keepcalculator

06 Numbers and Powers

VPNs for Raspberry Pi: Setup & Guide

Card No. 06·17157 · Updated · Standard formula, shown below

Setting up a VPN on a Raspberry Pi turns a small, low-power board into a private network gateway for your home or travels. You can either run VPN client software to route the Pi’s traffic through a commercial VPN service, or install VPN server software to securely access your home network remotely. This guide covers both approaches, the hardware you need, common pitfalls, and how to choose the right setup.

What a Raspberry Pi VPN Actually Does

A Raspberry Pi is a credit-card-sized computer that runs Linux. When you install VPN software on it, the Pi acts as either a client or a server:

  • Client mode: The Pi connects out to a commercial VPN provider (like NordVPN or ProtonVPN). All traffic from the Pi—and from any device on your local network that routes through it—is encrypted and sent via the VPN tunnel. This is useful for hiding your home IP address or bypassing geo-blocks on a TV or old router.
  • Server mode: The Pi runs VPN server software (WireGuard or OpenVPN) and sits on your home network. When you are away, your laptop or phone connects to the Pi, and you can access files, cameras, or other devices on your home LAN as if you were there.

Many people also use a Pi as a combined ad-blocker (Pi-hole) and VPN server, but that is an optional extra.

Which Raspberry Pi Model Do You Need?

The Pi’s CPU and RAM matter more for VPN throughput than for basic tasks. Here is a rough guide based on real-world performance:

  • Raspberry Pi Zero 2 W: Can handle WireGuard at around 50–80 Mbps, enough for light browsing or a single remote user.
  • Raspberry Pi 3 B+: WireGuard speeds of roughly 100–150 Mbps, OpenVPN slower due to single-thread limits.
  • Raspberry Pi 4 B (2GB or more): WireGuard can saturate gigabit Ethernet (900+ Mbps) if the Pi is not doing other heavy work. This is the sweet spot for most home setups.
  • Raspberry Pi 5: Even faster, but overkill unless you also run other services.

For a VPN server, the Pi 4 is the most popular choice because it has gigabit Ethernet and USB 3.0. The Pi 3’s Ethernet is limited to 300 Mbps, so it will bottleneck a fast home connection.

VPN Client vs. VPN Server: Which One Do You Want?

Your goal determines the setup. Ask yourself:

  • Do I want to hide my home IP address from websites? → Client mode with a commercial VPN.
  • Do I want to watch streaming services from another country on my TV? → Client mode on the Pi, then route the TV’s traffic through it.
  • Do I want to securely access my home files or cameras while traveling? → Server mode.
  • Do I want to protect my phone on public Wi-Fi? → Server mode (connect back to home) or client mode on the phone itself.

You can also do both: run a VPN client on the Pi for outbound privacy, and a server for inbound access, but that complicates routing and is rarely needed.

How to Set Up a VPN Server on a Raspberry Pi

The most common server setup uses WireGuard, which is faster and simpler than OpenVPN. Here is the general process (exact commands vary by OS version):

  1. Install Raspberry Pi OS Lite (64-bit) on an SD card using the Raspberry Pi Imager.
  2. Update the system: sudo apt update && sudo apt upgrade
  3. Install WireGuard: sudo apt install wireguard
  4. Generate keys: Use wg genkey and wg pubkey to create a private and public key pair for the server and each client.
  5. Create a config file in /etc/wireguard/wg0.conf with the server’s private key, a listen port (e.g., 51820), and a [Peer] section for each client.
  6. Enable IP forwarding: Edit /etc/sysctl.conf to uncomment net.ipv4.ip_forward=1.
  7. Set up firewall rules (using iptables or nftables) to allow traffic from the VPN interface to the LAN and to masquerade it.
  8. Start WireGuard: sudo systemctl enable wg-quick@wg0 and sudo systemctl start wg-quick@wg0.
  9. Port forward on your home router: forward UDP port 51820 to the Pi’s local IP address.

If you prefer a graphical interface, PiVPN is a well-known script that automates WireGuard or OpenVPN installation and generates client config files. It is not an official Raspberry Pi product, but it is widely used in the community.

How to Set Up a VPN Client on a Raspberry Pi

For client mode, you have two options:

  • Install the VPN provider’s official app (if they offer a Linux ARM version). Many providers do, but the setup varies.
  • Use OpenVPN or WireGuard manually: Download the provider’s config files, then run sudo openvpn --config yourfile.ovpn or import the WireGuard config with wg-quick up wg0.

