Cheap hardware for VPN server: what to choose in 2026

Cheap equipment for a VPN server: what to choose in 2026

If you're reading this, you have likely already tried free VPNs that severely reduce your speed, or paid services that work sporadically. Your own infrastructure is a different level of control. But what cheap equipment for a VPN server is really worth buying, and what is a waste of money? Let's break it down specifically: single-board computers, mini-PCs, routers, real performance metrics, and — importantly for Russia — which protocol won't be blocked by Roskomnadzor in a month.

Why you should set up your own VPN server and what equipment you need for it

A paid VPN service is someone else's server, someone else's protocol, and someone else's IP address. You don't control how traffic is masked as legitimate HTTPS, and you can't change the protocol in response to new blocks. Your own server gives you complete freedom of configuration.

This is especially important in Russia, where DPI (deep packet inspection) from providers can recognize and block signatures of popular protocols. When Roskomnadzor issues a directive — the provider shuts down traffic through the CSPU equipment. If you have your own protocol with the right masking, you simply change the configuration without waiting for the service to update.

Works where VPNs are blocked

Need a VPN that just works?

1. Download the NvoVPN app
2. Sign in with Google or email
3. Tap “Connect” — you’re done

Download for Windows Other devices →

• from 0.26 zł a day
• card or crypto
• 14 servers online

Your own server vs. paid VPN: what's the real difference

A paid VPN gives you one button and a ready-made app. Your own server requires 2-4 hours of initial setup and understanding of what's going on. But the IP address belongs only to you — no more "this address is blocked because 500 people used it on one service."

Another point: Russian VPN services, under pressure from Roskomnadzor, periodically either leave the market or start filtering traffic. A foreign service not subject to Russian jurisdiction can also be blocked. Your own server on a foreign VPS is the optimal option.

Minimum hardware requirements for WireGuard and VLESS/XRay

WireGuard is minimalist: it runs on 256 MB of RAM and one CPU core. In fact, WireGuard runs on an Orange Pi Zero with 512 MB of RAM without issues, just don't expect 1 Gbps.

VLESS/XRay with Reality requires a bit more: at least 512 MB of RAM, preferably 1 GB. XRay is written in Go, without JIT compilation, but it's not particularly heavy. On a Raspberry Pi 4 with 2 GB of RAM, it runs great, with CPU load during active traffic at 20-40%.

Shadowsocks-2022 has CPU load similar to WireGuard but adds overhead for encryption. On a weak ARM Cortex-A53 (Orange Pi Zero, old Pi), this is noticeable.

Where to physically place the server: at home, on a VPS, or with a hosting provider

At home: you need a static IP (or DDNS) and open ports. Many Russian providers are behind CGNAT — incoming connections are physically impossible without additional configuration. Check in advance: if your external IP starts with 100.64.x.x or 10.x.x.x — you have CGNAT.

VPS abroad (Hetzner, DigitalOcean, Vultr) — the optimal option. From 3-5 dollars per month for a basic server in Germany or Finland. Static IP is included. No issues with CGNAT and incoming connections.

Home equipment + foreign VPS — a combination for paranoids and perfectionists: all management is yours, outgoing traffic through a foreign IP.

Top cheap equipment options for a VPN server

Let's talk about specific devices with real prices. Prices are current as of early 2025, refer to Ozon/Wildberries/AliExpress — there are variations, but the order of magnitude is approximately this.

Single-board computers: Raspberry Pi 4/5, Orange Pi, Banana Pi — prices and performance

Raspberry Pi 4 (2 GB) — about 4000-5500 on Ozon (considering gray imports). The Cortex-A72 processor at 1.8 GHz provides ~400-600 Mbps with WireGuard in real conditions. Gigabit Ethernet is available. Community support is huge — any question gets answered within 5 minutes of Googling.

Raspberry Pi 5 (4 GB) — ~7000-9000. Cortex-A76, noticeably faster, but requires separate active cooling for 24/7 operation. Some old Pi 4 images will not work on it — check OS image compatibility before downloading.

