How to set up a VPN server on Raspberry Pi easily in 30 minutes

Imagine being able to securely access your home files from a hotel Wi-Fi, or stop worrying about your data privacy at the local coffee shop, all without paying a monthly fee. Learning how to set up a VPN server on Raspberry Pi isn’t just a fun tech project; it’s a powerful move to reclaim full control over your digital security.

In an era of monthly subscriptions and concerns over data logging, a self-hosted VPN offers a transparent and cost-effective alternative. It ensures that you are the sole controller of your data, creating an encrypted tunnel straight to your trusted home network, no matter where you are in the world.

Having built and troubleshooted dozens of these DIY servers over the years, from early models to the powerful new Raspberry Pi 5, I’ve seen how this simple, credit-card-sized computer can become a personal fortress of privacy. It’s not just for networking experts; it’s for anyone ready to take charge of their online safety.

Don’t just read about digital sovereignty, build it. Let me guide you through every step to transform that tiny computer into your personal security powerhouse, starting now.

1. Why build your own Raspberry Pi VPN server?

So, with dozens of commercial VPN services out there, why bother setting up your own on a tiny computer? The answer comes down to three powerful benefits: cost, control, and capability.

First, let’s talk about the money. Most popular VPN services charge a recurring fee, which can add up to hundreds of dollars over a few years. A Raspberry Pi is a one-time purchase. Think of it as buying your own high-quality coffee machine instead of paying for a pricey latte every single day. The initial investment pays for itself quickly.

Next, and for me, most importantly, is privacy. When you use a commercial VPN, you’re trusting a company’s “no-logs” promise. With a Pi VPN, you don’t need to trust anyone. You own the entire system. Your data travels from your device, through an encrypted tunnel you created, directly to your home network. No third-party company ever sees it.

Finally, it’s a gateway to your digital home. I’ll never forget the first time I traveled after setting up my Pi VPN. I was in a hotel across the country and realized I’d left a crucial work file on my home computer. Instead of panicking, I fired up the VPN on my laptop. A few clicks later, I was securely accessing my home PC’s files as if I were sitting right in front of it. That feeling of self-reliance is priceless. It allows you to safely check home security cameras or access your personal media server from anywhere in the world.

2. What you’ll need: The complete project checklist

Great projects start with great preparation. Think of this like gathering all your ingredients before you start cooking a new recipe. Having everything on hand makes the entire process smoother and a lot more fun. Here’s a quick look at everything you’ll need.

Category	Item	Key Recommendation / Notes
🗹	Raspberry Pi Board	Pi 4 or 5 for best performance.
🗹	microSD Card	16GB minimum, 32GB Class 10 recommended.
🗹	Power Supply	An official USB-C adapter is crucial for stability.
🗹	Ethernet Cable	Essential for a reliable server connection.
🗹	Case	Optional, but great for cooling and protection.
🗹	Raspberry Pi Imager	The official tool for easy OS installation.
🗹	SSH Client	PuTTY (Windows) or Terminal (macOS/Linux).

Now, let’s look at each of these items in more detail.

2.1. Essential hardware

Let’s begin with the physical components. These are the tangible pieces that will form the backbone of your personal VPN server, so choosing the right ones is the first step to a stable and reliable setup.

A Raspberry Pi board.

I strongly recommend a Raspberry Pi 4 or Raspberry Pi 5 for this project. Their processing power means your VPN will be fast and responsive, even with multiple devices connected. While a Pi 3 will work, you might notice some slowdown. My current setup on a Pi 5 handles video calls and file downloads simultaneously without breaking a sweat.

A high-quality microSD card.

This is your Pi’s hard drive, so don’t skimp here. You’ll need at least 16GB of space, but a 32GB Class 10 card is the sweet spot. The “Class 10” rating ensures it’s fast enough to run the operating system smoothly. Trust me, troubleshooting a project only to find the culprit was a cheap, slow SD card is a headache you want to avoid.

The correct power supply.

This is critical. A Raspberry Pi 4 or 5 needs a good USB-C power adapter that can provide a stable current. Using an old phone charger is a recipe for disaster, leading to random crashes and data corruption. I’ve learned the hard way that a stable power supply is non-negotiable for any server project.

