The good news is that setting up a working VPN – whether that's a commercial service or your own self-hosted one – has gotten significantly easier over the past few years. The tools are better, the interfaces are more polished, and in most cases you can have something running in under 30 minutes with no command line required. Here's how to think about it and how to actually do it.
What a VPN Actually Does (and Doesn't Do)
Before getting into setup, it's worth being clear on what a VPN is actually doing, because a lot of the confusion around them comes from mismatched expectations.
A VPN – Virtual Private Network – creates an encrypted tunnel between your device and a server somewhere else. When you browse the internet through a VPN, your traffic leaves your device encrypted, passes through that server, and then goes out to its destination from the server's IP address rather than yours. What this means practically: your internet service provider can see that you're connected to a VPN, but not what sites you're visiting. Websites you visit see the VPN server's IP address, not yours. People on the same network as you – a coffee shop Wi-Fi, a hotel network, a shared office connection – can't intercept your traffic.
What a VPN doesn't do is make you anonymous. If you log into Google, Google knows who you are regardless of what IP address you're using. If you're signed into your browser and all your accounts are active, your behavior is still trackable through cookies and fingerprinting. A VPN protects your traffic in transit and obscures your IP address – it's a privacy tool, not an invisibility cloak, and understanding that distinction helps you use one appropriately.
The two main reasons most people want a personal VPN are: protecting traffic on untrusted networks (public Wi-Fi being the classic case), and routing traffic through a different location to access geo-restricted content. Both are legitimate and both work reliably with a well-set-up VPN.
Option 1: A Commercial VPN Service
For most people, a reputable commercial VPN service is the right answer. You pay a monthly or annual fee, install their app on your devices, tap a button to connect, and you're done. There's no server to maintain, no configuration to manage, and the apps have become polished enough that using them is genuinely simple.
Choosing a Provider
The most important thing to look for in a commercial VPN is a verified no-logs policy. A VPN provider sits between you and the internet, which means they could theoretically log your activity. A no-logs policy means they claim not to keep records of what you do – and the best providers have had this independently audited by third-party security firms, which is meaningfully different from just claiming it in their terms of service.
Mullvad and ProtonVPN are the providers most consistently recommended in privacy-focused communities, for good reason. Mullvad in particular has an unusual privacy model – you don't need an email address to sign up, you pay with an account number, and they accept cash and cryptocurrency. ProtonVPN is run by the same Swiss company behind ProtonMail, has a strong privacy track record, and offers a genuinely usable free tier with no data limits (though speeds are slower on the free plan). Both have published transparency reports and undergone independent security audits.
ExpressVPN, NordVPN, and Surfshark are larger commercial providers that are widely used and generally solid, though they've had varying histories with audits and ownership that privacy researchers sometimes flag. If your primary goal is streaming and speed rather than maximum privacy, they're reasonable choices. If privacy is the main concern, Mullvad and ProtonVPN are cleaner options.
Setting It Up
Once you've picked a provider, setup is straightforward. Create an account (or for Mullvad, generate an account number), download the app for your platform – Windows, macOS, iOS, Android, Linux – and log in. Most providers have a single-click connect button that automatically selects a server. You can also manually choose a server location if you want to route through a specific country.
The most useful setting to enable is the kill switch, which most good VPN apps include. A kill switch cuts your internet connection entirely if the VPN connection drops unexpectedly, which prevents your real IP address from leaking during a brief disconnection. It's worth turning on, especially if you're using the VPN for privacy on untrusted networks.
That's genuinely all there is to the basic setup. Install, connect, enable kill switch. The whole process takes under ten minutes.
Option 2: Self-Hosting a VPN With Tailscale
If you want something more hands-on – or if you want to securely access your home network from anywhere without paying an ongoing subscription – self-hosting a VPN is more approachable than it used to be, largely because of tools like Tailscale.
Tailscale is built on WireGuard, the modern VPN protocol that replaced OpenVPN as the default choice for self-hosted setups because of its speed, simplicity, and clean security architecture. But Tailscale puts a much friendlier layer on top of WireGuard that handles the complicated parts – key exchange, NAT traversal, device management – automatically.
What Tailscale Does
Tailscale creates a private encrypted network across all your devices. Every device you install Tailscale on gets its own stable IP address on your private network, and those devices can communicate with each other securely from anywhere, as if they were all on the same local network. This is called a mesh VPN, and it's conceptually different from the commercial VPN model where all your traffic routes through a central server.
The practical use case that makes Tailscale compelling: you install it on your home computer or a Raspberry Pi at home, install it on your laptop, and you can now securely access your home network from anywhere in the world. Remote into your home desktop, access files on a home NAS, or use your home computer as an exit node so your traffic appears to come from your home IP address. No port forwarding, no router configuration, no dynamic DNS setup required.
Setting Up Tailscale
Start at tailscale.com and create a free account. The free tier supports up to 100 devices and three users, which covers basically any personal use case. Download the Tailscale app on your first device and log in – it will guide you through connecting that device to your Tailscale network (called a tailnet).
Install Tailscale on every device you want connected. Each one logs into the same Tailscale account and automatically appears in your admin console with its own stable IP address. At this point, your devices can communicate with each other securely from anywhere, and that's already useful on its own.
If you want to route all your internet traffic through a specific device – turning Tailscale into something closer to a traditional VPN where all traffic exits through one point – you can designate one device as an exit node. On that device (usually a home computer or a server), you enable the exit node setting in Tailscale. On your other devices, you select that exit node in the Tailscale app, and your traffic routes through it. This is done entirely through the app interface; no command line required for basic use.
The Tailscale documentation is genuinely excellent and walks through each step clearly. For most personal use cases, the setup from account creation to a working connected network takes 20 to 30 minutes.
