Oracle Cloud Free Tier WireGuard VPN (2026): Setup, and Why It Sometimes Fails

Oracle Cloud's Always Free tier is one of the few genuinely free ways to run your own VPN on a real cloud server with a public IP. It is popular for exactly that reason. It is also the source of a lot of "why won't this work" frustration, because two OCI-specific quirks silently block WireGuard even when your config is perfect. Here is the honest, working version: how to set it up, the two things that trip almost everyone up, and where the free tier's limits actually bite.

What you get on Always Free

Oracle's Always Free resources do not expire the way a trial does. Every account gets a couple of small AMD micro instances (VM.Standard.E2.1.Micro), plus up to 4 Arm Ampere A1 cores and 24 GB of memory you can split across instances (VM.Standard.A1.Flex), and a generous 10 TB of outbound transfer per month. For a single-user WireGuard VPN that is far more than enough - the bottleneck will be your home connection, not the instance. So yes, the running cost really can be zero.

The setup, in order

The procedure itself is standard WireGuard, with two OCI-specific steps you cannot skip. Create an Always Free instance with a Ubuntu 22.04 image and your SSH key, and note its public IPv4. Then, before anything else on the networking side, open the port and fix the firewall.

The two things that silently break it

If you have ever searched "oracle cloud wireguard not working", it is almost certainly one of these two, and often both.

First, the security list. Your VCN's public subnet has a security list that acts as a stateful firewall at the network edge. WireGuard's UDP 51820 is not open by default, so you must add an ingress rule: source 0.0.0.0/0, protocol UDP, destination port 51820. Miss this and the packets never even reach your instance.

Second, and much less obvious, the instance firewall. Oracle's Ubuntu images do not ship with an empty firewall. They come with an iptables INPUT chain that rejects most inbound traffic, persisted via netfilter-persistent. So you can open the security list correctly and still get nothing, because the box itself drops the packet. The fix is to insert an ACCEPT rule for UDP 51820 above the reject line - sudo iptables -I INPUT 6 -p udp --dport 51820 -j ACCEPT - and save it with sudo netfilter-persistent save. Do both, and the WireGuard handshake completes on the first try.

Where the free tier's limits actually bite

Free is real, but it is not the same as dependable, and being honest about that saves you a bad afternoon later.

The first friction is capacity. The Arm Ampere A1 shape is the popular one, and "Out of host capacity" errors when you try to create it are common in busy regions. You can retry at off-peak times or pick a quieter availability domain, but the simplest fix is to use the Always Free AMD micro shape instead - it is smaller, but a single-user WireGuard tunnel does not need much.

The second is reclamation. Oracle's policy permits reclaiming idle Always Free compute, and a lightly used VPN can look idle. A VPN you use daily generally stays active enough to be fine, but it is a risk you do not control, and an interruption you did not schedule is exactly what you do not want from the tunnel you rely on.

When to move to a paid VPS

For a lot of people the honest path is: start on Oracle Always Free to learn the setup and prove it works, then move to a low-cost paid VPS once the VPN becomes something you depend on every day. A paid box removes the two things Oracle's free tier cannot promise - guaranteed capacity in the region you want, and no idle-reclamation risk - usually for only a few euros a month. If you reach that point, our self-hosted WireGuard VPN on Contabo guide walks through the same WireGuard setup on a paid box that is reliably yours.

Either way, the WireGuard configuration you learn here is identical. The only real difference between the free Oracle instance and a paid VPS is how much you can count on the server still being there tomorrow.