An Ethernet cable.

While the Pi has Wi-Fi, a server needs stability above all else. A wired Ethernet connection is like a private highway for your data, free from the interference and traffic jams that can plague a wireless connection. You’ll plug this directly from your Pi into your home router.

A case (optional, but highly recommended).

A simple case protects your Pi from dust and accidental bumps. Many also come with a small fan or heatsinks, which help keep your little server cool and running at peak performance, especially if it’s tucked away in a closet.

2.2. Required software

With our physical components ready, we need the digital tools to bring the server to life. Think of this as the “brains” and “instructions” that will tell your hardware what to do.

Raspberry Pi Imager.

This is the official, free tool from the Raspberry Pi Foundation. It’s the easiest and most reliable way to install the operating system onto your microSD card. It takes all the guesswork out of the process.

An SSH client.

SSH (or Secure Shell) is a magical tool that lets you command your Raspberry Pi from your main computer over the network. This means you don’t need a separate keyboard, mouse, or monitor for your Pi once it’s set up.

• For Windows users, the classic and reliable choice is PuTTY.
• For macOS and Linux users, the Terminal app is already built in.

3. Phase 1: Preparing your Raspberry Pi for server duty

With all our components gathered, it’s time to lay the foundation. This phase is all about preparing the Raspberry Pi’s operating system and making sure it’s secure and up-to-date. Getting this part right will make the actual VPN installation in the next phase a breeze.

3.1. Installing Raspberry Pi OS Lite

We’ll be using Raspberry Pi OS Lite. Think of it as a streamlined, efficient version of the operating system. It doesn’t have a graphical desktop, which is perfect for a server because it uses fewer resources, leaving more power for our VPN. The best part? We can set it up completely “headless,” meaning we won’t need to plug a monitor or keyboard into the Pi at all.

Here’s how to do it using the Raspberry Pi Imager:

1. Download and open Raspberry Pi Imager on your main computer.
2. Choose the OS. Click Choose OS, then navigate to Raspberry Pi OS (other), and select Raspberry Pi OS Lite (64-bit). The 64-bit version offers better performance for modern hardware.
3. Choose your microSD card. Click Choose Storage and select your microSD card. Be absolutely certain you’ve picked the right drive, as this process will erase everything on it!
4. Configure the advanced options. This is the pro-tip that saves you a ton of hassle. Before clicking Write, click the little Settings cog icon on the bottom right. A new window will pop up.
   • Check the box for Enable SSH and select Use password authentication.
   • Check the box to set the username and password. Choose a username (like pi or your name) and a strong, memorable password.
   • Optionally, you can also configure your Wi-Fi details here, though we’ll be using Ethernet.
   • Click Save when you’re done.
5. Write the OS. Click the Write button. Go grab a coffee, as this will take a few minutes. Once it’s finished, you can safely eject the microSD card and insert it into your Raspberry Pi.

3.2. First boot and initial configuration

Now it’s time to wake up your Pi. Plug one end of the Ethernet cable into your Pi and the other into your router, then connect the power supply. Give it a minute or two to boot up.

1. Find your Pi’s IP address. Your Pi has now been assigned a local IP address by your router. The easiest way to find it is to log in to your router’s web admin page (the address is usually on a sticker on the router itself, like 192.168.1.1 or 192.168.0.1) and look for a list of “connected devices” or “DHCP clients.” You should see your Pi listed there with its IP address.
2. Connect via SSH. Open your SSH client (PuTTY on Windows or Terminal on macOS/Linux) and type the following command, replacing the placeholders with your own details: ssh your_username@your_pi_ip_address (For example: ssh safeteam@192.168.1.123)
   The first time you connect, you’ll see a security warning about a host key. This is normal. Just type yes and press Enter. Then, enter the password you created in the Imager.
3. Update your system. Welcome to your server’s command line! The very first thing you should always do is update the software. It’s like updating the apps on your phone – it patches security holes and fixes bugs. Run these two commands, one after the other.
   First, fetch the list of available updates: sudo apt update
   Next, install the updates (this one might take a while): sudo apt full-upgrade

This isn’t just good practice; it’s a core security principle. Cybersecurity authorities like CISA constantly highlight that keeping software patched is one of the most effective defenses against attacks. I make it a rule to run these commands on any new server before I install anything else.

