Systems · September 16, 2026
What a Personal WireGuard VPN Costs on AWS
Measured prices for a self-hosted WireGuard VPN on AWS, why Lightsail beats EC2 for this workload, and the user data trap that boots an instance with no VPN on it.
By Shihab Shahriar Antor · Updated 2026-09-16
Most guides to self-hosting a VPN stop at the software. The software is the easy part. What decides whether you keep the thing running is the bill, and the bill is dominated by two line items that have nothing to do with WireGuard: the public IPv4 address and egress bandwidth.
These figures come from building and running wireguard-anywhere, a shell tool that provisions the server, generates the keys and deletes it again. Every number below was read from the AWS pricing and Lightsail APIs on 16 September 2026, not from a pricing page screenshot.
Lightsail is roughly half the price of EC2 here
A VPN is an unusual workload: it needs almost no CPU and a lot of egress. EC2 prices those separately and charges for the address by the hour. Lightsail bundles a public IPv4 address and a transfer allowance into one flat price, which suits this shape of workload much better.
| Option | Per month | Egress included | Notes |
|---|---|---|---|
| Lightsail nano | $5.00 | 1 TB | 2 vCPU, 512 MB, IPv4 included |
| Lightsail nano, IPv6 only | $3.50 | 1 TB | Unreachable from IPv4 only networks |
| Lightsail micro | $7.00 | 2 TB | 1 GB RAM |
| EC2 t3.micro plus IPv4 plus 8 GB EBS | $11.88 | 100 GB | Account wide allowance, then $0.09/GB |
| EC2 t4g.nano plus IPv4 plus 8 GB EBS | $7.36 | 100 GB | ARM, cheaper compute, same address charge |
Read from the AWS Price List API and lightsail get-bundles on 16 September 2026. The EC2 rows include the public IPv4 charge of $0.005 per hour that has applied since February 2024, which is $3.65 a month on its own.
The number of regions does not drive the cost
Lightsail bills hourly and prorates partial months. A stopped instance is still billed, so the only thing that stops the meter is deleting it. That sounds like a drawback until you notice the consequence: you can only be connected to one VPN region at a time, so if you delete servers when you are done, the count of regions you keep stops mattering. Connected hours are the whole bill.
| Usage | Hours per month | Cost |
|---|---|---|
| 2 hours a day | 61 | $0.42 |
| 4 hours a day | 122 | $0.84 |
| 8 hours a day | 243 | $1.67 |
| Always on | 730 | $5.00 |
$5.00 divided by 730 hours is $0.006849 per hour. The transfer allowance prorates the same way, so an instance alive four hours a day receives roughly 170 GB of the 1 TB bundle.
What makes this practical is keeping the server keypair on the client machine and injecting it at launch. Destroying and recreating a region then reproduces the same server public key, so the only line that changes in a client config is the endpoint address. Without that, hourly use means reissuing configs to every device each time.
The trap: Lightsail runs user data as a shell script
This cost three rebuilt instances before it was diagnosed, and the symptom is deceptive. The instance reaches the running state, the console shows it healthy, and nothing at all is installed on it.
Lightsail hands user data to the cloud-init script handler rather than the config handler, and it concatenates its own bootstrap script with yours into one file. Two consequences follow. A #cloud-config YAML payload is executed line by line by dash, so package_update: is treated as a command and fails. And because your file is no longer first, its shebang is a comment in the middle of someone else’s script, so a bash-only construct aborts the whole run at the first line.
A running instance proves nothing
The lesson generalises past this one bug. Instance state tells you the hypervisor started a virtual machine. It says nothing about whether your software is on it. Three checks are worth wiring up, in increasing order of confidence.
- 01
Network volume as a proxy
The bootstrap downloads 38 to 40 MB of packages. Query the NetworkIn metric: anything under about 1 MB means the script never ran. This needs no access to the box, which matters when SSH is deliberately closed. The metric lags roughly five minutes, so do not conclude failure before then.
- 02
A readiness marker on disk
Have the bootstrap write a file only after the interface is confirmed up, and retry a few times before giving up. Checking for that file is unambiguous in a way that reading a log is not.
- 03
A real handshake
Run wg show wg0 dump and read the fifth field. Zero means no client has ever completed a handshake. Received and transmitted byte counters moving is the only proof the tunnel carries traffic.
Where it is genuinely free
The free tier question has a real answer, and it is not the one most comparisons give. For a VPN the constraint is egress, not compute. Most free tiers are generous with CPU and stingy with bandwidth, which is the wrong way round for this.
| Provider | What a new account receives | How long that runs a VPN |
|---|---|---|
| Azure | 750 hours a month of a B1s instance, free for 12 months | 12 months, always on, one region |
| AWS | $100 in credits, $200 after onboarding tasks | Up to 6 months, since the Free plan closes at six months |
| Google Cloud | $300 trial credit | 90 days |
| Oracle Cloud | Always Free: 2 OCPU, 12 GB RAM, 10 TB egress | Indefinitely, when capacity is available |
Checked 16 September 2026. AWS replaced the twelve month free tier with a credit model on 15 July 2025, so accounts created after that date do not get free EC2 hours. Oracle reduced its Always Free ARM allowance from 4 OCPU and 24 GB to 2 OCPU and 12 GB on 15 June 2026.
Two entries deserve a caveat. Oracle Cloud Always Free is the only tier with enough bandwidth to run a VPN indefinitely at 10 TB a month, but ARM capacity is frequently unavailable and the allowance was cut without an announcement. Google Cloud’s Always Free instance includes 1 GB of egress a month, which one video call exhausts; use the trial credit instead and treat the always free tier as unusable here.
What this buys and what it does not
Running your own server moves trust from a VPN company you cannot audit to a machine you control, with keys that never leave your laptop. It hides traffic from the local network and from an internet provider. It does not make anyone anonymous: traffic leaving the server is attributable to the cloud account that pays for it. Anyone promising otherwise is selling something.
Questions
- Is a self-hosted VPN cheaper than a commercial one?
- At two hours a day it is about $0.42 a month against $5 to $13 for a subscription. Left running all month it is $5.00, which is comparable. The saving comes from deleting the server when it is idle, not from self-hosting by itself.
- Why Lightsail instead of EC2?
- A $5 Lightsail bundle includes the public IPv4 address and 1 TB of transfer. The equivalent t3.micro is $11.88 a month once the hourly IPv4 charge and the EBS volume are counted, and it bills egress beyond a 100 GB account wide allowance.
- Does deleting the server invalidate my client configs?
- Only if the server keypair is generated on the server. Generate it on the client machine and inject it at launch, and a recreated region keeps the same server public key. Just the endpoint address changes.
- Will a self-hosted VPN work with streaming services?
- Usually not. Streaming platforms block datacentre address ranges and cloud ranges are well known. This is a privacy and security tool rather than a way to change region.
- Is WireGuard faster than OpenVPN?
- Generally yes. It runs in kernel space, uses modern cryptography and is a few thousand lines of code rather than hundreds of thousands. It also resumes instantly after a network change, which is the difference you notice on a phone.
- Which region should I pick?
- The one physically closest to you. Latency decides how a VPN feels; bandwidth almost never does. A server 200 ms away feels slow no matter how much throughput it has.
The tool these figures came from is open source and documented at github.com/shihabshahrier/wireguard-anywhere, including an agent guide so a coding agent can provision and verify a server without supervision.