Disclosure: This article contains affiliate links. If you purchase through our links we may earn a commission at no extra cost to you. We only recommend services we would use ourselves, based on their published specs and public track record.
If you are about to rent a VPS to run your own VPN, the first question is almost always: how much RAM and CPU do I actually need? It is an easy place to overspend, because hosting pages love to upsell cores and gigabytes you will never use. The honest answer for a self-hosted VPN is that the compute requirements are modest, and the number that really matters is somewhere else entirely.
This guide sizes a VPN server the practical way: what the software genuinely needs, why the network port is the real constraint, how the protocol you pick changes the picture, and when it makes sense to buy more.
The short answer
For a personal or small-family VPN built on WireGuard, 1 vCPU and 1 GB of RAM is more than enough. WireGuard runs as a kernel module with lightweight ChaCha20-Poly1305 encryption, so a single core handles typical home throughput without breaking a sweat. The usual bottleneck is not the CPU or the RAM - it is the guaranteed bandwidth of the VPS. Size the network first, then the compute.
Why the CPU is rarely the bottleneck
A VPN server does one core job: encrypt packets on the way out and decrypt them on the way in. With WireGuard, that work happens inside the Linux kernel rather than in a user-space process, which keeps the overhead low. Modern CPUs also accelerate symmetric encryption in hardware - AES-NI for AES, and efficient instructions that ChaCha20 leans on - so per-packet crypto is cheap in CPU terms.
As a general rule, a single modern vCPU can encrypt far more traffic than an entry-level VPS is allowed to push out through its network port. That is the key insight: you usually run out of bandwidth long before you run out of CPU. Buying four cores for a two-device home VPN does not make the tunnel faster if the port is the limit.
That does not mean the CPU never matters. It matters when you have many peers active at once, when you push very high sustained throughput, or when you run a heavier protocol. But for the common case - a few devices, ordinary browsing and streaming - one vCPU is the right starting point.
How much RAM a VPN server actually uses
RAM is the spec people overestimate the most. The WireGuard module itself has a small memory footprint; the bulk of your RAM budget goes to the operating system, the firewall (such as UFW or nftables), and any monitoring you add. A minimal Linux server running WireGuard sits comfortably inside 1 GB, with room to spare.
You need more memory only when the same VPS does more than terminate the VPN. Running a database, a stack of containers, a web application, or a self-hosted dashboard alongside the tunnel is what pushes you toward 2 GB or more. If the box is a dedicated VPN endpoint, 1 GB is a sensible, honest figure to plan around.
The spec that really matters: bandwidth
If CPU and RAM are usually oversized, what should you actually shop for? The network. Two figures decide how a self-hosted VPN feels in daily use:
- Guaranteed port speed in Mbps - how fast the VPS can move traffic
- Monthly traffic allowance - how much data you can transfer before caps or overage kick in
Encryption adds a small overhead on top of your raw traffic, but it is a modest percentage, not a doubling. What limits everyday performance is the port speed and, over a month, the traffic allowance. A household that streams high-resolution video through the tunnel can move a large amount of data, so a generous or unmetered traffic policy matters as much as raw Mbps. We break the providers down on exactly this metric in our cheapest VPS for WireGuard comparison, where price-per-Mbps and traffic allowance decide the ranking rather than core counts.
Protocol matters: WireGuard vs OpenVPN
The protocol you choose changes the resource maths. WireGuard is deliberately small: it runs in kernel space, spreads work across cores well, and uses less CPU per megabit. OpenVPN is older, runs in user space, and is largely single-threaded, so it consumes more CPU for the same throughput and can bottleneck on a single core before the network port does.
The practical takeaway: on identical hardware, WireGuard leaves you more headroom. If you are building fresh and want the lightest footprint per euro of VPS, WireGuard is the efficient default. If you must run OpenVPN for compatibility reasons, budget a little more CPU margin and expect the core, not the port, to be your limit at high throughput. For the full picture, see our WireGuard vs OpenVPN throughput and latency comparison.
When you genuinely need more
There are real cases where the modest baseline is not enough. Size up when:
- Many simultaneous users. A tunnel shared by a large household or a small team means more concurrent peers and more aggregate traffic. This pushes both the port speed and, eventually, the CPU.
- Sustained high throughput. If several people stream 4K or move large files through the tunnel at once, you want a higher guaranteed port speed and a generous traffic allowance far more than extra cores.
- You run OpenVPN. As above, its single-threaded, user-space design uses more CPU per megabit, so leave more headroom.
- The VPS does other jobs. Hosting containers, a database, or a web app on the same machine is what actually justifies 2 GB of RAM or more.
In all of these, the right move is usually a plan with a faster port and a bigger traffic allowance, not simply a bigger core count. If you are still deciding what a VPS even is and how it maps to these specs, our explainer what is a VPS walks through the terms.
A sensible starting configuration
Put it together and a self-hosted WireGuard VPN for a person or a small household sizes like this, as a general rule:
- CPU: 1 vCPU is enough for typical home throughput
- RAM: 1 GB for a dedicated VPN endpoint; more only if other services share the box
- Bandwidth: prioritise a solid guaranteed port speed and a generous or unmetered traffic allowance
- Disk: a few gigabytes covers the OS, WireGuard, and logs
The reassuring conclusion is that you do not need an expensive machine. An affordable VPS comfortably covers a personal VPN, which is why a low-cost provider like Contabo is a common, honest choice for this exact job - the entry plans already exceed what WireGuard asks for, and the traffic policy is generous enough for a streaming household. When you are ready to build it, our step-by-step self-host a VPN on Contabo with WireGuard guide walks through the whole setup.
Spin up an affordable VPS for your VPN → Contabo
Bottom line
Do not overbuy. For a self-hosted VPN, WireGuard on 1 vCPU and 1 GB of RAM is a solid baseline; the protocol is light, the CPU is rarely the limit, and the RAM is mostly for the OS. Spend your attention - and your budget - on guaranteed bandwidth and traffic allowance, which is what you will actually feel day to day. Add CPU, RAM, or a faster port only when your real workload (more users, higher throughput, OpenVPN, or extra services) demands it.
Start with an affordable VPS → Contabo
★ Nuremberg GDPR datacenter · ✓ Dedicated IPv4 included · 200+ Mbps guaranteed
Spin up the VPS from this guide → ContaboPublic IPv4 · full root · EU & US locations→
