Self-host wg-easy

VPN & Mesh Networking

deployed & timed by usprices checked · Jul 2026

The easiest way to run your own WireGuard VPN server, with a clean web UI for adding and managing clients — a self-hosted alternative to Tailscale and commercial VPNs for private access to your network from anywhere.

Tailscale / yr$96

Self-hosted / yr~$55

You keep$41/yr

Pocket the difference — spin it up on a cheap VPS in minutes.Start free on Kamatera →

Key facts

CategoryVPN & Mesh Networking

LicenseAGPL-3.0

StackTypeScript, Node.js

Min RAM256 MB

Dockeryes

Difficulty

What you need

Any VPS with at least 256 MB of RAM
A domain you control — most self-hosted setups need HTTPS in front of them
Under an hour if you've used Docker before

Install

Run these commands on your server:

# wg-easy — single container; web UI on 51821/tcp, tunnel on 51820/udp
# The /lib/modules mount is required — without it wg0 never comes up.
docker run -d --name wg-easy --restart unless-stopped \
  -e INIT_ENABLED=true -e INIT_HOST=vpn.example.com \
  -v ./etc_wireguard:/etc/wireguard \
  -v /lib/modules:/lib/modules:ro \
  -p 51820:51820/udp -p 51821:51821/tcp \
  --cap-add NET_ADMIN --cap-add SYS_MODULE ghcr.io/wg-easy/wg-easy:15

deploy guideHow to Deploy wg-easy on a VPS vps picksBest VPS for self-hostingbenchmarked quarterly · re-priced monthly

An alternative to

Tailscale →

Head-to-head

VPNJul 2026

wg-easy

Headscale

The simplest WireGuard VPN vs. your own Tailscale mesh.

Read the verdict →

More in VPN & Mesh Networking

VPN & Mesh NetworkingHeadscale

An open-source, self-hosted implementation of the Tailscale control server — run your own coordination plane for a private WireGuard mesh and keep using the official Tailscale clients, without depending on Tailscale's hosted service.

moderateRead guide →

VPN & Mesh NetworkingNetBird

An open-source WireGuard-based mesh VPN that connects your devices, servers, and clouds into a single private network with SSO and access controls — a self-hostable alternative to Tailscale and Twingate. The client is BSD-3-licensed; the self-hosted control-plane components (management, signal, relay) are AGPL-3.0.

hardRead guide →

VPN & Mesh NetworkingPangolin

A self-hosted tunneled reverse proxy that exposes services on your private network to the internet over WireGuard, with built-in identity, access control, and automatic SSL. A self-hostable alternative to Cloudflare Tunnel that keeps the ingress on a server you own.

TypeScriptGo