the server over SSH on its own, needing only the VPS IP address and password.
Hysteria2 and other UDP protocols
Hysteria2 runs on QUIC and copes well with packet loss: mobile internet on a train, congested Wi-Fi. In Russia its weak spot is UDP itself. Some operators throttle or cut UDP traffic to foreign addresses. As a backup Hysteria2 is useful, as the main protocol for Russia it is risky.
What gets blocked in Russia, Iran and China in 2026
Russia: protocols, hosting subnets and whitelists
Blocking in Russia works on three levels. The first is protocol signatures, covered above.
The second level is addresses. Since late 2024, users and researchers from the net4people community have documented a strange effect with TCP connections to several large foreign hosts. The connection freezes after roughly 15-20 KB of data. Subnets of Hetzner, DigitalOcean, OVH and other clouds were affected. A website loads halfway, a VPN connects and then stalls. Protocol disguise does not help here: the route to the data center itself is being cut.
The third level is whitelists. Since summer 2025, mobile internet in dozens of Russian regions has been shut off, leaving access only to services on an approved list: government services, banks, marketplaces, VK, Yandex. During those hours any VPN is useless. The foreign server is unreachable entirely, whatever protocol it runs.
Blocking of commercial VPN services runs separately. In 2024, Apple removed about 25 VPN apps from the Russian App Store at Roskomnadzor’s request. The regulator regularly reports blocking services, with the count in the hundreds (estimate). A personal server for three people rarely ends up on those lists: it is not advertised and does not appear in app stores. That is the main advantage of a private VPS over a popular service.
Iran
Iran filters harder than Russia and maintains the National Information Network, which keeps domestic services running while the outside internet is off. In June 2025, during the war with Israel, international access was almost completely cut for several days. In normal times, Iranian users rely heavily on VLESS with Reality and CDN-based configurations. Addresses of popular hosts land on blacklists quickly, so servers get replaced more often than in Russia.
China
The Great Firewall catches even traffic that looks like random noise. In 2023, researchers at USENIX Security described how it identifies fully encrypted protocols such as Shadowsocks using byte statistics in the first packet. A detected server gets blocked by IP. Selling VPN access without a license is a criminal offense in China, so personal servers there live a semi-underground life.
How long a personal server lasts before blocking
| Country | Protocol | Personal server lifespan (estimate) |
|---|---|---|
| Russia | WireGuard, OpenVPN | seconds to minutes per session |
| Russia | VLESS + Reality, AmneziaWG | months |
| Iran | VLESS + Reality | weeks |
| China | Reality, Trojan | days to weeks |
| EU, US | any | no restrictions |
How to set up a VPN on a VPS: three ways
Option 1. The Amnezia app, no terminal
The shortest path. It needs a VPS running Ubuntu, its IP address and the root password. In the Amnezia app, the user picks the option to set up their own server, enters the details and chooses a protocol: AmneziaWG or XRay with Reality. The app installs Docker and the server side automatically. Keys for other devices are shared by link or QR code. The whole process takes 5-10 minutes (estimate).
Option 2. The 3x-ui panel for VLESS and Reality
For those willing to open a terminal. The 3x-ui panel installs Xray and provides a web interface for managing users and traffic.
ssh root@SERVER_IP
apt update && apt upgrade -y
bash <(curl -Ls https://raw.githubusercontent.com/mhsanaei/3x-ui/master/install.sh)The installer prints the panel address, port, username and password. In the panel, an inbound VLESS connection is created with Reality security, a cover domain and port 443. The panel generates a separate link and QR code for each user and shows how much traffic each one has used.
Option 3. Plain WireGuard for countries without DPI
If the server is for travel in Europe, public Wi-Fi protection or access to home services, disguise is unnecessary. Plain WireGuard is the fastest option and installs with a single script.
curl -O https://raw.githubusercontent.com/angristan/wireguard-install/master/wireguard-install.sh
chmod +x wireguard-install.sh
./wireguard-install.shThe script asks a few questions, brings up the interface and creates a client config file. That file is imported into the official WireGuard app.
Minimal server protection
A VPS with open SSH and a root password gets brute-forced by bots within hours of going live. A basic firewall closes everything unneeded:
ufw allow 22/tcp
ufw allow 443/tcp
ufw enableThe 3x-ui panel port and the UDP port for AmneziaWG or WireGuard are opened separately, the installer shows their numbers. Logging in with an SSH key instead of a password removes the brute-force problem almost completely.
Own server or a ready-made VPN service: the catch
| Parameter | Own VPS | Commercial VPN |
|---|---|---|
| Monthly price (estimate) | $3-7 | $3-12 |
| IP address | one, dedicated | shared with thousands of users |
| Risk of landing on Roskomnadzor lists | low | high for popular services |
| Choice of countries | one location per server | dozens of locations |
| Anonymity | low, the host knows who pays | depends on logging policy |
| Maintenance | on the owner | on the service |
A personal server does not provide anonymity. The host knows who pays, and every website sees the same IP. It is a tool for bypassing blocks, not for hiding identity. Data center addresses irritate anti-fraud systems: Google shows more captchas, streaming services trim their catalogs or refuse to work.
The second catch is maintenance. When a hosting subnet gets restricted, nobody switches servers for the owner. A new VPS has to be rented, the setup moved, and new keys handed out to every user. With 3x-ui that takes 20-30 minutes (estimate), longer with a manual setup.
The third catch is a single country. Access to services available only in the US or only in Europe requires a second VPS, which doubles the budget.
Is running your own VPN legal in Russia
Under the legislation known at the time of writing, simply using a VPN as an individual in Russia is not punished with a fine. Law 276-FZ of 2017 requires owners of VPN services and anonymizers to connect to the registry of banned sites and filter traffic. It targets those who provide access to other people.
Since March 2024, advertising ways to bypass blocks has been banned in Russia. Since September 1, 2025, there is a fine of 3,000-5,000 rubles for deliberately searching for extremist materials, including via VPN. Fines for advertising VPNs were introduced at the same time: 50,000-80,000 rubles for individuals, up to 500,000 for companies.
The gray zone is a server shared with friends and relatives. Formally, giving access to third parties moves the owner closer to the status of a block-bypassing service. No public cases against owners of personal servers for 3-5 people are known (estimate), but the law is broadly worded, and enforcement tightened through 2025 and 2026.