Orange Pi 3 LTS — 2500-3500. Allwinner H6, Cortex-A53. Performance is about half that of Pi 4: WireGuard ~150-250 Mbps. Sufficient for one or two users. Buy only the official version — there are clones with different flash memory chips on AliExpress that cause OS hangs.

Banana Pi M5 — ~3500-4500. Amlogic S905X3, the same class as Cortex-A55. A decent alternative to Orange Pi, but the documentation is worse.

Mini-PCs: N100, Celeron J4125 — the best balance of price and performance

Intel N100 is a different level. x86 architecture, AES-NI out of the box, providing hardware acceleration for OpenVPN and other protocols with AES encryption. Mini-PCs N100 cost 8000-12000 on Ozon (brands like BMAX, MinisForum, Trigkey).

WireGuard on N100 provides 900+ Mbps — nearly gigabit. XRay with VLESS+Reality — 400-600 Mbps even with heavy TLS. This is already a server level of a small office, not just a personal VPN.

Celeron J4125 — a bit older, ~6000-9000 for a ready-made mini-PC. Performance is slightly lower than N100, but AES-NI is also present. A good option if you find it on sale.

An old laptop or PC as a VPN server: when it makes sense

If you have an old laptop with a Core i3/i5 and 4 GB of RAM lying idle — this is free equipment for a VPN server. The built-in battery serves as a UPS during power outages. Disadvantages: power consumption of 15-45 W versus 3-5 W for Raspberry Pi, plus fan noise.

For permanent use, this is not economically viable — the difference in electricity over a year is 1500-4000. But for testing or a temporary server — it's excellent.

Routers with OpenWRT: GL.iNet, TP-Link — the most compact option

GL.iNet Beryl AX (MT3000) — 6000-8000. MediaTek MT7981B, 256 MB of RAM, WireGuard right out of the box in the web interface. Power consumption ~5 W. But there is one limitation: it has one 2.5G port, the others are 1G. For most, this is not a problem.

An important limitation of all cheap routers: if you have Fast Ethernet (100 Mbps) ports, this is the physical speed limit; no software will help. Check the port specifications before purchasing.

TP-Link Archer C7 and similar devices on OpenWRT work, but the processor is weak — WireGuard will reach a maximum of 50-80 Mbps. This is acceptable for one user, but not for a family.

Comparison table: price / consumption / WireGuard speed

Which protocol to choose for your server to bypass Roskomnadzor blocking

This is the most important section if you live in Russia. You can buy the perfect cheap equipment for a VPN server, but if the protocol is blocked in two weeks — all of it is in vain.

WireGuard: fast, but easily blocked via UDP

WireGuard is a technically superior protocol. Minimalist code (about 4000 lines), fast cryptography Curve25519/ChaCha20, low latency. In a world without DPI — the ideal choice.

In Russia — the problem. WireGuard operates over UDP and has distinctive signatures in the first handshake packets. Provider DPI equipment recognizes and blocks it. Moreover, some providers apply UDP throttling: they do not explicitly block, but reduce UDP traffic to 5-10 Mbps. You will think everything is working, just slowly.

VLESS + XRay + Reality: the best choice for bypassing DPI in Russia

VLESS with Reality transport is currently the most resistant to DPI option. Reality disguises the connection as a real TLS handshake with a real domain (e.g., microsoft.com or apple.com). DPI sees legitimate HTTPS on port 443 — nothing to block.

XRay is a fork of V2Ray with additional features, including Reality. It installs with a single command via the official script. It works great on mini-PCs with N100. On Orange Pi Zero with Cortex-A53 — slow, because there is no hardware acceleration for AES, and XRay loads the CPU by 70-80% at 100 Mbps traffic.

Shadowsocks-2022: a compromise between speed and obfuscation

Shadowsocks-2022 is an updated version of the old protocol with improved cryptography (AEAD-2022). The obfuscation is worse than Reality, but better than regular WireGuard. The traffic looks like random data, which already complicates signature analysis.

