You may have seen a lot of online advertisements for paid VPN services. However, as we discussed in a previous article, tunneling all your internet traffic through a VPN service is not a good idea.
Contrary to what their websites say, VPN companies usually don't care about protecting your privacy. These companies can see all of your web browsing history as they handle your internet traffic and DNS requests. We may also store logs of your IP address and connection history. This means this data can be passed on to authorities or stolen by cybercriminals.
In most cases, you don't need to enable a VPN connection before you can browse the web, as nearly all websites are delivered to your browser over a secure, encrypted connection (known as HTTPS).
However, depending on your risk profile, also known as your threat model, a VPN may be useful. You may not be able to access your website from a public network because the public network is blocked. Or maybe you're traveling to a country where the content you want to access, such as news, music, or video streaming services, isn't available. In these cases, it's important to minimize the risks when using a VPN.
That's why we'll show you a few different ways to set up your own encrypted VPN server at home or in a nearby data center.
Easy: Run Tailscale on a spare computer at home
Tailscale allows you to easily create a virtual network and connect all your devices to that network. Tailscale is built on WireGuard, a robust open source VPN protocol that works on almost any device.
Tailscale has many use cases. Developers use this to access remote servers. Businesses use it to give employees access to all kinds of corporate services even when they're not in the office. In this example, we will use it as an alternative to a VPN service that can encrypt and redirect all your internet traffic.
If you have a computer that's always running at home, or an old laptop that you no longer use, download and install Tailscale on that device. The Tailscale app is available for both Windows and macOS. (Also available on Linux using Terminal.)
Create a Tailscale account and create your first tailnet. In Tailscale terminology, Tailnet is a unique private peer-to-peer mesh network that allows devices to communicate with each other.
Click the Tailscale icon in your macOS menu bar or Windows taskbar. Turn on Tailscale and go to the Exit Node menu. Click “Run End Node…”
You can now install Tailscale on personal devices you travel with, such as your laptop or cell phone. Install Tailscale and log in to your account. The computer running at home appears in the list of devices in your private network.
Proceed again to the Terminate Nodes section. This time, select your home computer as the end node. that's it! If your device uses your home computer as an exit node, all Internet traffic will pass through that exit node.
Tailscale's role is to manage the coordination servers that make this VPN connection possible. This coordination server is responsible for distributing public keys to all devices in the Tailscale network so that they can securely communicate with each other. Tailscale does not route traffic through the coordination server.
As for your private key, it always remains on your device. Without these private keys, there is no way for Tailscale or anyone else to decrypt the data flowing through the VPN tunnel. This configuration allows you to get all the benefits of an encrypted VPN connection without having to manually generate, distribute, and handle public keys.
As a result, you can browse the web as if you were at home, even if you are thousands of miles away on a very limited Wi-Fi network.
At this point, you might be thinking, “This is great, but I don't want my computer running 24/7.” The good news is that with Tailscale you can turn your Apple TV into an exit node. Apple TV is designed to be always on, ready to turn on and use, so your exit node is always available. If you're not an Apple TV user, you might have an Android-based set-top box or an old Android smartphone sitting in your drawer. Tailscale allows you to run end nodes on Android devices as well.
The exit node submenu for the Tailscale client on macOS (left) and Windows (right). Image credit: TechCrunch (screenshot)
Medium: Install Tailscale on Raspberry Pi
If your modem or router is in a special location, you may want to build your own Tailscale device and connect it to your router with an Ethernet cable.
If so, you can also purchase a Raspberry Pi, a small and inexpensive single-board microcomputer. We recommend the Raspberry Pi 4 or Raspberry Pi 5 as they have Gigabit Ethernet ports. If you have a fiber connection at home, you can turn on your VPN connection and get faster speeds on that Gigabit Ethernet port.
You can flash your microSD card using Raspberry Pi Desktop, an operating system designed specifically for these computers. To set up your Raspberry Pi, you'll also need a USB keyboard and mouse, and a micro-HDMI-to-HDMI cable.
You can then connect your Raspberry Pi to your computer display or TV and power it on. To install and run Tailscale, you need to open a terminal and run a few commands detailed on the Tailscale website.
You also need to enable IP forwarding in the Raspberry OS using the following three commands:
echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.conf echo 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.conf echo 'net. ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.conf sudo sysctl -p /etc/sysctl.conf
After the last command, run the following command:
sudo tail scale up –advertise-exit-node
This completes the conversion of this Raspberry Pi to a Tailscale exit node.
You can now install Tailscale on your personal device that you travel with and use your Raspberry Pi as an exit node.
Raspberry Pi 5. Image credit: Romain Dilet / TechCrunch
If you like this setup and are comfortable using a terminal, you can follow the same steps in Raspberry Pi OS Lite, an operating system for the Raspberry Pi that doesn't have a traditional desktop interface.
You can also follow the same steps to create your own VPN server in a nearby data center. Many companies, including DigitalOcean, Vultr, Linode, Scaleway, Hetzner Cloud, and OVHcloud, offer inexpensive virtual servers for around $5 per month.
After you create a server with one of these cloud hosting companies, start your server and install Tailscale using the web console. You can also log in from your own terminal using SSH, which is often used for remote access.
Tailscale iPhone app. There is a feature at the top that allows you to select an exit node. Image credit: Romain Dilet / TechCrunch
Advanced: Tailscale for Fly.io or WireGuard for VPS
At this point, you may find that it's not that difficult to set up your own encrypted VPN server and route all your internet traffic through it. So you can get creative with your setup.
For example, developer Patrick Recher built a global network of Tailscale exit nodes on Fly.io, a cloud hosting company that can create virtual machines on the fly based on configuration files.
Recher can add servers to new regions with a single command line. And when you're done, stop and destroy the virtual machine. For more information, please visit Recher's GitHub repository.
If you do not want to rely on Tailscale to coordinate your peer-to-peer network, you can install and configure WireGuard directly. There are several tutorials on the web that guide you through the WireGuard setup process. Setting up WireGuard isn't too complicated, and you'll learn a few things along the way.