A Complete Walkthrough: Migrating From LetsVPN to a Self-Hosted WireGuard VPN

As a user who has long relied on VPNs for accessing overseas resources and work communication, I recently experienced the sudden shutdown of LetsVPN. From hitting walls with alternative solutions to finally setting up my own WireGuard VPN, I encountered many pitfalls along the way and accumulated reusable, practical experience. This article provides a complete review of the entire process, from the LetsVPN shutdown notice and the screening of alternative solutions to the full steps of self-hosting a VPN (cloud server selection, deployment, and client installation/configuration), along with key operational points and pitfall-avoidance details for friends with similar needs to use as a reference.

1. Sudden Incident: LetsVPN Completely Shut Down, Temporary Network Access Paralyzed
For a long time, I had been using LetsVPN to meet my daily overseas network access needs. Although there were occasional minor issues like network fluctuations and unstable speeds, it generally worked fine and could stably support my work and study needs.
After entering mid-April, LetsVPN started showing obvious abnormalities: although the client could occasionally manage to connect, the network was extremely unstable, with high latency, severe packet loss, and frequent stutters during webpage loading. The problem continued to worsen later; during most time periods, it was completely impossible to establish a normal connection, and basic functionality gradually failed.
By the end of April, the official shutdown announcement was released, explicitly stating that LetsVPN would terminate all business operations for the Chinese mainland region, would no longer provide related services thereafter, and simultaneously shut down functions like account renewals and node connections. As shown in Figure 1: Screenshot of LetsVPN’s official mainland business shutdown announcement

From then on, my original network tools became completely invalid. Essential daily operations like accessing overseas websites and looking up materials were entirely interrupted, and my normal work and study rhythm was severely disrupted. I urgently needed to find a stable and usable alternative solution.

2. Hitting a Wall with Alternatives: Enterprise VPN Thresholds Too High, Abandoning the Option
Faced with the dilemma of LetsVPN’s shutdown, my first thought was to switch to other personal consumer VPNs (rather than directly choosing an enterprise version), since for personal daily use, consumer VPNs better fit my needs. However, after actual research, I found that due to policy factors, the vast majority of personal consumer VPNs on the market face the same compliance issues. It is not a technical failure, but a policy-level restriction, causing most consumer VPNs to either be unusable or to potentially stop service at any time, exactly the same situation as LetsVPN. After weighing the options, I turned to considering enterprise VPNs, rather than giving up on consumer VPNs from the start—here a distinction needs to be made: LetsVPN itself is a personal consumer commercial VPN, not an enterprise version. This research revealed that all personal consumer commercial VPNs (whether free or paid) are subject to policy restrictions and cannot be used stably long-term, which is why I had to abandon personal consumer VPNs and turn to researching enterprise VPNs.
However, after deeper investigation, I found that enterprise VPNs have two insurmountable thresholds: first, the price is too high. The monthly and annual fees of mainstream enterprise VPNs far exceed an individual’s affordable range, making the cost-effectiveness extremely low for individual users. Second, the qualification requirements are strict. Opening an enterprise VPN requires providing relevant qualifications such as a business license and legal representative information, which individual users simply cannot satisfy. Ultimately, I could only abandon the enterprise VPN option and decide on the plan of self-hosting a WireGuard VPN. (As shown in Figure 2: Screenshot of enterprise VPN qualification requirements)

3. Final Decision: Self-host WireGuard VPN, Take the Initiative
Personal consumer VPNs are subject to policy restrictions and cannot be used stably long-term, while enterprise VPNs have thresholds that are too high (dual restrictions on qualifications and price). After weighing the options, I finally decided to self-host a VPN, explicitly choosing the WireGuard protocol rather than other open-source VPN software. Compared to other mainstream open-source VPN software, WireGuard has irreplaceable advantages, which is the key reason I abandoned other open-source VPNs and chose WireGuard. The specific advantages are as follows:

