WireGuard on DigitalOcean (2026): Your Own VPN on a $4 Droplet

The essentials

A DigitalOcean Droplet is one of the simplest places to run your own WireGuard VPN. The cheapest Basic Droplet is enough for personal use, the setup takes about fifteen minutes, and per-second billing means a server you only need for a trip costs only the hours it exists.

On 17 October 2026, DigitalOcean's pricing page listed the plans that matter for a VPN like this:

For one person, the $4 Droplet is enough. WireGuard runs inside the Linux kernel and needs very little memory. Pick the $6 plan if several people will share the server or if you stream a lot, because the transfer allowance doubles.

How the billing works, and why it matters for a VPN

DigitalOcean states that Droplets are billed per second since 1 January 2026, with a minimum charge of 60 seconds or $0.01, and that bundled plans never cost more than their monthly price. Two consequences:

• A trip VPN costs almost nothing. Create a Droplet in the city you need, use it for a week, destroy it. You pay for that week only.
• Powering off is not stopping. A switched-off Droplet still exists and is still billed. To stop paying, destroy it (take a snapshot first if you want to recreate it later).

The allowance counts outbound transfer only; DigitalOcean says inbound is always free. On a VPN server, the files you download through the tunnel leave the Droplet towards your device, so your own downloads are what use up the 500 GiB.

Step 1: create the Droplet

1. Create a Droplet with Ubuntu 24.04 LTS (WireGuard is in the kernel, no extra module to build).
2. Choose the region where you want your traffic to appear. DigitalOcean lists San Francisco, Richmond, New York City, Kansas City, Atlanta, Toronto, Amsterdam, London, Frankfurt, Bangalore, Singapore and Sydney.
3. Pick the $4 Basic plan and add your SSH key rather than a password.
4. Note the Droplet's public IPv4 address: it will be the Endpoint of your clients.

Step 2: install WireGuard and write the server config

Connect over SSH and install WireGuard:

apt update && apt install -y wireguard

The fastest way to get matching configs is our free WireGuard config generator: enter the Droplet's IP, choose the number of clients, and it writes the server config and one config per client in your browser, with the keys generated locally and a QR code for each phone. Paste the server part into /etc/wireguard/wg0.conf.

If you prefer to do it by hand, generate a key pair with wg genkey | tee server.key | wg pubkey > server.pub and follow our WireGuard config templates.

Step 3: forwarding, firewall and start

Allow the server to route traffic for its clients:

echo "net.ipv4.ip_forward=1" > /etc/sysctl.d/99-wireguard.conf
sysctl --system

Open the WireGuard port and keep SSH open (51820/udp is the default; see which WireGuard port to use):

ufw allow OpenSSH
ufw allow 51820/udp
ufw enable

Make sure your wg0.conf contains the NAT rules so client traffic leaves through the Droplet's public interface (on DigitalOcean it is usually eth0; check with ip route):

PostUp = iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

Then start the tunnel and enable it at boot:

systemctl enable --now wg-quick@wg0
wg show

Import the client config on your phone (QR code) or computer, connect, and check that your public IP is now the Droplet's. If the client shows no handshake, our handshake troubleshooting guide walks through the causes in order.

DigitalOcean or a monthly VPS?

DigitalOcean is the better tool when the server is temporary or moves around: per-second billing and twelve locations make it ideal for a VPN you create for a trip and destroy afterwards. For one server you keep for months, a monthly VPS such as a Contabo Cloud VPS gives more CPU, RAM and transfer for a similar price. We compare the two plan by plan in Contabo vs DigitalOcean.

See DigitalOcean's current Droplet pricing · See the current Contabo Cloud VPS plans