BLOG · FIELD NOTES

VPNSmith Guides & Comparisons

Understand how a WireGuard tunnel works, what a GDPR VPS truly costs, and how to forge your own infra. Long-form, sourced, kept up to date.

All · 117 VPS Comparisons · 12 Self-host VPN · 75 Tunneling & Obfuscation · 13 clusters.self-host-vpn-head · 9 clusters.vpn-trust-audits · 1 clusters.commercial-vpn · 2 clusters.vps-hosting · 3 clusters.wireguard · 1 Cloud Privacy · 1

Close-up of a black network patch panel with numbered ports, bundles of bright blue Ethernet cables with white connectors plugged in and looping through metal cable guides, the background blurred into blue and teal lights

FeaturedSelf-host VPN2026-10-08

Headscale vs WireGuard (2026): One Is the Tunnel, the Other Hands Out the Keys

Headscale does not replace WireGuard: it coordinates it. Plain WireGuard means writing every peer by hand; Headscale distributes keys, addresses and routes to Tailscale clients. What each one requires, what Headscale's own documentation says it is not, and how to choose.

8 min readRead the article

A round blue road sign with a white arrow pointing right, mounted on a slim metal pole against a weathered wall of peeling grey and ochre plaster

Self-host VPN

2026-09-064 min

wg-quick: resolvconf: command not found. The DNS Line Needs a Program You Do Not Have

wg-quick does not set DNS itself. It shells out to resolvconf, and on a minimal server that binary is simply absent. Three ways to fix it, and the one that is right depends on what already manages your resolver.

Read

A chrome lock cylinder lying on a red surface surrounded by its dismantled parts, a dozen flat brass pins and small coiled springs scattered around it under pinkish light

Self-host VPN

2026-09-064 min

WireGuard: Required key not available. Four Causes, and the Error Names None of Them

The kernel is saying it received a packet on a WireGuard interface and had no key able to decrypt it. That is one sentence with four very different causes, and the message deliberately tells you nothing about which one applies. Here is how to find out in three commands.

Read

Close-up of a rusty metal gate latch with four padlocks of different sizes hanging from the bolt, one brass, one grey, one blue and red, against a blurred dirt background

Self-host VPN

2026-09-064 min

WireGuard: Unable to Access Interface: Operation Not Permitted

wg-quick stops on Unable to access interface: Operation not permitted, and the usual advice is to add sudo. Often sudo is already there. The message covers four distinct causes, from a missing capability in a container to a config file the tool refuses to read, and each one has its own check.

Read

Three chrome lock cylinders lined up in the foreground with keys in them, a key cutting machine and a person's hands working behind them out of focus

Self-host VPN

2026-09-063 min

Two Devices, One WireGuard Key: What Actually Breaks, and Why It Looks Random

Copying one client config onto a phone and a laptop works until both are connected. Then traffic goes to whichever handshook last, the server cannot tell them apart, and you cannot revoke one without cutting the other. What the protocol does, and the fix in three commands.

Read

Three measuring tools laid side by side on a white background, a yellow tape measure with inch and centimetre scales, a pale grey folding meter rule, and a steel ruler with fine engraved graduations

Self-host VPN

2026-09-064 min

WireGuard: Key Is Not the Correct Length or Format

A WireGuard key is 32 bytes written as 44 base64 characters ending in an equals sign. The error means what you pasted is not that, and the cause is almost always invisible: a trailing newline, a wrapped line, a key echoed with a shell prompt, or a public key sitting where a private one belongs.

Read

Self-host VPN

2026-09-064 min

wg-quick: Bad address. The Line Is Almost Always Missing Its Prefix

One error, and four ways to produce it: a missing CIDR suffix, a host address written where a network was meant, an IPv6 form the tool will not take, or an Endpoint that no longer resolves. How to tell which one you have before changing anything.

Read

Close-up at a shallow angle of four black drive bays in a desktop storage enclosure, their locks and slots receding out of focus against a white background

Self-host VPN

2026-09-054 min

WireGuard on TrueNAS: Three Places to Put It, and Only One Survives an Update

TrueNAS gives you an app, a jail or a virtual machine, and the difference is not convenience. It decides what happens to your tunnel the next time the system updates, and whether the NAS itself is reachable when the tunnel is the only way in.

Read

The back of a tall metal signpost against a clear blue sky, six blank arrow shaped panels pointing in different directions, stacked one above another and lit from the side

Self-host VPN

2026-09-054 min

WireGuard Split DNS: Send Only Your Internal Domains Through the Tunnel

WireGuard's DNS option is all or nothing: set it and every lookup goes to the tunnel resolver. Sending only your internal zone there, and leaving the rest on your normal resolver, needs a piece WireGuard does not have. Here are the three ways to add it.

Read

The corner of a dark smartphone lying on a white surface, its screen showing a large black QR code on a bright blue background, the phone tilted so the code runs diagonally out of frame

Self-host VPN

2026-09-054 min

WireGuard QR Code: Generate One in a Second, and Handle It Like a Private Key

One qrencode command turns a client config into a QR code the mobile app reads instantly. It is also the fastest way to leak a private key, because a QR code left in a terminal buffer or a screenshot is the config, in full, readable by anything with a camera.

Read

A bank of rack mounted blade servers photographed head on and lit entirely in deep blue, their perforated front panels and rows of small green status lights filling the frame

Self-host VPN

2026-09-054 min

WireGuard on Proxmox: Host, VM or LXC, and Why the Container Route Bites

Three places to run WireGuard on a Proxmox box, and they are not equivalent. The host is simplest, a VM is cleanest, and an LXC container needs TUN passed through before wg-quick will even start. What each one costs you.

Read

Two brass padlocks hanging side by side on the hasps of a metal door painted in bold orange and yellow graffiti, their shackles through matching loops

Self-host VPN

2026-09-054 min

WireGuard Preshared Key: What It Adds, and Why It Is Not a Password

The preshared key is optional, it takes one command to generate, and almost every guide either skips it or misdescribes it as extra authentication. It is neither. It is a hedge against a future attacker with a quantum computer, and here is how to add one without breaking a live tunnel.

Read

A line of interlocking white and orange plastic road barriers blocking a paved passageway between two grey concrete buildings, sunlight falling across the ground in front of them

Self-host VPN

2026-09-054 min

WireGuard PostUp and PostDown iptables Rules: What Each Line Is For

Every WireGuard server config on the internet carries the same four iptables lines, copied without explanation. Here is what each one does, which of them you can drop, and the two mistakes that make a tunnel connect and then carry nothing.

Read

Don't feel like reading? Run the diagnostic.

5 minutes, no signup, and you see exactly what sites detect about you.

Run the diagnostic Get Contabo