To route other devices through the Pi, you need to enable IP forwarding and set up NAT (masquerading) so that devices on your LAN can use the Pi as their gateway. Then change each device’s default gateway to the Pi’s IP address, or configure your router’s DHCP to hand out the Pi as the gateway.

A simpler method for whole-home VPN is to install the VPN client on your router instead, but many routers do not support it. The Pi is a flexible alternative.

Common Problems and How to Fix Them

Here are the most frequent issues people hit:

  • Slow speeds: OpenVPN is single-threaded and slow on older Pis. Switch to WireGuard. Also, the Pi’s Ethernet port on Pi 3 is limited to 300 Mbps; use a Pi 4 or 5 for gigabit.
  • Cannot connect from outside: Check that you have forwarded the correct UDP port on your router, and that your ISP is not blocking it. Also, your home IP may change; consider using a dynamic DNS service.
  • VPN works but no internet: You forgot to enable IP forwarding or masquerading. Double-check your iptables rules.
  • DNS leaks: Ensure your VPN config sets DNS servers (e.g., 1.1.1.1) and that your system’s DNS is not overriding them.
  • Pi crashes or freezes: Use a good-quality power supply (5V/3A for Pi 4) and a proper heat sink. Overheating can cause throttling.

Security and Privacy Considerations

A Raspberry Pi VPN is not a magic privacy shield. Here is what to keep in mind:

  • Client mode: Your VPN provider can see your traffic (unless it uses a no-logs policy). The Pi only encrypts traffic between your network and the provider’s server.
  • Server mode: You are exposing a service on your home network to the internet. Use strong keys, keep the Pi updated, and consider using a non-standard port to reduce automated attacks.
  • Physical security: If someone steals your Pi, they can read the config files and keys. Encrypt the SD card or at least keep the config files in a protected directory.
  • Do not rely on a VPN for anonymity: It hides your IP from the sites you visit, but cookies, browser fingerprints, and login accounts can still track you.

Cost and Alternatives

The Raspberry Pi itself costs between $15 (Zero 2 W) and $80 (Pi 5 with case and power supply). An SD card adds a few dollars. Running a Pi 4 24/7 costs roughly $3–5 per year in electricity (at typical rates).

Alternatives to a Pi-based VPN include:

  • Commercial VPN router (e.g., GL.iNet devices) – easier but less flexible.
  • Old laptop or desktop – more power but more expensive to run.
  • Cloud VPS (e.g., a $5/month VPS) – you can run your own VPN server there, but you do not get access to your home network.
  • Router firmware like OpenWrt – if your router supports it, you can run the VPN directly on the router.

For most people, a Raspberry Pi 4 with WireGuard is the best balance of cost, performance, and control.

Frequently Asked Questions

Can a Raspberry Pi handle a VPN for a whole house?

Yes, a Pi 4 with WireGuard can route 500+ Mbps, which is more than most home internet connections. However, if you have gigabit fiber, the Pi may become the bottleneck. For typical households with 100–300 Mbps, it is fine.

Is WireGuard better than OpenVPN on a Raspberry Pi?

Yes, WireGuard is significantly faster and uses less CPU because it is a modern protocol with a smaller codebase. On a Pi 3, WireGuard can triple the throughput compared to OpenVPN. OpenVPN is still useful if you need more advanced features or compatibility with older clients.

Do I need a static IP address from my ISP?

No, but it helps. If your home IP changes, you can use a dynamic DNS service (like DuckDNS or No-IP) to get a hostname that always points to your current IP. The Pi can update the DDNS record automatically with a cron job.

Can I use a Raspberry Pi VPN to watch Netflix from another country?

Possibly, but streaming services actively block known VPN IP addresses. If you use a commercial VPN provider, they may have servers that work, but it is not guaranteed. A home VPN server will not help with geo-blocking because your home IP is in your own country.

How do I keep my Raspberry Pi VPN secure?

Keep the OS and software updated (sudo apt update && sudo apt upgrade), use strong pre-shared keys or certificates, disable password SSH login and use key-based authentication, and limit access to the Pi’s admin interfaces to your LAN. Also, monitor logs for unusual activity.

Can I use a Raspberry Pi Zero for a VPN?

Yes, but only for light use. The Zero 2 W can handle WireGuard at around 50–80 Mbps, which is fine for a single user or a few low-bandwidth devices. It lacks gigabit Ethernet, so it is not ideal for whole-home routing.

Related

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.

More cards in this drawer

The whole Numbers and Powers drawer →