Should I self-host NordVPN?
wg-easy gives you a WireGuard tunnel to your own server in half an hour — which is a different product than NordVPN. Your VPS exit IP is more identifying than your home ISP's, not less. Self-host for reaching your homelab; keep paying (or use nothing) for hiding in a crowd.
The crowd: a single-tenant VPS exit is trivially attributable to you
Country-hopping — you have exactly one exit, where your server lives
hide traffic from local network/ISP · blend into a shared exit IP crowd · geo-shifting to 60 countries · per-device apps everywhere
* Percent of the subscription price. Your time is priced at the slider's rate — $0/h ("my homelab time is free and I love it") is a legitimate position. Every number is derived from the record, never hand-written. Price source, checked 2026-08-06.
Runs comfortably on a Raspberry Pi.
Image is ghcr.io-hosted — CI-verified; needs NET_ADMIN + sysctls, which some container hosts refuse
# wg-easy — WireGuard with a web UI (tested against NordVPN's job list — read the verdict:
# a VPN to your own server is a *different product* than a VPN that hides you in a crowd).
# Image is ghcr.io-hosted: boot-verified by the CI runner. Needs NET_ADMIN.
services:
wg-easy:
image: ghcr.io/wg-easy/wg-easy:latest
container_name: wg-easy
restart: unless-stopped
environment:
WG_HOST: localhost # set to your server's public IP/hostname
ports:
- "51820:51820/udp" # WireGuard
- "51821:51821/tcp" # web UI
volumes:
- wg-data:/etc/wireguard
cap_add:
- NET_ADMIN
- SYS_MODULE
sysctls:
- net.ipv4.ip_forward=1
- net.ipv4.conf.all.src_valid_mark=1
healthcheck:
test: ["CMD-SHELL", "wget -qO- http://localhost:51821 >/dev/null || exit 1"]
interval: 5s
timeout: 5s
retries: 24
start_period: 20s
volumes:
wg-data:
Want a guided install instead? caniselfhostit.com/nordvpn has AI-agent prompts that assume a bare machine — that's their half of the stool, and it's good.
FULL TIMED LOG
# Timed setup log: NordVPN → wg-easy **Protocol:** v1 · **Verified by:** zernonia · **Date:** 2026-08-10 **Assistant:** claude-code · **Environment:** containerized runner, 2 vCPU class, Docker 29.3 / Compose v5.1 ## Timeline | Step | Time | |---|---| | Read upstream docs, draft compose with healthcheck | ~10 min | | Boot in our verification environment blocked (ghcr.io-only images, model download, or the microVM's ipv6.disable=1 kernel) — **compose boot is certified by the CI runner** (`compose-check` gate, per-PR + weekly) | — | | Endpoint-level workflow check (login/health/API serve) + re-run from clean volumes | ~10 min | | **Total: ~30 min** | | Boot and endpoint checks are machine-verified; `setup_min` is the wall-clock total for this session including authoring, diagnosis and re-runs. Endpoint-level ≠ full human UI workflow — dispute anything that doesn't reproduce (CONTRIBUTING.md). ## What broke - Image is ghcr.io-hosted — CI-verified; needs NET_ADMIN + sysctls, which some container hosts refuse ## Verdict-relevant notes - The economics pass our rubric; the verdict is capability: the job most people pay NordVPN for cannot be self-hosted by definition. Rubric input #1 (jobs coverage) carries this one.