With your Pi now fully updated and configured, you have a solid, secure base ready for the main event.

4. Phase 2: How to set up a VPN server on Raspberry Pi with PiVPN

Welcome to the main event! With our Pi prepped and ready, we’re now going to install the software that does all the heavy lifting. We’ll be using a brilliant tool called PiVPN, which automates the entire complex process into a simple, step-by-step wizard.

For everyone else, let’s walk through this together.

4.1. Why PiVPN is the smart choice

Manually installing a VPN server like WireGuard or OpenVPN involves dozens of complex steps, from generating encryption keys to configuring network rules. I’ve done it manually, and it’s a recipe for a long, frustrating night.

PiVPN is a specialized script that acts like a smart assistant. It asks you a series of simple questions and then performs all those complicated tasks for you, perfectly, every time. It was built specifically for the Raspberry Pi community, and it’s the gold standard for a reason.

4.2. The one-command installation

On your Pi’s command line (connected via SSH), run this single command. This will download the PiVPN installation script and start it automatically.

Generated bash

curl -L https://install.pivpn.io

This will launch a blue, text-based wizard. Use your arrow keys to move, the spacebar to select/deselect options, and Enter to confirm. Here’s a breakdown of the screens you’ll see and the choices I recommend:

• User Selection: It will ask which user the configurations should belong to. Choose the username you created earlier.
• Protocol Choice: This is your first big decision. It will ask you to choose between WireGuard and OpenVPN. We’ll cover this in detail next.
• Port Selection: WireGuard’s default port is 51820. There’s no reason to change this unless you know what you’re doing. Just press Enter to confirm. Make a note of this port number; you’ll need it later.
• DNS Provider: This is the service your VPN will use to look up websites. I recommend choosing a privacy-focused one like Cloudflare (1.1.1.1) or Quad9.
• DDNS Setup: The wizard will ask if you want to use a public IP or a DNS name. Unless you pay your internet provider for a static IP (most people don’t), you’ll need DDNS. Choose Yes here. We’ll explore this more in section 4.4.
• Unattended Upgrades: The script will offer to enable automatic security updates for your Pi. This is a fantastic feature. I always enable this for peace of mind. Select Yes.

After a few more confirmation screens, PiVPN will install. It will end by asking you to reboot. Choose Yes.

4.3. Wireguard vs. OpenVPN: Which protocol should you choose?

Think of a VPN protocol as the specific method used to create your secure tunnel. PiVPN offers two of the best:

Feature	WireGuard	OpenVPN
Speed	Excellent. Far faster and more efficient.	Good. Reliable but noticeably slower.
Security	Modern & Strong. Uses state-of-the-art cryptography.	Battle-Tested. Very secure and audited for years.
Battery Life	Excellent. Very lightweight on mobile devices.	Good. Can use more battery on phones/laptops.
Ease of Setup	Simpler. A smaller codebase makes it easier to manage.	More complex With many configuration options.

4.4. DNS: Reaching your VPN from anywhere

So, why did we need to set up that DDNS (Dynamic DNS) thing? Here’s a simple analogy:

Your home’s public IP address, the one the internet sees, is like a temporary hotel room number. Your internet provider can change it anytime, after a power outage, a router reboot, or just randomly. If it changes, your VPN app won’t know where to connect.

A DDNS service gives you a permanent, memorable address for your changing IP. Think of it as a personal P.O. Box. You give your VPN app the PO Box address (e.g., my-safe-pi.duckdns.org). The DDNS service’s job is to constantly check your hotel room number (your real IP) and automatically forward all mail (your VPN connection) to the right place.

During the PiVPN setup, it helps you create a free account with a provider like No-IP or DuckDNS. This is the vital link that ensures you can always find your way home.

5. Phase 3: Configuring your network and connecting devices

Our PiVPN server is installed and running, but right now, it can only talk to devices inside your home. To reach it from the outside world, we need to give our router a clear set of instructions. Think of this phase as setting up the “address” and “doorbell” for your VPN server so your devices can find it from anywhere.

