Public Wi-Fi networks in coffee shops, hotels, and airports expose your web traffic to eavesdropping and untrusted network operators. Having your own personal VPN allows you to encrypt all internet traffic on untrusted connections and route it securely through your home router.
PiVPN turns a Raspberry Pi into a dedicated VPN server in minutes. While OpenVPN was historically the default choice, modern deployments use WireGuard: a state-of-the-art cryptographic tunnel that is faster, uses less battery on mobile phones, and reconnects instantly when switching between Wi-Fi and mobile data.
Requirements and network planning
WireGuard is remarkably efficient. It runs comfortably on any Raspberry Pi model, from the Pi Zero 2 W to the Raspberry Pi 5.
Before starting: 1. Assign a static local IP address to your Raspberry Pi in your home router settings or Raspberry Pi OS configuration. 2. Determine your public IP address or DDNS domain. If your internet service provider assigns a dynamic public IP address, configure a free Dynamic DNS (DDNS) hostname such as DuckDNS. 3. Port forward UDP 51820 on your home router to the local static IP address of your Raspberry Pi. WireGuard uses UDP exclusively.
Install PiVPN with WireGuard
PiVPN provides an automated, guided installer script maintained by the open-source community. Connect to your Raspberry Pi via terminal or SSH and execute:
curl -L https://install.pivpn.io | bash
Follow the interactive prompts on your screen:
1. User account: Select your primary user (typically pi or your custom username) to store client profiles.
2. VPN Protocol: Choose WireGuard (recommended for speed and efficiency).
3. Port: Accept the default WireGuard port 51820 (UDP), or customize it if desired.
4. DNS Provider: Choose a DNS provider. If you have Pi-hole installed on the same Raspberry Pi, PiVPN detects it automatically and offers to use it, giving your mobile devices ad-blocking on the go.
5. Public IP or DNS Name: Select your static public IP address or enter your DuckDNS domain name.
6. Complete the setup and let the installer reboot your Raspberry Pi if requested:
sudo reboot
Generate your first client configuration
After rebooting, generate a client profile for your smartphone or laptop using the built-in pivpn command:
pivpn add
You will be prompted to enter a descriptive client name (for example, phone-iphone or laptop-macbook). PiVPN generates a public/private keypair and creates a configuration file saved in $HOME/configs/.
Connect your smartphone using a QR code
Connecting a mobile device is effortless thanks to WireGuard’s built-in QR code scanner.
- Install the official WireGuard app from the iOS App Store or Google Play Store.
- In your Raspberry Pi terminal, render the QR code for your client profile:
pivpn -qr phone-iphone
- Open the WireGuard mobile app, tap the + (Add) button, and select Create from QR code.
- Scan the code rendered directly in your terminal window, assign a name such as
Home VPN, and save the tunnel. - Toggle the tunnel switch on.
Verify that your phone connects and test your connection by visiting a public IP checking site like https://icanhazip.com. The returned IP address should match your home router's public address.
Managing clients and monitoring tunnels
PiVPN provides simple terminal management commands to inspect active sessions:
pivpn list
pivpn -c
The -c (clients) flag displays a live table of connected peers, showing when they last handshook and the amount of data transferred in each direction.
To revoke an old device or lost phone, simply run:
pivpn -r phone-iphone
Split tunnel versus full tunnel
By default, PiVPN configures a full tunnel (AllowedIPs = 0.0.0.0/0, ::/0), routing all internet browsing through your home connection. This is ideal for security on hotel and coffee shop networks.
If you only want access to your home devices (such as local file shares, SSH, or local web servers) while routing normal internet traffic through your cellular connection:
1. Edit the client configuration file before importing.
2. Change AllowedIPs to your home local subnet (for example, 192.168.1.0/24).
This reduces bandwidth load on your home connection while keeping local access seamless.
Sources and further reading
Check real-time CPU, RAM, temperature, and service health for your networking projects with Open Pi for iOS and Android. Local-first, private, and no cloud account required.
Researched and validated against official project documentation and community standards on September 11, 2026. Review your board model, storage, and current release notes before deploying.