SMF·NORDVPN
Can a prompt replace NordVPN?
Security & passwords — passwords, privacy and private networking
Exhibit tracking slip
Verdict
Installing WireGuard on a cheap VPS and generating client configs is a genuine one-sitting project, and it gives you an encrypted tunnel and a fixed exit IP. It does not give you what NordVPN actually sells: thousands of servers in dozens of countries to choose an exit location from, capacity that absorbs millions of concurrent users, obfuscation that gets past VPN-blocking firewalls, and a published no-logs policy backed by independent audits.
Exhibit A — The prompt
Received on31.07.2026Build a self-hosted personal VPN: WireGuard running on a VPS the user already controls, with a script that generates and manages client configs. Do not build a VPN network, a client app, or anything resembling a managed service — this is a setup script plus a small config-management tool, not a product.
Core loop: the operator runs a setup script against a fresh Ubuntu VPS (DigitalOcean, Hetzner, or similar) that installs WireGuard, generates a server keypair, and opens the UDP port. For each device, the script generates a client keypair, writes a `.conf` file (or a QR code for mobile) pointing at the VPS's public IP, and appends the client's public key to the server config. Store the list of provisioned clients and their creation dates in a local SQLite file so the operator can list and revoke them later. A revoke command removes a client's key from the server config and reloads WireGuard without dropping other connections.
This needs a VPS the operator pays for and administers themselves — a few dollars a month from any cloud provider, with root SSH access. No API key, no third-party account beyond the VPS itself. Test that a client can actually route traffic through the tunnel, not just establish a handshake.
Do not build: a network of servers in multiple countries, a GUI client app, obfuscation to bypass VPN-blocking firewalls, or a no-logs audit — a single VPS run by one person has no independent verification behind it, and the tool should never claim otherwise. State plainly in the README that this is one server in one location, visible as one IP, not an anonymity network.Opening prefills the prompt — press enter to run it.
Exhibit B — What you lose
- B.1 thousands of servers across dozens of countries to pick an exit location from
- B.2 independent no-logs audits and a legal team defending that policy
- B.3 obfuscated connections that get through VPN-blocking firewalls
- B.4 automatic failover when a server goes down
- B.5 24/7 support and apps for every platform with one-tap connect
Prior art
Exhibit C — Why people still pay: security assurance, infrastructure, and trust
People pay for NordVPN because a single self-hosted server is a single point of failure with one exit IP in one country, run by whoever configured it — not a network. The subscription buys server diversity, an audited no-logs claim from an independent firm, and the operational work of keeping thousands of exit nodes fast and unblocked, not just an encrypted tunnel.
Questions
Does this hide my IP from the sites I visit?
It replaces your home IP with your VPS's IP, so sites see the VPS's address instead. But it's one fixed address you control and pay for — easier to trace back to you than one of NordVPN's shared exit nodes, not harder.
Will it work on my phone?
Yes — any standard WireGuard app (available for iOS and Android) can import the generated config or scan the QR code. What you lose is NordVPN's one-tap server picker; here there's exactly one server, the one you rented.
What does it cost to run?
A small VPS runs $4–6 a month from providers like Hetzner or DigitalOcean — cheaper than NordVPN's monthly price, though you're trading the price difference for becoming your own systems administrator.
What's the one thing that doesn't survive the rebuild?
Server choice and audited no-logs claims. NordVPN lets you pick an exit country from thousands of servers and backs its logging policy with independent audits; a self-hosted VPS is one server in one place, and the only proof it isn't logging anything is your own word.
Related tools
Receipt