For a while, I’ve rented a VPS to use as a home VPN server using OpenVPN, and I’ve used an OpenWRT plugin to connect my home network to it. However, the hosting provider I’m using has been increasing their prices, so I’ve decided to host this VPN server at home. While I plan to use OpenVPN for this server as well, I’ve been looking into what other options there are. I’ve heard some buzz about Tailscale, but I’m not keen on any solution that is SaaS and not open source.
I’m curious to know what you folks might be using, and if there are any recommendations anyone else who has done this before can give.
It’s funny that you asked this, because I was thinking about the same thing earlier today.
I previously used a setup like you’re describing (WireGuard instead of OpenVPN in my case), for my home NAS, but I eventually abandoned it because the dealing with the dynamic DNS became too annoying.
[Sidebar: to be clear, it may have been annoying because my setup was just janky. I bought a cheap domain name through Porkbun and used a cron job and a small script to call their API regularly to make the needed updates when my dynamic IP changed. This was done more as a fun project than out of any real need.]
Anyway, earlier today I was thinking about switching to Tailscale for this use case because I expect that it will basically “just work” without many moving parts.
I have used Tailscale in the past, mostly in a gaming context. Example: my friend hosts a private home server for some game we both play, and by adding both that server and my PC to the same Tailnet, I’m able to connect without worrying about DNS issues or opening any ports. I have to say, it’s worked great in that context and we’ve had zero issues with it.
That said, I think Tailscale is only worth looking at if you plan to have a limited number of devices connecting to the resources you’re self-hosting.
Another option is a CloudFlare Tunnel which @brennanwrote about here. I haven’t tried this one personally.
Wireguard is indeed the name of the game in 2026. Like OpenVPN, it requires you to generate and propagate cryptographic keys on every machine. While OpenVPN supports signing device certificates via a root CA you deploy once, Wireguard requires you to propagate every single device certificate to every peer they’re allowed to contact. It’s easier to start with, can become cumbersome at scale if you want each mobile device to reach the other mobile devices. If you just want mobile ↔ server communication, it’s manageable by hand.
Tailscale is a commercial solution that handles that certificate distribution for you. Headscale is an open-source re-implementation of the server protocol that’s compatible with the official clients, but I would not trust access control to an enslopified project.
If you’re already familiar with OpenVPN, might as well continue with it? It’s a tried-and-true piece of software.
Thanks to all of you for responding. I looked into Wireguard and experimented with it, and I honestly found it was way less hassle for me than using OpenVPN.
While dong this setup, I stumbled upon PIVPN, which is basically just an assortment of scripts built on top of Wiregard and OpenVPN to make it much more like a “just work out of the box” experience. The only problem I had with it is that the installer didn’t let me configure the CIDR I wanted the tunneled addressed to be on, and I had to dive into /etc to reconfigure Wiregard and PIVPN manually.
I think in my case OpenVPN’s structure works against me. I don’t really like that I have to be my own CA for a home VPN. Since I have a low single digit number of devices I want to tunnel in my home network, having the ability to setup RSA keys once and not needing to worry about certificate expiry makes it way more streamlined for me.
I mean that’s true - I just wanted to learn what other options there were and see if there were pros to switching to something else.
For the record, I just port forward directly now. Cloudflare tunnel is an easy, free option for devs but I can’t recommend it due to the company’s practices and actions.