PiVPN 2026: self-host WireGuard or OpenVPN in one command

Self-hosting a VPN used to mean hand-editing config files and hoping you got the keys, routing and firewall right. PiVPN removes almost all of that: it is a one-command installer that sets up WireGuard or OpenVPN on a Raspberry Pi or any Debian/Ubuntu VPS, then manages your client devices with a few simple commands. This guide covers how it works, the install, the honest limits, and where it fits versus the mesh VPNs.

What is PiVPN, and what is it not?

PiVPN is a wrapper/installer, not a new protocol. It configures the real, well-audited VPN software for you:

• Pick WireGuard (recommended in 2026) or OpenVPN during setup.
• It handles keys, server config, routing and firewall rules with sane defaults.
• Manage clients with pivpn add, pivpn -qr (QR code for phones), and pivpn -l to list profiles.

It gives you a classic single VPN server: every device connects back to that one machine. That simplicity is its strength. If you'd rather hand-write the wg0.conf yourself instead of relying on the installer's defaults, our ready-to-use WireGuard config templates cover the same single-server setup plus split-tunnel, kill-switch and multi-peer variants you can paste and adapt.

Your VPN hides your IP. It does not hide your browser.

A correctly configured WireGuard tunnel replaces the address a site sees. It changes nothing about what your browser announces on its own: fonts, screen, time zone, graphics stack. That combination is often unique enough to follow you across sessions, tunnel or no tunnel.

Measure your own browser fingerprint, passive, no questions, no account, no email. It tells you how many browsers out of N look like yours, and which attribute makes you stand out.

Should you run PiVPN on a Raspberry Pi or a VPS?

The short answer: a Pi if you want back into your own home network, a VPS if you want a fast exit point. They solve different problems, and running both is common.

• Raspberry Pi at home → a tunnel back into your home network; depends on your home upload speed and a stable public IP / dynamic DNS. See our Raspberry Pi 5 self-host guide.
• Cloud VPS → a fast, always-on private exit point with a fixed public IP, for a few euros a month - ideal for remote access while travelling. A Contabo Cloud VPS 10 at €5.50/month handles personal VPN traffic comfortably.

How do you install PiVPN in one command?

On a fresh Debian/Ubuntu host:

# review the script before running it (open the URL in a browser first)
curl -L https://install.pivpn.io | bash

The guided installer asks for the protocol (choose WireGuard), the network interface, a static IP, the DNS provider, and the public endpoint (IP or domain). When it finishes, add your first client:

pivpn add            # create a client profile
pivpn -qr            # show a QR code to import on a phone

Always open and read an install script before piping it to bash. For base VPS hardening that applies here too, see the Contabo VPS setup guide, and for the protocol choice, WireGuard vs OpenVPN.

Is PiVPN free?

Yes, entirely. PiVPN is open-source software installed on a machine you already control, with no account, no licence tier and no per-device charge. The only thing you pay for is the machine it runs on: nothing at all if you reuse a Raspberry Pi you already own, or the monthly cost of a small VPS if you want a fixed public IP and an always-on exit point.

That is the whole cost model, and it is what separates a self-hosted tunnel from a commercial VPN subscription, you are buying hardware or hosting, not a service. What it does not buy you is the shared-IP anonymity of a commercial provider: your tunnel exits from an address that belongs to you alone.

How do you add and remove PiVPN clients?

Once you pass three or four clients, the failures stop being obvious. Two devices handed the same address both work alone, and the second to connect displaces the first, which looks like an intermittent server fault and is not one. We wrote wg-clients-audit to read a folder of generated .conf files and report exactly that: duplicate addresses, a private key reused across two devices, and AllowedIPs ranges broad enough to swallow the client's own LAN.

pivpn add covers the first profile; the rest of daily use is three more commands:

pivpn list           # every profile, and which are enabled
pivpn -qr <name>     # re-display a profile QR code
pivpn revoke <name>  # disable a lost or retired device

Revoking matters more than people expect. A WireGuard peer stays valid until you remove it, so a phone that was lost or a laptop that left the company keeps a working key until someone runs that command. Generated profiles live under the home directory of the install user, treat those files like passwords, because that is what they are.

Why does my PiVPN connect but carry no traffic?

Almost every "it installed fine but I cannot connect from outside" case comes down to one of two causes, and neither is PiVPN's fault. If the second one applies to you, the fix is not a setting: it is a different tool, and that comparison is PiVPN vs Tailscale.

The port is not reachable. WireGuard listens on UDP, and a home router will not forward it unless you tell it to. You need a port-forwarding rule sending that UDP port to the Pi's local address, and the Pi needs a fixed local IP so the rule keeps pointing at it. If your ISP puts you behind CGNAT, no rule will help, that case is covered in our guide to WireGuard behind CGNAT.

The public address moved. Most residential connections get a dynamic IP, so the endpoint baked into a client profile stops matching after the next renewal. A dynamic-DNS hostname in place of a raw IP fixes it permanently, and it is worth setting up before you distribute profiles rather than after.

If the tunnel comes up but no traffic passes, the cause is usually elsewhere: our handshake troubleshooting guide walks the eight causes in order of likelihood.

What are the limits of PiVPN?

• Single server, not a mesh. Every client routes through that one box. Great for a personal exit node; not built for meshing many devices and sites.
• You own the maintenance. Patching, key rotation, firewall and uptime are yours - keep unattended security updates on.
• Home-hosting caveats. On a Raspberry Pi, your upload speed caps throughput and you need a stable public IP or dynamic DNS.
• It is a wrapper. Security comes from WireGuard/OpenVPN and your host hygiene, not from PiVPN itself.

PiVPN vs Tailscale: which one should you choose?

If you need a mesh instead of a single server, see our NetBird self-host guide and the best self-hosted VPN 2026 overview.

The bottom line

PiVPN is the fastest, simplest way to stand up your own WireGuard or OpenVPN server in 2026 - on a Raspberry Pi for home access, or on a cheap VPS for an always-on private exit point. Choose it when you want one clean personal server; reach for a mesh VPN when you need many nodes connected. Either way, you own the server and the keys.

Once the server is up, the day-to-day work is adding and revoking peers: see managing PiVPN clients for pivpn add, pivpn -qr, revocation and what actually breaks when you get it wrong.

Spin up a Contabo VPS for PiVPN →

Editorial guide based on PiVPN's documented installer behaviour and the documented properties of WireGuard and OpenVPN. Security depends on the underlying protocols and your host hygiene, which we state plainly. Commercial links carry the rel="sponsored nofollow" attribute; an affiliate commission may apply at no extra cost to you.