Two of the three tools below are ours, so read this with that in mind. We package OpenVPN Access Server and Headscale as AWS AMIs, and both earned their spot here honestly, not because we sell them. The best self hosted VPN for you depends on one question most listicles skip: do you want a working admin console today, or are you fine assembling one from open source parts?
Quick answer
Jump to a section
How to choose a self hosted VPN server
Skip the protocol trivia. Three questions get you to the right pick:
- Do you need a working admin console on day one? OpenVPN Access Server ships one. Headscale and raw WireGuard don't, natively; Headscale gets one through Headplane, a third-party web UI, and raw WireGuard has none at all.
- Do your users already have the Tailscale app installed, or would they need a new client? Headscale works with the official Tailscale client apps as-is. OpenVPN needs its own client software, and raw WireGuard needs a config file per device.
- How much manual peer management are you willing to do? Raw WireGuard means editing config files and redistributing keys by hand for every device you add or remove. That's fine for three servers you manage yourself, painful for thirty employees.
Hosted VPN service or self hosted VPN?
A quick word on the other option, because a lot of people land here after searching "hosted VPN". A hosted VPN service (NordLayer, say, or Tailscale's own cloud) runs the servers for you. You pay per user per month and never patch anything. A self hosted VPN puts the server in your own AWS or GCP account or on your own hardware: you patch it, but the keys, logs and user list never leave infrastructure you control, and the cost is a flat server bill rather than a seat count.
For a five-person team with no compliance requirements, a hosted service is honestly the easier choice. Once you have auditors asking where connection logs live, or 50 people on a per-seat plan, self-hosting starts paying for itself. The rest of this article assumes you're in that second group.
1. OpenVPN Access Server: the one with a working admin console
OpenVPN Access Server is free forever for up to 2 simultaneous connections, no credit card required. Past that, the Growth plan runs $7 per connection per month billed annually, and Enterprise plans (2,000+ connections) are custom quoted. Every tier gets the full feature set, including the web admin console, per-user accounts, and one-click revocation. It runs over TCP or UDP, and TCP on port 443 specifically means it looks like ordinary HTTPS traffic to most corporate firewalls, which matters if your team connects from hotel Wi-Fi or a country that throttles VPN traffic.
Key features
- Web-based admin console with per-user accounts and instant revocation
- Free for up to 2 simultaneous connections, then $7/connection/month
- Runs over TCP port 443 for restrictive networks, or UDP for speed
- Client software for every major desktop and mobile platform
2. Headscale: the WireGuard-based mesh with no per-user fee
Headscale is BSD-3 licensed and reimplements Tailscale's coordination server, so your devices run the exact same official Tailscale client, it just talks to a server you control instead of Tailscale's cloud. It supports MagicDNS, subnet routing, exit nodes, and OIDC-based single sign-on, with no cap on users or devices. Our Headscale vs Tailscale comparison covers exactly what you give up by leaving Tailscale's hosted control plane. It doesn't ship its own web UI, most people pair it with Headplane, a community-built dashboard, for day-to-day node and ACL management instead of the command line.
Key features
- Works with the unmodified official Tailscale client on every platform
- MagicDNS, subnet routing, exit nodes, and OIDC single sign-on
- No per-user or per-device pricing at any scale
- Pairs with Headplane for a web UI, since Headscale itself is CLI-only
3. Raw WireGuard: the fastest option if you do the wiring yourself
WireGuard is the protocol underneath both a full VPN product and a coordination layer like Headscale. Run it directly with wg-quick and you get the smallest possible footprint (roughly 4,000 lines of code, built into the Linux kernel since version 5.6) and the best raw throughput of the three, no user accounts, no admin console, no revoke button. Adding or removing a device means editing a config file and redistributing a key by hand. A full mesh of n devices needs n(n-1)/2 pairwise connections, which is exactly why almost nobody manages more than a handful of peers this way without a tool like wg-easy or Netmaker layered on top. If you're choosing between the two protocols rather than the three products, our OpenVPN vs WireGuard breakdown goes into speed, firewall traversal and cost.
Key features
- Smallest codebase of the three, built into the Linux kernel directly
- Best raw throughput and lowest CPU overhead per connection
- Zero licensing cost, it's a kernel module, not a product
- UDP only, no TCP fallback for restrictive networks
Best self hosted VPN with a web UI for an Ubuntu server
This is the question behind a lot of searches: you have an Ubuntu server, you want a VPN, and you don't want to live in config files. Three setups get you a browser-based admin panel:
- OpenVPN Access Server. Installs from OpenVPN's own apt repository on current Ubuntu LTS releases, and the admin UI comes up on port 943 (
https://your-server:943/admin). Users, groups, routing and client downloads are all in the browser. The most complete UI of the three, by a distance. - wg-easy. wg-easy runs WireGuard plus a small web dashboard in one Docker container. You add a peer, it shows a QR code, done. Great for a small team on one server, but it isn't a user directory and has no SSO.
- Headscale with Headplane. Headscale ships a .deb package for Ubuntu, and Headplane adds node and ACL management in the browser. More moving parts, but you get Tailscale's clients and a mesh instead of a single gateway.