• Lightweight and efficient, with extremely low resource usage: Compared to other open-source VPN software like OpenVPN and SoftEther, WireGuard requires no complex server-side configuration. Its kernel-level implementation means it consumes very little server memory and CPU resources. Even a low-spec cloud server (1 core, 1GB RAM) can run it stably without stutters or resource shortages, making it highly adaptable for personal self-hosting scenarios.
• Stable connection and lower latency: WireGuard adopts a minimalist encrypted transmission mechanism without redundant configurations. The connection response speed is fast, and it is less prone to disconnections and stutters. Compared to other open-source VPNs (such as OpenVPN), latency can be reduced by more than 30%, making it especially suitable for watching high-definition videos and browsing overseas webpages. This is the core reason I prioritized it.
• Simple configuration, no complex operations required: Unlike other open-source VPN software (such as OpenVPN, which requires manual configuration of routes, certificates, etc.), WireGuard’s configuration logic is more concise. You only need to import the configuration file and toggle the switch to use it, without needing to deeply understand the underlying principles. It is more friendly to non-professional users and fit my needs at the time.
• Strong compatibility and friendly multi-device support: WireGuard supports simultaneous multi-device connections (just generate independent configurations for different devices) and adapts to various terminals like computers and phones. Without needing to install complex plugins, it enables multiple devices to be online simultaneously, which is difficult for many other open-source VPN software to achieve.
• Avoiding policy risks, adaptable to personal scenarios: Other open-source VPN software (like OpenVPN) is mostly suited for enterprise or professional users, with cumbersome configurations and some functions restricted by policy. WireGuard’s protocol design, however, is more aligned with personal usage scenarios. It requires no complex qualification audits, and self-hosted deployment can bypass the policy restrictions of commercial VPNs while balancing stability and security.
  Overall, WireGuard is not only open-source and free, but also better fits my core needs of “personal use, stable and smooth, and simple operation.” Compared to other open-source VPN software, it is more lightweight and better suited for personal self-hosting scenarios. Therefore, I ultimately chose to use WireGuard to build my personal VPN instead of other open-source VPN software.
  The core idea of self-hosting a VPN is: choose a reliable cloud service provider to deploy the server, install the WireGuard service on the server, and then configure clients for the computer and phone to achieve simultaneous stable connections across multiple devices. The entire process is divided into three main phases: “Cloud Server Selection and Deployment,” “WireGuard Service Installation,” and “Client Configuration.” The practical steps are broken down below.

4. Full Practical Process of Self-hosting a WireGuard VPN (with Pitfall Avoidance Details)
4.1 Step 1: Choose a Cloud Service Provider and Deploy the Base Server
The core of self-hosting a VPN is having an overseas cloud server. Based on my personal usage needs (stability, cost-effectiveness, and ease of operation), after comparing mainstream overseas cloud service providers like Vultr, DigitalOcean, and Hetzner, I ultimately chose Vultr: it has a wide global distribution of nodes, supports hourly billing, and the entry-level server (1 core, 1GB RAM, 500GB traffic) costs only $5 per month. It also supports IPv6 and deploys quickly, making it suitable for personal self-hosted VPN use.
Specific deployment steps
1. Register a Vultr account, complete the real-name authentication, and then proceed with the top-up operation: prioritize choosing Alipay for payment, with a top-up amount of $10 (which meets the minimum usage requirement for an entry-level server; you can top up more later based on usage duration). After the top-up is complete, confirm the payment has been received. As shown in Figure 3

2. Create a server: After logging into your Vultr account, follow the path Compute – Instances – Deploy Server to enter the server deployment page (as shown in Figure 4). The specific configuration choices are as follows:

– Node selection: Prioritize choosing the Singapore node (closer to the Chinese mainland, with low network latency and more stable speed);
– Server type: Choose Shared CPU (shared CPU, meets daily usage needs, high cost-effectiveness);
– Package selection: The $5 per month entry-level configuration (no need for excessively high specs, sufficient to support WireGuard operation);
– Other settings: Set the automatic backup function to “Disable” (reduces usage costs; you can manually back up key configurations daily); as shown in Figure 5