The main advantage for weak hardware: CPU load is lower than that of XRay. On Orange Pi 3 LTS, the difference in CPU load between Shadowsocks-2022 and XRay can reach 30-40%. If you have an ARM Cortex-A53 board — Shadowsocks-2022 is a more practical choice.

Amnezia VPN: a ready-made solution based on regular hardware

Amnezia is a Russian open-source project that takes WireGuard and adds junk packets before the actual handshake. DPI cannot recognize the WireGuard signature because it sees a non-standard packet sequence.

AmneziaWG works on virtually any hardware where regular WireGuard works — the overhead is minimal. Client applications are available for Android, iOS, Windows, macOS. A good solution if you have already set up WireGuard and want to quickly add DPI protection without reinstalling everything.

OpenVPN and IKEv2: when they still make sense to use

OpenVPN over TCP on port 443 is an old but working scheme. The traffic looks like HTTPS to most providers without deep analysis. The speed is 30-50% lower than WireGuard, and the CPU load is higher. But it works almost everywhere and is supported by all clients.

IKEv2 — for corporate scenarios and iOS (built-in support). In the context of bypassing Roskomnadzor blocking — a weak choice: it is relatively easy to block. Use only if you need compatibility with a specific corporate solution.

Step-by-step setup of a VPN server on cheap hardware

Installing the OS: Debian/Ubuntu vs. Alpine Linux for resource savings

On Raspberry Pi 4 use Raspberry Pi OS Lite (64-bit) — this is an optimized Debian for this platform. Download from the official website raspberrypi.com, the version without a desktop (Lite). Write it using Raspberry Pi Imager — it also sets up SSH and hostname before the first boot.

For mini-PCs on x86 — Debian 12 Bookworm Minimal or Ubuntu Server 24.04 LTS. Alpine Linux saves RAM, but the repositories are less extensive, and some packages need to be compiled manually. For a beginner, this is extra hassle.

Installing WireGuard in 10 minutes: commands and configuration

On Debian/Ubuntu:

apt update && apt install -y wireguard
wg genkey | tee /etc/wireguard/server_private.key | wg pubkey > /etc/wireguard/server_public.key
chmod 600 /etc/wireguard/server_private.key

Configuration /etc/wireguard/wg0.conf:

[Interface]# Server private key
PrivateKey = <contents of server_private.key>
# Server address in VPN network
Address = 10.0.0.1/24
# Port — better non-standard, but if provider blocks UDP — it's a problem
ListenPort = 51820
# Enable traffic forwarding
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
# Client public key
PublicKey = <client_public.key>
AllowedIPs = 10.0.0.2/32

Enable and start:

echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
sysctl -p
systemctl enable wg-quick@wg0
systemctl start wg-quick@wg0

If your provider blocks UDP traffic on non-standard ports — change ListenPort to 53 (DNS) or use wstunnel to wrap WireGuard in WebSocket.

Installing XRay/VLESS with Reality on a mini-PC or single-board computer

Official installation script for XRay (version 1.8.x and above):

bash -c "$(curl -L https://github.com/XTLS/Xray-install/raw/main/install-release.sh)" @ install

After installation, the configuration is located in /usr/local/etc/xray/config.json. For Reality, you need to generate a key pair:

xray x25519

In the configuration, you specify "dest": "www.microsoft.com:443" — XRay will redirect unrecognized connections to Microsoft, creating a convincing disguise.

Client connections: Android, iPhone, Windows, router

WireGuard Android/iOS: the official WireGuard app from the Play Store/App Store. Generate a configuration QR code with qrencode -t ansiutf8 < client.conf, scan it with your phone.

VLESS/XRay on Android: v2rayNG app (Google Play). Copy the link as vless://uuid@ip:443?..., paste it into the app.

VLESS/XRay on iOS: Streisand or Shadowrocket app (paid, $2.99). Import the same link.

Windows: for WireGuard — the official client from wireguard.com, import the .conf file. For XRay — Nekoray or Hiddify.

Monitoring and security: fail2ban, automatic updates

Minimum security set:

apt install -y fail2ban unattended-upgrades
systemctl enable fail2ban
dpkg-reconfigure -plow unattended-upgrades

Fail2ban automatically blocks SSH brute force. Unattended-upgrades installs security patches without your involvement. Change the SSH port from 22 to something non-standard and disable password authentication — only keys.