Option 3: Self-Hosting on a Cloud Server With Algo or Outline
If you want full control over your VPN server and are willing to spend a little more time on setup, running your own VPN on a cloud server gives you an exit node in a specific location (useful for accessing content from a particular country) with no ongoing subscription to a third party.
The two most beginner-accessible tools for this are Algo and Outline.
Algo is an open-source project from Trail of Bits that automates the process of deploying a WireGuard VPN server on a cloud provider. You run a script, answer a few questions, and it provisions and configures everything for you. The documentation is detailed and the process, while it does involve a terminal window, requires following clear steps rather than understanding networking fundamentals. Outline is another open-source option originally developed by Jigsaw (an Alphabet subsidiary) that provides an even more visual setup experience through a desktop app.
For both, you'll need an account with a cloud provider like DigitalOcean, Linode, or Vultr, and the cost is typically $4–6 per month for a small server. You're paying for the server rather than a subscription service, and you own the infrastructure entirely.
This option is worth the slightly higher setup effort if you have a specific reason to want a VPN server in a particular location that commercial providers don't cover well, or if you want to be certain that no third party has any visibility into your traffic.
Which Option Is Right for You?
The most useful way to think about this is by what you're actually trying to accomplish.
If you want protection on public Wi-Fi and occasional use for streaming, a commercial provider like Mullvad or ProtonVPN is the simplest and most reliable answer. The monthly cost is low, the apps are polished, and you don't have to think about maintenance. If privacy is your primary concern and you want to minimize trust in any third party, Mullvad specifically is hard to beat.
If you want to securely access your home network from anywhere – or connect multiple personal devices into a secure private network – Tailscale is genuinely excellent and free for personal use. It's the most accessible self-hosted option available right now, and the setup experience has been refined to the point where most people find it straightforward.
If you want a self-owned exit node in a specific location and are comfortable spending 30–60 minutes on initial setup, Algo or Outline on a cheap cloud server gives you something fully under your control.
You don't have to pick just one. A common setup among privacy-conscious people is using Tailscale for connecting personal devices and a commercial provider like Mullvad for public Wi-Fi and general browsing – two different tools for two different purposes, neither requiring deep technical knowledge to maintain.
A Few Things Worth Knowing Before You Start
VPNs do slow down your connection somewhat, because your traffic is being routed through an additional server and encrypted in the process. With modern protocols like WireGuard, the impact is smaller than it used to be – most people notice little difference on high-speed connections – but if you're on a slower connection or using a geographically distant server, you may see a meaningful reduction in speed.
Browser extensions offered by VPN providers are not the same as a device-level VPN. A browser VPN extension only encrypts traffic going through that specific browser; apps, system updates, and anything else running on your device are not protected. Device-level VPN apps protect all your traffic, which is what you want for real privacy protection.
On mobile, VPN apps work the same as on desktop. Both iOS and Android support WireGuard natively, and most commercial providers have solid mobile apps. It's worth turning on the "always-on VPN" setting in your phone's network settings if you use public Wi-Fi frequently – this ensures the VPN connects automatically whenever you're on a network other than your trusted home connection.
FAQ
Does using a VPN make me anonymous online?
No. A VPN hides your IP address from websites and encrypts your traffic from your ISP and anyone on your local network. It doesn't prevent tracking through cookies, browser fingerprinting, or account logins. For browsing privacy, combining a VPN with a privacy-focused browser and blocking trackers makes a more meaningful difference than a VPN alone.
Is it legal to use a VPN?
In most countries, yes. VPN use is legal and common in the US, UK, EU, Canada, Australia, and most of the world. A small number of countries – Russia, China, Iran, and a few others – restrict or ban VPN use. Using a VPN doesn't change the legality of what you do online; it just adds a privacy layer to lawful activity.
Will a VPN stop my ISP from seeing what I do?
Your ISP will be able to see that you're connected to a VPN, but not the sites you visit or the content of your traffic while connected. This is one of the primary reasons people use commercial VPNs.
What's the difference between WireGuard and OpenVPN?
Both are VPN protocols – the technical standard that governs how the encrypted tunnel is established and maintained. WireGuard is newer, faster, and has a significantly smaller and simpler codebase, which generally makes it easier to audit for security. Most modern VPN providers now default to WireGuard. OpenVPN is older and more established but slower and more complex. For new setups, WireGuard is the better choice in almost every case.
Can I use a VPN on my router so all home devices are protected?
Yes, many routers support VPN client mode, which routes all traffic from every connected device through the VPN without needing an app on each device. This requires a router that supports VPN clients (many consumer routers don't), but if yours does, the VPN provider's documentation will usually have a setup guide specific to your router model.
Setting up a personal VPN doesn't require you to understand networking at a deep level. It requires picking the right tool for what you're trying to do, following the setup steps that now exist for almost every option, and knowing enough about what the technology does to use it with realistic expectations. That last part is the part most VPN marketing skips over – and it's the part that actually matters.
📚 Sources
Mullvad VPN – privacy policy and no-logs audit – https://mullvad.net/en/blog/2022/11/2/audit-of-our-infrastructure-completed
ProtonVPN – security audits and transparency – https://protonvpn.com/blog/security-audit/
Tailscale – how it works overview – https://tailscale.com/blog/how-tailscale-works
WireGuard – official technical overview – https://www.wireguard.com/papers/wireguard.pdf
Algo VPN – Trail of Bits open source project – https://github.com/trailofbits/algo
Outline VPN – Jigsaw project overview – https://getoutline.org
EFF – Surveillance Self-Defense: VPNs – https://ssd.eff.org/module/choosing-vpn-thats-right-you