– Operating system: Choose Ubuntu 22.04 (stronger compatibility, smoother WireGuard installation process, avoids installation conflicts caused by versions that are too high or too low); as shown in Figure 6

– Keep the remaining configurations as default. After confirming there are no errors, click “Create” and wait for the server deployment to complete (usually takes 1-3 minutes).
3. After the server is created, promptly record the core server information: public IP, default login account (the default account is root), and login password. This information is key for subsequent SSH remote logins and WireGuard configuration, so do not omit it.
4. Configure firewall rules: Go to the Vultr backend, follow the path Network – Firewall Groups, click “Add Firewall Group,” and name it wg-work (for easy identification, corresponding to the WireGuard configuration). After creation, add 2 new rules under this firewall group to ensure subsequent operations proceed normally. The specific rules are as follows:
– Rule 1: Select TCP for the protocol, enter 22 for the port, and add the note “SSH Remote Management” (used for subsequent SSH logins to the server for configuration operations);
– Rule 2: Select UDP for the protocol, enter 51820 for the port, and add the note “WireGuard Core Port” (the core port for WireGuard operation, must be open, otherwise normal connection is impossible). As shown in Figure 7

Pitfall avoidance details:
1. When selecting a server node, try to avoid blocked nodes. You can check the availability of a node’s IP in advance using online tools to avoid being unable to access it after deployment;
2. When creating the server, strictly choose the Ubuntu 22.04 system. Do not use versions that are too high or too low to reduce software conflicts during the subsequent WireGuard installation;
3. Firewall rules must be configured accurately. Both rules are indispensable, otherwise SSH login or normal WireGuard usage will fail;
4. When topping up, prioritize choosing Alipay for easier operation. The $10 is enough to support an entry-level server for 1-2 months, avoiding waste from overcharging.

4.2 Step 2: Log into the Server and Install the WireGuard Service
After the server deployment is complete, you need to log into the server via SSH to install and configure the WireGuard service. The specific steps are as follows:
1. SSH into the server: Using a computer terminal (PowerShell or Terminal for Windows, Terminal for Linux/macOS), enter the command ssh root@server_public_IP, enter the server password, and complete the login (for the first login, you will be prompted to confirm the key; just type yes);
2. Install the WireGuard service: One-click installation of WireGuard (copy and paste the entire block to execute) (as shown in Figure 8: Screenshot of the WireGuard installation script)

apt update -y && apt install curl wget sudo -y
curl -O https://raw.githubusercontent.com/angristan/wireguard-install/master/wireguard-install.sh
chmod +x wireguard-install.sh
./wireguard-install.sh

apt update -y && apt install curl wget sudo -y
curl -O https://raw.githubusercontent.com/angristan/wireguard-install/master/wireguard-install.sh
chmod +x wireguard-install.sh
./wireguard-install.sh

3. Configure the WireGuard service: After the script execution is complete, a menu will pop up. Select “1) Add a new user”, enter the client name (e.g., job, for the computer client), and press Enter for all subsequent steps to use the default configuration. The script will automatically generate the client configuration file and server configuration, completing the service deployment. (As shown in Figure 9: Screenshot of the completed client configuration generation)

4. Rule 2: You need to delete the previous 51820, and then re-add it based on the actual port. Select UDP for the protocol, enter 57586 for the port, and add the note “WireGuard Core Port” (the core port for WireGuard operation, must be open, otherwise normal connection is impossible). As shown in Figure 10

5. If the terminal connection times out, you can sometimes connect via Vultr’s web terminal. In this case, you need to manually enter the password corresponding to root. As shown in Figure 11