If the server is going on AWS or GCP rather than your own hardware, our AMIs skip the install step entirely; the setup guides are linked further down.
Best self hosted VPN options: feature comparison
| Feature | OpenVPN Access Server | Headscale | Raw WireGuard |
|---|---|---|---|
| Admin console | Built in | Via Headplane (third-party) | None |
| User accounts | Yes | Via OIDC SSO | No, public-key peers only |
| Pricing | Free for 2, then $7/connection/mo | Free, any scale | Free, any scale |
| Client software | OpenVPN's own apps | Official Tailscale client | Native OS WireGuard client |
| Transport | TCP or UDP | UDP (WireGuard-based) | UDP only |
| Works behind strict firewalls | Yes, via TCP 443 | Depends on UDP access | Depends on UDP access |
| Setup effort for a team | Low, console-driven | Moderate, easier with Headplane | High, manual per device |
Why we run OpenVPN and Headscale for clients
Most teams that come to us already know they want something self-hosted, the question is which shape fits. Teams migrating off a traditional corporate VPN land on OpenVPN Access Server because the admin experience is familiar and the TCP-443 firewall traversal just works. Teams already using or evaluating Tailscale land on Headscale because it's the same client experience with the coordination server under their own control instead of a vendor's. We package both as ready-to-launch AMIs specifically because the setup work, TLS, the database, the reverse proxy, is the part that eats a weekend otherwise.
Our OpenVPN developer guide and GCP deployment guide cover Access Server end to end, and if you'd rather run it inside your own GCP project the OpenVPN on GCP Marketplace listing deploys the same Access Server in minutes. Our Headscale developer guide covers the Tailscale-compatible route in the same depth.
Where I'd start
Want employee accounts and revocation working today, and you might have staff connecting from restrictive networks: OpenVPN Access Server. Already like Tailscale's client experience but want the coordination layer on your own infrastructure at zero per-seat cost: Headscale. Running a handful of your own servers and comfortable managing keys by hand for the best possible throughput: raw WireGuard.
None of these three lock you in. All three speak open protocols and store configuration in formats you can read and export, so picking one now doesn't close off switching later if your team's shape changes.
Frequently Asked Questions
What is the best self hosted VPN in 2026?
OpenVPN Access Server for traditional remote access with a real admin console. Headscale for a modern, WireGuard-based mesh compatible with Tailscale's own client apps. Raw WireGuard for the leanest possible setup if you're comfortable managing peers by hand.
What's a good self hosted VPN server for a small business?
OpenVPN Access Server. It's free for up to 2 simultaneous connections, gives IT a web console for adding and revoking users, and runs over TCP port 443 so it isn't blocked by restrictive corporate firewalls.
What is a real OpenVPN alternative that's still self-hosted?
Headscale, if you want the account and device management OpenVPN offers but built on the faster WireGuard protocol instead. It reimplements Tailscale's coordination server, so you connect with Tailscale's own official client apps, just pointed at your own server.
Is Headscale a real Tailscale alternative?
Yes. Headscale is an open source, self-hosted reimplementation of Tailscale's coordination server. You install the same official Tailscale client on every device, it just talks to a server you run instead of Tailscale's cloud, with no per-user cost.
What does wireguard server setup actually involve if I do it myself?
Generating a key pair per device, writing a config file for each peer, and manually distributing those configs. It works, but there's no user account layer, no revoke button, and no dashboard. Most teams add Headscale or wg-easy specifically to avoid managing that by hand.
Which self hosted VPN server is fastest?
Anything built on WireGuard, Headscale included, generally beats OpenVPN Access Server on raw throughput and CPU overhead, thanks to WireGuard's smaller codebase and kernel-level implementation. For most remote-access use cases the difference isn't noticeable until you're well past a few hundred concurrent connections.
Headscale vs OpenVPN: which should I use?
OpenVPN Access Server if people connect to one network from outside and you want a ready admin console. Headscale if devices need to reach each other directly as a mesh, or your team already uses the Tailscale app.
What is a good WireGuard alternative?
If WireGuard's problem is UDP being blocked, OpenVPN over TCP port 443 gets through where WireGuard can't. If the problem is managing peers by hand, keep WireGuard and add Headscale or wg-easy on top instead of replacing it.
What is the best self hosted VPN with a web UI for an Ubuntu server?
OpenVPN Access Server, which installs from OpenVPN's own Ubuntu repository and ships a full admin UI. For WireGuard with a UI, wg-easy runs in Docker with a browser dashboard, and Headscale gets one from Headplane.
Is a hosted VPN service better than a self hosted VPN?
A hosted VPN service is less work: no server to patch. A self hosted VPN keeps the server, logs and keys in your own account, and costs a flat server fee instead of a per-user subscription. Businesses with compliance needs usually self-host.
Launch OpenVPN Access Server on AWS in Minutes
Launch a pre-configured OpenVPN Access Server on AWS, admin console and user management already running, free for up to 2 connections.
Get OpenVPN Access Server on AWS Marketplace