5.1. Setting a static IP address for your Pi

Inside your home network, your router gives out temporary IP addresses (like 192.168.1.12) to devices as they connect. The problem is, this address can change when you reboot the Pi. We need to give our Pi a permanent, predictable address so the router always knows where to find it.

This is called setting a static IP address or a DHCP reservation. It’s like telling your office mailroom, “The marketing department is always in office #204.”

1. Log in to your router’s web admin page.
2. Look for a section named “DHCP Server,” “Address Reservation,” or “LAN Settings.”
3. You’ll likely see a list of connected devices. Find your Raspberry Pi (it might be named raspberrypi or have the IP address you used to SSH into it).
4. There should be an option to “Reserve”, “Add”, or “Bind” this address. Click it. This tells your router to always give that exact same IP address to your Raspberry Pi whenever it connects.

From personal experience, this is a step you should never skip. I once spent an entire evening troubleshooting why my VPN suddenly stopped working, only to realize my router had assigned my Pi a new IP after a power flicker. A static IP prevents that headache forever.

5.2. Port forwarding: Opening the door for your VPN

Now that our Pi has a permanent office, we need to tell the building’s receptionist (your router) to forward specific mail to it. This is port forwarding.

Right now, your router’s firewall blocks all incoming connections for security. We need to open one specific “door” (a port) and tell the router, “Any connection attempts that arrive on this specific port should be sent directly to the Raspberry Pi’s static IP address.”

1. In your router’s admin page, find the “Port Forwarding,” “Virtual Servers,” or “Firewall” section.
2. Create a new rule with the following details:
   • Service Name: Give it a memorable name, like WireGuard-VPN.
   • Internal IP / Device IP: Enter the static IP address you just reserved for your Pi.
   • External Port: Enter the port you noted during the PiVPN installation. For WireGuard, this is 51820.
   • Internal Port: This should be the same as the external port: 51820.
   • Protocol: Select UDP. WireGuard uses UDP because it’s faster.
3. Save and apply the rule. Your router will now forward all incoming WireGuard traffic to your Pi.

5.3. How to create VPN client profiles

The final step is to create the “keys” for your devices. Each phone, laptop, or tablet that you want to connect needs its own unique profile.

On your Pi’s command line (via SSH), use this simple command:

pivpn add

The script will ask you for a name for the client. Choose something descriptive, like my-iphone or work-laptop. Press Enter.

That’s it! PiVPN has just created a new user with its own unique set of cryptographic keys. Now, how do you get this profile onto your phone or computer? You have two easy options:

• For Mobile (The QR Code Method): This is the easiest way. Just run the following command, replacing my-iphone with the client name you chose: pivpn -qr my-iphone
  This will display a giant QR code right in your terminal window. We’ll scan this with the WireGuard app in the next step.
• For Desktops (The File Method): PiVPN has saved a configuration file in the /home/your_username/configs directory. The file will be named my-iphone.conf. You’ll need to securely transfer this file to your computer to import it into the desktop client.

6. The final test: Connecting your first device

This is the most satisfying part of the entire project. All the setup and configuration lead to this moment: connecting your device and seeing it work. It’s time to use the “key” we just created to unlock our private tunnel back home. I still remember the huge grin I had the first time I saw the “Connected” status pop up on my phone.

Let’s walk through connecting the two most common types of devices.

6.1. On iOS/Android

Connecting your phone is incredibly simple, thanks to the QR code we generated.

1. Download the official app. Go to the Apple App Store or Google Play Store and search for “WireGuard”. Download the official application from the WireGuard Development Team.
2. Add a new tunnel. Open the app and tap the + button. Choose Create from QR code.
3. Scan the code. Point your phone’s camera at the QR code displayed in your SSH terminal window. It will instantly read the code and import the entire configuration.
4. Name your connection. Give the tunnel a name (e.g., “Home VPN”) and tap Save.
5. Connect! You’ll now see the new connection in a list. Just tap the toggle switch next to it.

If everything is correct, the status will change to “Connected.” You’ll also see a small VPN icon appear in your phone’s status bar. It’s that easy!

6.2. On Windows/macOS

For your computer, the process is very similar, but instead of using a QR code, we’ll import the configuration file.