4.3 Step 3: Install the Client and Solve the Official Client Download Dilemma
After the WireGuard service deployment is complete, you need to install the corresponding client on your computer and phone to successfully connect to the VPN. However, I encountered the most tricky and time-consuming problem here: the local computer had not yet been configured with a VPN connection, so I could not access the official WireGuard website (wireguard.com), making it impossible to directly download the official client. All subsequent operations came to a halt. I tried multiple solutions and spent a lot of time troubleshooting and debugging.
To address the client download dilemma, I successively tried three solutions: configuring a download service on the already deployed server, transferring the installation package via base64 encoding, and finding a reliable third-party client. However, the first two solutions were cumbersome to operate and had compatibility issues, while third-party clients posed security risks, so none achieved the ideal result. Ultimately, by leveraging the temporary state where LetsVPN on my phone could occasionally manage to connect, I successfully solved the client download problem for all devices. This was the most time-consuming and critical step in the entire deployment process.
For different devices, the specific download and installation methods are as follows. At the same time, to prevent subsequent users from encountering the same download dilemma, I will upload the WireGuard official client installation packages for both the computer (Windows system) and phone (Android system) to my personal blog and provide exclusive download links, so everyone can obtain them directly without having to repeatedly try various complex solutions.
(1) Computer Client Installation (Windows System)
Core solution path: Leveraging the network from the phone’s temporary LetsVPN connection, access the official WireGuard download page via the phone’s web browser (as shown in Figure 13), download the Windows system client installation package (wireguard-amd64-1.0.1.msi, as shown in Figure 14), and then transfer the installation package to the computer via file transfer methods between the phone and computer (such as WeChat, QQ, or a USB cable), avoiding the problem of the local computer being unable to access the official site.

Supplementary backup solution (if the above method cannot be implemented):

• Solution 1: Utilize an HTTP download service. Set up a temporary download service through the already deployed WireGuard server. The specific operation steps are: execute the command python3 -m http.server 80 on the server side. When the terminal displays “Serving HTTP on 0.0.0.0 port 80”, it means the download service has started successfully. Then, directly enter the link http://139.180.154.26/wireguard-installer.exe in your local browser to download the WireGuard client installation package. It should be specifically noted that during actual operation, I found that no domestic website provided a direct download for wireguard-installer.exe. Therefore, the HTTP download service set up on this server is the core implementation method of Solution 1, avoiding the issues of accessing the HTTPS official site and the lack of available resources domestically.

python3 -m http.server 8080

python3 -m http.server 8080

• Solution 2: If the HTTP link (http://139.180.154.26:8080/wireguard-installer.exe) cannot be accessed, you can use base64 encoding to encode the client installation package, transfer it to the computer, and then decode and install it (this method is applicable to all scenarios where direct download is impossible; the operation is slightly complex, but the success rate is high).
  Installation process: Double-click the downloaded installation package, click Next all the way. When the Windows Firewall prompt pops up, be sure to click “Allow access” (otherwise, the network adapter cannot be created, affecting subsequent connections). After installation is complete, the client will open automatically. (As shown in Figure 12: Screenshot of the computer client base64 document and the converted installation package) Note: The wireguard-installer.exe installation package still needs to connect to the official WireGuard website during the installation process, so if you want to use base64, you need to use wireguard-amd64-1.0.1.msi instead.

# 下载官方 64 位安装包
wget https://download.wireguard.com/windows-client/wireguard-installer.exe

# 校验一下文件大小，正常约 12MB 左右
ls -lh wireguard-installer.exe
# 服务器上执行
base64 wireguard-installer.exe > wg.txt
# 把 wg.txt 内容全选复制到本地
$b = Get-Content C:\Users\你的用户名\Desktop\wg.txt
[IO.File]::WriteAllBytes("C:\Users\你的用户名\Desktop\wireguard-installer.exe", [Convert]::FromBase64String($b))

