Pi as a VPN Server (WireGuard/PiVPN)

Why WireGuard Over OpenVPN

WireGuard is simpler, faster, and has a much smaller attack surface than OpenVPN — modern crypto by default, no config sprawl. Unless you have a specific reason to need OpenVPN (some corporate/legacy compatibility requirement), WireGuard is the right default in 2026.

Install via PiVPN

PiVPN wraps the whole setup (WireGuard install, key generation, client config generation) into one guided installer:

curl -L https://install.pivpn.io | bash

Walk through the prompts: pick WireGuard as the VPN type, confirm your Pi's static local IP, and either use your public IP directly or set up a dynamic DNS hostname if your ISP doesn't give you a static IP (most residential connections don't).

Router Port Forwarding

Forward UDP port 51820 (WireGuard's default) from your router to the Pi's local IP. This is the only port you need open — much smaller footprint than OpenVPN's typical TCP setup.

Adding Clients

pivpn add

This generates a client config file and a QR code — scan it directly in the WireGuard mobile app for instant setup, no manual config editing needed.

What You Get

• Secure remote access to your home network from anywhere — reach Pi-hole, Home Assistant, NAS shares, etc. as if you were on your home LAN.
• Route all your traffic through home when on untrusted WiFi (coffee shops, hotels) — enable "full tunnel" in the client config's AllowedIPs (set to 0.0.0.0/0) rather than split-tunnel.

Security Notes

• Keep the Pi itself patched — sudo apt update && sudo apt upgrade regularly, since this device now has a port exposed to the internet.
• Use pivpn -qr to reveal a client QR code again later without regenerating keys, if you need to re-provision a device.
• Revoke lost/compromised devices immediately with pivpn revoke — don't just delete the config and assume it's handled.