What doesn't work and typical errors when choosing hardware

Why a home IP is not suitable for VPN in Russia

Even if you have solved the CGNAT issue and obtained a static IP from your provider — a home IP address is problematic for another reason. Russian providers have the right and technical ability to block specific IP addresses of their users upon request. Plus, your IP is within the range of a Russian provider — some foreign services additionally filter it.

The correct scheme: home equipment + VPS abroad as an exit node. At home, there is a Raspberry Pi or mini-PC, which connects through a tunnel to your server in Germany, all traffic goes through a German IP. This way, no one knows your home address.

Routers without hardware NAT: a bottleneck in speed

Many budget routers with OpenWRT lack hardware NAT acceleration. With VPN traffic, all forwarding goes through the CPU, which on MIPS routers from 2016-2018 is frankly weak. The real speed can be 20-40 Mbps with theoretical 300 Mbps for the router.

GL.iNet on MediaTek MT7621/MT7981 is better — Software Flow Offloading works there and provides a noticeable boost. But hardware older than 2020 with a MIPS processor for a VPN server is junk, don't waste your time.

Single-board computers with 100 Mbps Ethernet — a hidden limitation

Orange Pi Zero, Banana Pi M2 Zero, some early Raspberry Pi — they physically have 100 Mbps Ethernet or only WiFi. WireGuard can provide 300 Mbps through the CPU, but the network will be a bottleneck at 100 Mbps. Check the specifications before purchasing.

Raspberry Pi 4 and 5 — gigabit Ethernet. Orange Pi 3 LTS — also gigabit. This is the minimum for normal use.

Heat and stability: problems with 24/7 operation of cheap equipment

Raspberry Pi 4 without cooling under constant load reduces frequency from 1800 MHz to 600 MHz. This is a real problem for a VPN server 24/7. Buy a case with a passive heatsink — this completely solves the problem without a single fan.

Cheap Chinese mini-PCs, such as "no-name N100", sometimes have unstable WiFi modules and mediocre power supplies. Connect via Ethernet, WiFi is not needed at all for the server. Get a power supply with a margin — a cheap 12V/1A under load may have voltage drops.

A separate story — cheap hosting in exotic locations (1 dollar a month for VPS in Moldova or Kazakhstan): power outages, unstable connection, sometimes just offline for several hours. Hetzner, Contabo, DigitalOcean — pay an extra 2 dollars, but sleep peacefully.

An alternative to your own server: when to choose a ready-made VPN

When self-hosting is inappropriate

Your own VPN server on cheap hardware for VPN is a project. Not an app, not a subscription, but a project with initial setup, periodic maintenance, and troubleshooting, such as "the server crashed at 3 AM, and everyone at home has no internet."

Let's calculate the real TCO: Raspberry Pi 4 (~6100 total one-time cost) + cooling case + microSD card (~see current prices on the website) = ~6100 total one-time cost. Electricity: ~4 W × 24 h × 30 days × see current prices on the website = ~see current prices on the website per month. VPS abroad (Hetzner CX11, 2 GB RAM, Germany) = ~see current prices on the website/month. Total: ~6100 entry + ~see current prices on the website/month. For 6 months, that's ~see current prices on the website. Plus your time for setup and maintenance.

A ready-made VPN service with proper support for bypassing blocks costs 100-500 rubles/month. For 6 months — 600-3000 rubles, zero time for setup. For non-technical users, the choice is obvious.

NvoVPN and other services as a ready-made alternative without hardware

If you don't want to deal with configurations and updates, a ready-made service is a reasonable choice. NvoVPN, for example, already supports modern protocols for bypassing DPI and does not require purchasing any hardware — just download the app and connect.

Your own server makes sense if: you have technical knowledge and want to control every aspect, you are ready for time costs, or you have specific requirements (for example, a specific outgoing IP for working with certain services). In other cases — assess soberly whether it's worth it.