# 下载官方 64 位安装包
wget https://download.wireguard.com/windows-client/wireguard-installer.exe

# 校验一下文件大小，正常约 12MB 左右
ls -lh wireguard-installer.exe
# 服务器上执行
base64 wireguard-installer.exe > wg.txt
# 把 wg.txt 内容全选复制到本地
$b = Get-Content C:\Users\你的用户名\Desktop\wg.txt
[IO.File]::WriteAllBytes("C:\Users\你的用户名\Desktop\wireguard-installer.exe", [Convert]::FromBase64String($b))

(2) Mobile Client Installation (iOS/Android)
Download process: Leverage the temporarily available status of LetsVPN on the phone to complete the client download. The specific steps are as follows:
1. Temporarily connect to LetsVPN (it occasionally connects successfully; although the network is unstable, it is sufficient to complete the client download operation);
2. After a successful connection, immediately visit the official WireGuard mobile download page to download the client for the corresponding system (download iOS from the App Store, and Android from Google Play or the official site);
3. After the download is complete, promptly disconnect the LetsVPN connection, install the client, and wait for subsequent configuration.
Pitfall avoidance details:
1. When downloading the client, be sure to choose the official version to avoid downloading third-party modified versions, preventing security risks and connection failures;
2. When installing the client on a computer, if prompted with “Installation Failed”, you need to turn off the computer’s antivirus software first, and then try installing again;
3. To make it easy for everyone to quickly obtain the client and avoid repeating the same pitfalls, I have uploaded the official installation packages for both computer and phone to my personal blog. You can download them directly via the blog link later;
4. When using your phone to connect to LetsVPN for downloading, if the connection is interrupted, you can try reconnecting multiple times, prioritizing nodes with relatively stable signals to ensure the download completes.

4.4 Step 4: Configure Clients to Enable Simultaneous Computer and Phone Connections
After the client installation is complete, you need to import the configuration file generated by the server to connect to the VPN. The computer and phone must use independent configuration files (to avoid conflicts). The specific steps are as follows:
(1) Computer Client Configuration

1. On the server, locate the configuration file for the computer client (job) and copy the configuration content (you can view it with the command cat /etc/wireguard/clients/job.conf);
2. Open the WireGuard client on your computer, click “Add Tunnel → Add empty tunnel”, delete the default content, paste the copied configuration, click “Save”, and name it “Vultr-WG” (for easy identification);
3. Click “Activate” on the right side of the configuration, wait 1 second, and when it shows “Connected”, it means the computer client configuration is complete and you can normally access overseas websites. (As shown in Figure 15: Screenshot of successful computer VPN connection)

(2) Mobile Client Configuration (Solving Multi-device Conflict Issues)
In the initial attempt, I imported the computer’s configuration file into the phone. I found that they could connect simultaneously, but the connection was unstable (WireGuard does not allow two devices to use the same configuration, as it will cause IP conflicts and disconnections). Therefore, an independent configuration file needs to be generated for the phone:

1. SSH into the server, execute the command bash wireguard-install.sh, select “1) Add a new user”, enter the client name (e.g., phone), and press Enter for the default configuration to generate the phone’s exclusive configuration file; (As shown in Figure 16: Screenshot of the mobile VPN connection QR code)

1. You can also copy the content of the phone configuration file and transfer it to the phone via WeChat file transfer, a USB cable, etc. (name it phone.conf to avoid invalid name errors);
2. Open the WireGuard client on your phone, click “+” in the upper right corner, select “Import configuration or archive”, find the transferred phone.conf file, and complete the import; alternatively, scan the QR code;
3. When the VPN permission request pops up, click “Allow”, toggle the switch on the right side of the configuration, and when it shows “Connected”, it means the mobile client configuration is complete. (As shown in Figure 17: Screenshot of successful mobile VPN connection)

(3) Verify Connection Effect
With the computer and phone connected to the VPN simultaneously, open a browser and visit ip.cn to check whether the public IP matches the server’s public IP (the geographical location should show Singapore). Visit YouTube to test the smoothness of 1080p video playback, confirming there are no stutters or disconnections, and that simultaneous multi-device connections work normally without conflicts. (As shown in Figure 18: Screenshot of the phone opening the Google Play Store)

