BLOG · FIELD NOTES

VPNSmith Guides & Comparisons

Understand how a WireGuard tunnel works, what a GDPR VPS truly costs, and how to forge your own infra. Long-form, sourced, kept up to date.

All · 115 VPS Comparisons · 10 Self-host VPN · 75 Tunneling & Obfuscation · 13 clusters.self-host-vpn-head · 9 clusters.vpn-trust-audits · 1 clusters.commercial-vpn · 2 clusters.vps-hosting · 3 clusters.wireguard · 1 Cloud Privacy · 1

A data centre aisle lined with tall dark server cabinets, with a workstation cart in the foreground holding a monitor, a keyboard and a mouse

FeaturedVPS Comparisons2026-10-15

Contabo vs DigitalOcean (2026): Fixed Monthly Box or Per-Second Cloud for Your VPN?

Contabo and DigitalOcean compared on the figures both publish: Contabo's Cloud VPS plans read on 13 October 2026, DigitalOcean's Basic Droplets, billing, transfer allowance and backups read on 14 October 2026. Which one fits a self-hosted WireGuard server, and when the other wins.

5 min readRead the article

A woman in black holding an open laptop leans against the glass wall of a server room lit in blue, her reflection visible in the glass, with an office corridor stretching behind her

VPS Comparisons

2026-10-146 min

Contabo vs Hostinger VPS (2026): Entry Price, Renewal Price, and What You Get

Contabo and Hostinger VPS plans compared on the figures both hosts displayed on 13 October 2026: resources, traffic, port speed, backups, and the renewal price that follows Hostinger's introductory rate. With a verdict for a self-hosted VPN.

Read

Close-up of two rack servers stacked one above the other, seen at an angle: rows of drive bays with small green status lights, perforated metal front panels, background out of focus

VPS Comparisons

2026-10-136 min

Contabo vs netcup (2026): Which VPS for a Self-Hosted VPN?

Contabo and netcup are two German VPS hosts with very different entry plans. Prices, resources, contract terms and datacenter locations read on both official pages on 13 October 2026, and what each one means for a self-hosted WireGuard server.

Read

Close-up of a black network patch panel with numbered ports, bundles of bright blue Ethernet cables with white connectors plugged in and looping through metal cable guides, the background blurred into blue and teal lights

Self-host VPN

2026-10-088 min

Headscale vs WireGuard (2026): One Is the Tunnel, the Other Hands Out the Keys

Headscale does not replace WireGuard: it coordinates it. Plain WireGuard means writing every peer by hand; Headscale distributes keys, addresses and routes to Tailscale clients. What each one requires, what Headscale's own documentation says it is not, and how to choose.

Read

An aisle inside a data center: rows of tall black mesh-door server cabinets with blue cabling on the right, a polished concrete floor, and a mobile cart carrying a monitor at the far end

Tunneling & Obfuscation

2026-10-076 min

Best VPS for V2Ray and Xray in 2026: What Actually Matters (and What Doesn't)

V2Ray and Xray run on almost any VPS. The choice is decided by datacenter location, IP reputation, traffic allowance and how fast you can replace a blocked IP. Contabo, Hetzner and Oracle's free tier compared on those criteria, with figures read on their official pages in October 2026.

Read

The rear panel of a white network device labeled eth0 to eth3, with grey and orange ethernet cables plugged in and green link LEDs lit

clusters.self-host-vpn-head

2026-09-265 min

Tailscale Subnet Router: Reach Your Whole LAN Without Installing Tailscale Everywhere (2026)

A subnet router advertises your local network's routes to your tailnet, so printers, NAS boxes and IoT devices become reachable without running Tailscale on them. The exact commands, the admin console approval step everyone misses, the accept-routes flag on Linux, and the overlapping-subnet trap.

Read

A long corridor of server racks in a data centre, blue LED lights glowing from the front panels of each rack, cable trays running along the ceiling

clusters.self-host-vpn-head

2026-09-206 min

Tailscale vs WireGuard: What Tailscale Adds, What It Takes Away (2026)

Tailscale is built on WireGuard, so the comparison is not protocol vs protocol. It is raw WireGuard (you manage keys, routes and NAT yourself) vs Tailscale (a managed control plane that does it for you). Here is what you gain, what you give up, and which one fits your situation.

Read

A round blue road sign with a white arrow pointing right, mounted on a slim metal pole against a weathered wall of peeling grey and ochre plaster

Self-host VPN

2026-09-064 min

wg-quick: resolvconf: command not found. The DNS Line Needs a Program You Do Not Have

wg-quick does not set DNS itself. It shells out to resolvconf, and on a minimal server that binary is simply absent. Three ways to fix it, and the one that is right depends on what already manages your resolver.

Read

A chrome lock cylinder lying on a red surface surrounded by its dismantled parts, a dozen flat brass pins and small coiled springs scattered around it under pinkish light

Self-host VPN

2026-09-064 min

WireGuard: Required key not available. Four Causes, and the Error Names None of Them

The kernel is saying it received a packet on a WireGuard interface and had no key able to decrypt it. That is one sentence with four very different causes, and the message deliberately tells you nothing about which one applies. Here is how to find out in three commands.

Read

Close-up of a rusty metal gate latch with four padlocks of different sizes hanging from the bolt, one brass, one grey, one blue and red, against a blurred dirt background

Self-host VPN

2026-09-064 min

WireGuard: Unable to Access Interface: Operation Not Permitted

wg-quick stops on Unable to access interface: Operation not permitted, and the usual advice is to add sudo. Often sudo is already there. The message covers four distinct causes, from a missing capability in a container to a config file the tool refuses to read, and each one has its own check.

Read

Three chrome lock cylinders lined up in the foreground with keys in them, a key cutting machine and a person's hands working behind them out of focus

Self-host VPN

2026-09-063 min

Two Devices, One WireGuard Key: What Actually Breaks, and Why It Looks Random

Copying one client config onto a phone and a laptop works until both are connected. Then traffic goes to whichever handshook last, the server cannot tell them apart, and you cannot revoke one without cutting the other. What the protocol does, and the fix in three commands.

Read

Three measuring tools laid side by side on a white background, a yellow tape measure with inch and centimetre scales, a pale grey folding meter rule, and a steel ruler with fine engraved graduations

Self-host VPN

2026-09-064 min

WireGuard: Key Is Not the Correct Length or Format

A WireGuard key is 32 bytes written as 44 base64 characters ending in an equals sign. The error means what you pasted is not that, and the cause is almost always invisible: a trailing newline, a wrapped line, a key echoed with a shell prompt, or a public key sitting where a private one belongs.

Read

Self-host VPN

2026-09-064 min

wg-quick: Bad address. The Line Is Almost Always Missing Its Prefix

One error, and four ways to produce it: a missing CIDR suffix, a host address written where a network was meant, an IPv6 form the tool will not take, or an Endpoint that no longer resolves. How to tell which one you have before changing anything.

Read

Don't feel like reading? Run the diagnostic.

5 minutes, no signup, and you see exactly what sites detect about you.

Run the diagnostic Get Contabo