1. Download the WireGuard client. Go to the official WireGuard website (wireguard.com/install) and download the correct version for your operating system.
2. Transfer the configuration file. You need to get the .conf file from your Raspberry Pi to your computer. An easy and secure way to do this is using a tool like WinSCP on Windows or the scp command on macOS/Linux. The file is located in the configs directory inside your user’s home folder on the Pi.
3. Import the tunnel. Open the WireGuard application on your computer and click Import tunnel(s) from file. Select the .conf file you just transferred.
4. Activate the connection. The new tunnel will appear in the list. Click the Activate button next to it.

The status should change to “Active.”

How do you know it’s really working? The ultimate test is to check your public IP address. Disconnect from your home Wi-Fi (use your phone’s mobile data) or connect from a different network. With the VPN active, open a web browser and go to a site like ipleak.net.

The IP address displayed on the website should be your home’s public IP address, not your mobile carrier’s or the coffee shop’s. When you see your home IP address appear, you’ve done it. You are now securely browsing the internet through your own private Raspberry Pi server. Congratulations!

7. Troubleshooting and post-installation tips

Okay, so what happens if it doesn’t “just work”? First, don’t panic. Every single person who works with tech, myself included, has spent hours chasing down a problem that turned out to be a simple typo or a single missed checkbox. Think of troubleshooting as being a detective. Let’s go through the most common clues.

7.1. Common PiVPN issues: A troubleshooter’s guide

PROBLEM 1: 

You can't connect at all (the connection times out).

The Analogy: Your device is trying to ring the doorbell, but no one is answering.

The Solutions: This is almost always a port forwarding issue.

• Double-check your port forwarding rule. Is the IP address in the rule the exact static IP of your Pi? Did you select UDP for the protocol? Is the port number 51820?
• Check your DDNS. Go to your DDNS provider’s website (like No-IP or DuckDNS) and log in. Does the IP address they have on file match the public IP address you see on a site like ipleak.net? If not, your DDNS client isn’t updating correctly.
• ISP Firewall: Some internet service providers have their own firewall that can block ports. I once spent a whole day on this, only to find a hidden setting in my ISP’s account portal called “Security Shield” that was blocking my port. You may need to log in to your ISP account or call them to ensure they aren’t blocking port 51820.

PROBLEM 2: 

You're connected, but you can't access the internet.

The Analogy: You’ve successfully entered your house, but the phonebook inside only lists local numbers, so you can’t call anyone outside.

The Solutions: This is a classic DNS problem. The fix is to tell your client to use a public DNS server instead of trying to use your home router.

• Open the WireGuard app on your device and edit the connection.
• Find the DNS field. It might be blank or have your Pi’s local IP.
• Change it to a public DNS server. A great, fast choice is Cloudflare: 1.1.1.1.
• Save the changes and try reconnecting. This solves the issue 9 times out of 10.

PROBLEM 3: 

The VPN is connected, but the speed is very slow.

The Analogy: Your internet is a highway. While your download lane might have 8 lanes, your upload lane might only have one.

The Solutions: Your VPN speed is limited by your home internet’s upload speed. The server has to upload data to your device. Go to a speed test website from your home computer and check your upload speed. If it’s only 5-10 Mbps, that’s your performance ceiling. Using an Ethernet cable for the Pi and choosing WireGuard over OpenVPN are the best ways to maximize the speed you have.

PROBLEM 4: 

You need to manage users.

The Analogy: You’re the landlord and need to give out new keys or take old ones back.

The Solutions: PiVPN makes this easy.

• To add a new device/user: pivpn add
• To revoke an existing user’s access: pivpn remove
• To see who has access: pivpn list

7.2. Post-installation: Securing and optimizing your server

Once your VPN is running smoothly, here are a couple of pro tips to make your server more secure and to measure its performance.