5. Client Installation Package Download Links (Dedicated for Pitfall Avoidance)
As mentioned earlier, when not connected to a VPN locally, you cannot directly access the official WireGuard site to download the client, and domestic websites have no available download resources for wireguard-amd64-1.0.1.msi. To thoroughly solve your download dilemma and avoid repeating the same pitfalls, I have uploaded the WireGuard official client installation packages for both computer and phone to my personal blog, providing exclusive download links. You can obtain them directly with a click, without any complex operations.
The specific download links are as follows (all are official original installation packages, with no third-party modifications, safe and risk-free):

• Computer (Windows System): (Corresponding installation package: wireguard-amd64-1.0.1.msi)
• Mobile (Android System): (Official original version, adapted for various Android models)
  Supplementary note: If the link is inaccessible or the download fails (e.g., errors like “Webpage parsing failed, it may be an unsupported webpage type, please check the webpage or try again later”), you can try to solve it using the backup solutions mentioned in Section 4.3 above (setting up an HTTP download service on the server, base64 encoding transfer), or contact me to update the link.

6. Summary and Subsequent Optimization Suggestions
5.1 Review of the Entire Process
From LetsVPN’s shutdown, to hitting a wall with enterprise VPNs, to successfully self-hosting a WireGuard VPN, the entire process had its twists and turns, but ultimately achieved simultaneous stable connections for multiple devices. The core process is summarized as follows:
LetsVPN shutdown → Researching enterprise VPNs (qualifications + price thresholds too high, abandoned) → Deciding to self-host WireGuard VPN → Choosing Vultr cloud service provider, deploying server → Installing WireGuard service, generating client configurations → Solving the official client download dilemma (HTTP download service, base64, LetsVPN temporary connection) → Configuring independent clients for computer and phone → Verifying connection effect, achieving stable usage.
5.2 Pitfall Avoidance Summary (Key Points)

• Cloud server selection: Prioritize choosing nodes that are close and cost-effective. Choose Ubuntu 22.04 for the system to reduce installation conflicts;
• Client download: When not connected to a VPN, you cannot access the official site. You can obtain the installation package via HTTP download, base64, or a temporary VPN;
• Multi-device configuration: The computer and phone need to use independent configuration files to avoid conflicts and disconnections caused by using the same configuration;
• Script usage: Prioritize using the one-click installation script provided on the server. If the script fails, you can re-download the official script to avoid manual configuration errors.
  5.3 Subsequent Optimization Suggestions

1. Optimize MTU configuration: If the connection is stable but the speed is slow, you can use the nr-wg-mtu-finder tool to find the optimal MTU value and improve transmission speed;
2. Regularly back up configurations: Back up the configuration files of the server and clients locally to avoid losing configurations due to server failures;
3. Adding new devices: If you need to add devices like tablets or backup phones later, you can execute the one-click script again to add new client configurations without needing to redeploy the server.

Although self-hosting a VPN requires certain practical steps, once deployed, its overall stability and usage flexibility far exceed those of various commercial VPNs. Not only do you not need to worry about service provider shutdowns, qualification controls, node throttling, and high subscription fees, but it also fundamentally protects the security of personal network privacy data. Note: The previously used LetsVPN cost $8/month, whereas the current self-hosted VPN costs $5/month. If the network needs to be upgraded later, I can independently increase the bandwidth.
Third-party commercial VPN service providers carry risks of logging user online behavior, collecting data, and leaking privacy. In contrast, a self-hosted service keeps the server and configurations entirely under your control. Traffic is managed by yourself throughout the process, with no third-party intermediaries stealing or retaining online data, offering stronger privacy.
I hope this complete review and pitfall avoidance experience helps friends in need take fewer detours, quickly complete the deployment of a self-hosted WireGuard VPN, and stably solve their daily overseas network access needs.