Roll your own VPN.

A WireGuard server on your cloud account, in about three minutes.

Already have a VPN? Open your save file

Get your configs back, check the server, add time or delete it. The file never leaves this tab.

1

Choose where it runs

You pay the provider directly. SporeStack needs no account and takes Monero.

2

Choose a location

Sites will see you here. Closer is faster.

3

Make keys for your devices

Each device gets its own key.

Advanced options
4

Launch your server

This creates a small Ubuntu 24.04 server. On first boot it:

  • Keeps no logs: no journal, no syslog, /var/log in RAM, no swap, no core dumps.
  • Wipes a device's IP from memory a few minutes after it goes quiet.
  • Runs its own DNS with no query logs, blocking ads and trackers by default.
  • Removes provider agents, usage stats, snap, crash reporting and Ubuntu's ad pings.
  • Locks itself down: firewall on, root locked, SSH off unless you keep it, devices unreachable from outside and from each other.
  • Deletes its setup traces. Your provider still keeps its own copy of this script.
  • Exits through Cloudflare WARP, unless you turned it off.
  • Installs security updates automatically, and restarts WARP or DNS if they stop working.
Read the script 

        

        
        
        
By continuing, you agree to the terms.

        

      

    


    
    

      
5
Set up WireGuard

      

        
        
    
          
  1. Server ordered
    2. 
          
  2. Booting
    3. 
          
  3. Setting up
    4. 
          
  4. Ready
    5. 
        

        
        

      

    


    
    

      
6
Connect your devices

      

        
Get the WireGuard app (
          iPhone ·
          Android ·
          Mac ·
          Windows/Linux
          ), then scan the QR code or import the file. Delete the downloaded files afterwards.

        
Save these now. The keys exist only in this tab.

        
        

          Keep the VPN on automatically
          
    
            
  • iPhone, iPad, Mac: edit the tunnel and turn on On-Demand for Wi-Fi and cellular. To skip your home Wi-Fi, use Except these SSIDs. It's not a strict kill switch.
    • 
            
  • Android: Settings → Network → VPN → ⚙ WireGuard → Always-on VPN and Block connections without VPN.
    • 
            
  • Windows, Linux: nothing to do.
    • 
          

        

        

        

          
        

        

          
Save file

          
Open it here later to get your configs, check the server, add time or delete it.

          
Keep this file secret. It holds every key for this VPN and your provider token. Set a password, don't email it or put it in a cloud folder, and delete it when you delete the server.

          
          
          
          

        

        

          
Done with it?

          
Deleting the server stops billing.

          
          
          

        

      

    


    

      
Why you don't have to trust us

      

        

          
No server

          
rollavpn is static files. Its Content-Security-Policy only lets it reach the four provider APIs, so it can't send anything to us.

        

        

          
Your keys

          
Keys are made in your browser and only leave in files you download. The server's key travels in its setup script, which your provider (and SporeStack, if used) can see.

        

        

          
Nothing to log in to

          
SSH is off and root is locked unless you add a key. The only way in is WireGuard.

        

        

          
Read it first

          
Step 4 shows the exact script. The whole app is about 2,600 lines, with no build step.

        

      

    


    

      
Open source

      

        

          
WireGuard

          
WireGuard is small enough to read, built into Linux since 5.6, and its protocol has formal proofs. The server uses the version in Ubuntu's kernel.

        

        

          
Build it yourself

          
Skip app-store binaries and build from the official source. On Linux:

          
git clone https://git.zx2c4.com/wireguard-tools
make -C wireguard-tools/src
sudo make -C wireguard-tools/src install

          
The other apps are in wireguard-apple, wireguard-android and wireguard-windows.

        

        

          
Someone else's hardware

          
A cloud server runs on someone else's computer. Its owner can read memory, copy the disk and watch traffic. No logs means nothing to hand over, but nothing on the server stops a host that's watching.

        

        

          
True of every VPN

          
Any VPN's "no logs" is a promise about hardware you can't inspect. rollavpn limits what one host can learn instead: pay anonymously, add a second hop, delete old servers. The only hardware you can fully trust is your own.

        

      

    


    

      
What it does and doesn't do

      

        

          
It hides you from

          
The Wi-Fi you're on and your ISP. Sites see the server's IP, not yours.

        

        

          
Anonymity

          
Your provider knows who pays. Use SporeStack so nobody does, and Second hop so no host sees both ends. Without WARP, sites see an IP only you use; a fresh server now and then breaks the link.

        

        

          
It can't hide you on a site

          
Logins, cookies and fingerprinting still identify you. Use separate browsers for separate identities, or Tor Browser.

        

        

          
VPN detection

          
Some sites block cloud IPs. WARP helps, but its addresses are still listed as VPN. Only a home connection looks like home, which is what Your own server is for.

        

      

    


    

      
Run it locally

      
Get the source and serve the web/ folder from localhost. Opening the file directly won't work.

      
git clone https://github.com/rollavpn/rollavpn.git
cd rollavpn
node serve.mjs          # or: python3 -m http.server -d web 8000
# open http://localhost:8000

      
No dependencies.