BLOG · FIELD NOTES

VPNSmith Guides & Benchmarks

Understand how a WireGuard tunnel works, what a GDPR VPS truly costs, and how to forge your own infra. Long-form, sourced, kept up to date.

All · 96 Self-host VPN · 62 clusters.vpn-trust-audits · 1 Tunneling & Obfuscation · 12 VPS Comparisons · 7 clusters.self-host-vpn-head · 7 clusters.commercial-vpn · 2 clusters.vps-hosting · 3 clusters.wireguard · 1 Cloud Privacy · 1

Extreme close-up of a dark circuit board, black memory chips marked SHE77 D908J, small capacitors and a single metal pin standing upright, the rest falling out of focus

FeaturedSelf-host VPN2026-08-21

WireGuard vs IPsec 2026: 4000 lines against 400000, and what that actually buys you

IPsec is not obsolete and WireGuard is not universally better. The honest split: where each one wins, what IKEv2 changes on mobile, and which one to self-host.

5 min readRead the article

A red emergency stop station on brushed metal: a yellow mushroom button marked EMERGENCY STOP under a clear hinged cover, an EMERGENCY CUT OFF TRIPPED indicator above it, and a black emergency phone panel to the right

Self-host VPN

2026-08-215 min

VPN kill switch test 2026: how to prove yours actually cuts

Your VPN app says the kill switch is on. That is a claim, not a proof. Four tests that show whether traffic really stops, and the three leaks a kill switch never covers.

Read

Two players at a dark desk under red and blue neon, the nearer one in a white t-shirt with a headset, hands on an orange-backlit mechanical keyboard and a mouse

Self-host VPN

2026-08-216 min

Self-hosted VPN for gaming 2026: when it helps, and when it just adds ping

A self-hosted VPN adds latency to a direct route. Here are the four cases where it still wins for gaming, the region rule that decides everything, and how to measure it yourself.

Read

Close-up of a dark screen showing colour-highlighted jQuery code that manipulates CSS padding on elements named header1 and header2

clusters.vpn-trust-audits

2026-08-205 min

Is NordVPN Safe? What a 30-Vendor Header Scan Can and Cannot Tell You

We scanned the public websites of 30 VPN vendors for the six recommended HTTP security headers. NordVPN scored 6 of 6. Two thirds of the field ship no Content-Security-Policy at all. Here is what that means, and the much larger part it does not mean.

Read

Extreme close-up of a perforated rack server front panel lit in deep blue, with a row of green and amber status LEDs and a round silver button, drive bays blurred underneath

Self-host VPN

2026-08-204 min

Headscale pricing (2026): the licence is free, the server is not

Headscale costs nothing to license - it is BSD-3-Clause. What you actually pay for is a server and your own time. And below six users, Tailscale's free plan is cheaper than any VPS.

Read

Row of antique skeleton keys hanging from small hooks on a dark wooden board, side lighting, background out of focus

Self-host VPN

2026-08-194 min

WireGuard: remove a peer without restarting, and make it stick (2026)

wg set peer remove takes effect instantly and disappears on the next wg-quick down/up. The difference between the running state and the config file, why the peer comes back, and the order of operations that actually revokes access.

Read

Close-up of a round chrome padlock hanging from a black metal gate frame, its shackle through a dark bracket and the keyhole facing the camera, against a blurred blue-grey background

Self-host VPN

2026-08-1718 min

Security Headers of 99 VPN and Privacy Websites, Measured (August 2026)

We scanned the homepages of 99 VPN providers, password managers, encrypted messengers and privacy tools for HTTP security headers. Three score 100/100; 22 declare none at all. Full table, published method, and the scanner so you can re-run it.

Read

A black and white PRIVATE PROPERTY NO TRESPASSING sign wired flat against a green chain-link fence, with a blank white strip along its lower edge, an out-of-focus orange building and dark green shrubs behind it

Self-host VPN

2026-08-175 min

90 of 100 Privacy Companies Have Never Named an AI Crawler in robots.txt (August 2026)

We read the robots.txt of 106 VPN, password manager, encrypted messaging and privacy-tool websites. Only ten have said anything at all about AI crawlers, and one addressed all eight. Full data, method and scanner published.

Read

A dense fibre patch panel shot straight on: rows of turquoise LC duplex couplers set in a black grid, with pale blue fibre cables and cream connector boots crossing the frame diagonally

Self-host VPN

2026-08-164 min

NetBird vs Headscale (2026): Your Own Stack, or Someone Else's Client

Both let you run the coordination server yourself. NetBird ships its own client and its own identity layer; Headscale reimplements Tailscale's server and leans on Tailscale's official apps. The choice is about which dependency you can live with.

Read

A fibre optic patch panel photographed at an angle: rows of turquoise LC adapters, dozens of white duplex connectors plugged in, and turquoise and yellow cables sweeping away in bundles to the left.

Self-host VPN

2026-08-144 min

Pangolin vs Cloudflare Tunnel (2026): Who Owns the Exit Point

Both let you expose a self-hosted service without opening a port on your router. The difference that decides it is who owns the machine your traffic exits from - Cloudflare's edge, or a VPS you rent and run yourself.

Read

Close-up of a 24-port gigabit switch, most ports empty, a few filled with black and white cables showing a lit green link light

Self-host VPN

2026-08-136 min

WireGuard Add Peer: Do It Live, Without Restarting the Tunnel

Adding a WireGuard peer does not require restarting anything. wg set applies a new peer to a running interface immediately, while wg-quick down/up drops every existing session. The command, what belongs in AllowedIPs, how to make it survive a reboot, and why the new peer usually fails to connect.

Read

Self-host VPN

2026-08-124 min

Twingate vs Tailscale (2026): Access to Resources, or Access to a Network

Tailscale connects your devices to each other. Twingate connects users to specific resources. They look like competitors and answer different questions - which is why picking the wrong one feels like fighting the product.

Read

Rack-mounted modules labelled PBI DMM-1701M with white Ethernet cables plugged into their RJ45 ports, amber link LEDs lit, and blue velcro ties gathering the cable runs.

Self-host VPN

2026-08-126 min

NetBird vs Tailscale (2026): The Control Plane Is the Whole Decision

NetBird and Tailscale build the same thing - a WireGuard mesh with automatic NAT traversal. They differ on one point that decides everything else: whether you can run the control plane yourself, with the same code the vendor runs.

Read

Don't feel like reading? Run the diagnostic.

5 minutes, no signup, and you see exactly what sites detect about you.

Run the diagnostic Get Contabo