• Essential security hardening:
  • Change your SSH port: Hackers constantly scan the default SSH port (22). Changing it is like moving your front door to a less obvious location.
  • Install Fail2Ban: This is a brilliant little security guard. It watches for failed login attempts and automatically blocks the IP addresses of attackers who try to brute-force their way into your Pi. You can install it with sudo apt install fail2ban.
  • Ensure automatic updates are on: If you didn’t enable unattended-upgrades during the PiVPN setup, it’s a great idea to do it now. It’s your server’s personal maintenance crew, patching vulnerabilities while you sleep.
• How to benchmark your VPN speed:
  • Curious about your server’s actual performance? You can run a speed test directly from your Pi’s command line.
  • First, install the tool: sudo apt install speedtest-cli
  • Then, just run the command: speedtest-cli
  • This will show you the maximum theoretical speed your server can get from your home internet. It’s a fun way to see the raw power of your connection and understand your VPN’s performance limits.

8. DIY VPN vs. commercial VPN: The final verdict

Congratulations on building your own private fortress! You’ve accomplished something that gives you an incredible amount of power over your digital life. But this brings up an important question: Does this awesome DIY project make commercial VPN services obsolete?

The honest answer is: it depends entirely on what you need a VPN for. As someone who uses both a self-hosted Pi VPN and subscribes to a commercial service, I can tell you they are two different tools for two different jobs.

Let’s break it down with a quick comparison:

Feature	DIY Raspberry Pi VPN	Commercial VPN Service
Primary Goal	Securely access your home network & full data control.	Bypass geo-restrictions & general-purpose privacy.
Privacy	Maximum. You control the hardware and logs.	Trust-based. Relies on the provider’s no-logs policy.
Speed	Limited by your home internet’s upload speed.	Typically much faster, with optimized global servers.
Server Locations	One: your home.	Dozens or hundreds of countries worldwide.
Cost	One-time hardware purchase, then free.	Ongoing monthly or yearly subscription fee.
Setup & Maintenance	Requires initial setup, and you are the IT support.	Instant setup with polished apps and dedicated customer support.
Best For	Tech enthusiasts, remote access to home files, and total privacy advocates.	Streaming, gaming, bypassing censorship, and ease of use.

Your Raspberry Pi VPN is the undisputed champion for:

• Absolute privacy and control. You are the only person with the keys. There are no third-party servers, no terms of service to read, and no “no-logs” promises to trust. You know your data isn’t being logged because you built the system.
• Securely accessing your home network. This is its superpower. It’s the perfect tool for grabbing files from your home PC, checking your security cameras, or managing smart home devices from anywhere in the world, all through a secure, encrypted tunnel.
• Saving money. After the initial hardware cost, it’s completely free. No monthly or yearly subscription fees, ever.

However, a commercial VPN service is a better choice when:

• You need high speeds for streaming and downloads. Your Pi VPN’s speed is bottlenecked by your home internet’s upload speed, which is often a one-lane country road compared to the superhighway speeds commercial services offer.
• You want to bypass geo-restrictions. Want to watch a UK-exclusive show on Netflix or access a streaming service only available in Japan? A commercial VPN gives you a global network of servers to choose from. Your Pi VPN will always have your home country’s IP address.
• You value convenience and support. Commercial VPNs come with polished apps for every device and a support team ready to help if something goes wrong. With your Pi, you are the IT department.

If this DIY project seems too complex, or your main goal is to unlock streaming libraries and have servers all over the world, then a commercial service is undoubtedly the better tool for the job. If that’s the case, check out Safelyo’s guide to the best commercial VPN services.

9. FAQ about the VPN server on Raspberry Pi

It’s natural to have a few more questions after completing a project like this. I’ve gathered answers to some of the most common queries that come up, giving you quick and direct solutions.

10. Conclusion

In summary, learning how to set up a VPN server on Raspberry Pi is an incredibly rewarding project that puts a powerful tool for security and privacy directly into your hands. You’ve gone from a simple idea to a fully functional, personal VPN server that you own and control completely.

Throughout this guide, you have accomplished several key milestones:

• You’ve learned how to prepare the necessary hardware for the project.
• You’ve successfully installed and configured a secure VPN server using PiVPN.
• You now know how to create client profiles and connect your devices.
• You are equipped to troubleshoot the most common issues you might encounter.

Now, that secure connection to your home network is no longer just an idea, but a reality you’ve built yourself. Don’t hesitate to experiment and be proud of the robust system you’ve created. Taking control of your own digital security is one of the most valuable skills in today’s world. For more in-depth and helpful tech guides, keep exploring the Tech How-To Simplified category here at Safelyo.