PiVPN in 2026: the easiest way to self-host WireGuard or OpenVPN

Self-hosting a VPN used to mean hand-editing config files and hoping you got the keys, routing and firewall right. PiVPN removes almost all of that: it is a one-command installer that sets up WireGuard or OpenVPN on a Raspberry Pi or any Debian/Ubuntu VPS, then manages your client devices with a few simple commands. This guide covers how it works, the install, the honest limits, and where it fits versus the mesh VPNs.

What PiVPN is (and isn't)

PiVPN is a wrapper/installer, not a new protocol. It configures the real, well-audited VPN software for you:

Pick WireGuard (recommended in 2026) or OpenVPN during setup.
It handles keys, server config, routing and firewall rules with sane defaults.
Manage clients with pivpn add, pivpn -qr (QR code for phones), and pivpn -l to list profiles.

It gives you a classic single VPN server: every device connects back to that one machine. That simplicity is its strength. If you'd rather hand-write the wg0.conf yourself instead of relying on the installer's defaults, our ready-to-use WireGuard config templates cover the same single-server setup plus split-tunnel, kill-switch and multi-peer variants you can paste and adapt.

Raspberry Pi or VPS?

Raspberry Pi at home → a tunnel back into your home network; depends on your home upload speed and a stable public IP / dynamic DNS. See our Raspberry Pi 5 self-host guide.
Cloud VPS → a fast, always-on private exit point with a fixed public IP, for a few euros a month - ideal for remote access while travelling. A Contabo Cloud VPS 10 at €5.50/month handles personal VPN traffic comfortably.

Installing PiVPN

On a fresh Debian/Ubuntu host:

# review the script before running it (open the URL in a browser first)
curl -L https://install.pivpn.io | bash

The guided installer asks for the protocol (choose WireGuard), the network interface, a static IP, the DNS provider, and the public endpoint (IP or domain). When it finishes, add your first client:

pivpn add            # create a client profile
pivpn -qr            # show a QR code to import on a phone

Always open and read an install script before piping it to bash. For base VPS hardening that applies here too, see the Contabo VPS setup guide, and for the protocol choice, WireGuard vs OpenVPN.

The honest limits

Single server, not a mesh. Every client routes through that one box. Great for a personal exit node; not built for meshing many devices and sites.
You own the maintenance. Patching, key rotation, firewall and uptime are yours - keep unattended security updates on.
Home-hosting caveats. On a Raspberry Pi, your upload speed caps throughput and you need a stable public IP or dynamic DNS.
It is a wrapper. Security comes from WireGuard/OpenVPN and your host hygiene, not from PiVPN itself.

PiVPN vs the mesh VPNs

	PiVPN	Tailscale / Headscale / NetBird
Model	Single VPN server	Peer-to-peer mesh
Best for	Personal exit node, remote access	Many devices/sites connected together
Setup	One installer, very simple	More components (coordinator, etc.)
Protocol	WireGuard or OpenVPN	WireGuard-based

If you need a mesh instead of a single server, see our NetBird self-host guide and the best self-hosted VPN 2026 overview.

The bottom line

PiVPN is the fastest, simplest way to stand up your own WireGuard or OpenVPN server in 2026 - on a Raspberry Pi for home access, or on a cheap VPS for an always-on private exit point. Choose it when you want one clean personal server; reach for a mesh VPN when you need many nodes connected. Either way, you own the server and the keys.

Spin up a Contabo VPS for PiVPN →

Editorial guide based on PiVPN's documented installer behaviour and the documented properties of WireGuard and OpenVPN. Security depends on the underlying protocols and your host hygiene, which we state plainly. Commercial links carry the rel="sponsored nofollow" attribute; an affiliate commission may apply at no extra cost to you.

★ Nuremberg GDPR datacenter · ✓ Dedicated IPv4 included · 200+ Mbps guaranteed

Self-host your VPN on your own VPS → ContaboFull root access · public IPv4 · pick your region→

Frequently asked questions

What is PiVPN exactly?

PiVPN is a free, open-source installer script that sets up a personal VPN server - either WireGuard or OpenVPN - on a Debian or Ubuntu machine. It was created for the Raspberry Pi (hence the name) but runs on any Debian-based system, including a cheap cloud VPS. A single command walks you through a guided install, then simple commands like 'pivpn add' create client profiles with ready-to-scan QR codes. It is a wrapper that configures the underlying VPN correctly for you, not a new VPN protocol.

Does PiVPN use WireGuard or OpenVPN?

Both - you choose during installation. In 2026 the recommended default is WireGuard: it is faster, has a smaller codebase, connects almost instantly and uses less battery on mobile. OpenVPN remains an option when you need to traverse restrictive networks that block WireGuard's UDP, or for compatibility with older clients. PiVPN configures whichever you pick with sane defaults, so you get a correct setup without hand-writing config files.

Can I run PiVPN on a VPS instead of a Raspberry Pi?

Yes, and for remote access it is often the better choice. A Raspberry Pi at home gives you a tunnel back to your home network, but depends on your home upload speed and a stable public IP or dynamic DNS. A cloud VPS gives a fast, always-on server with a fixed public IP for a few euros a month - ideal if your goal is a private exit point or remote access while travelling. PiVPN installs identically on a Debian/Ubuntu VPS.

Is PiVPN secure and still maintained?

PiVPN is open-source and configures well-audited protocols (WireGuard, OpenVPN) with reasonable defaults, so the security rests on those mature foundations rather than on PiVPN itself. As with any single-server VPN, your security depends on keeping the host patched, using key-based SSH, a firewall, and unattended security updates. Always review the install script before piping it to bash, and keep the OS and VPN packages updated.

PiVPN vs Tailscale, Headscale or NetBird - which should I choose?

Different models. PiVPN gives you a classic single VPN server: every client connects to that one box. It is the simplest mental model and perfect for a personal exit node or remote access. Tailscale, Headscale and NetBird are mesh VPNs where devices connect peer-to-peer with a coordination server - better for connecting many devices and sites together. Choose PiVPN for a straightforward personal server; choose a mesh if you need many nodes meshed across locations.