How do I start my own VPN service on rented servers?

What does running a VPN for other people involve?

Running a VPN for other people means their traffic reaches the internet under your IP addresses. Every site they visit sees your server, not them. The service is three jobs at once: a network, a small business and a complaints desk.

• Exit servers: one machine per city you sell, running WireGuard, OpenVPN or both.
• Keys: one key per device, issued, rotated and revoked without touching other users.
• Billing and support: your prices, your refund rules, your help pages.
• User terms: rules your customers accept, at least as strict as your host's.
• Abuse desk: a working complaints address and a fast way to close one account.
• Logging policy: a written decision on what you record, checked against your own country's law.

A VPN service sells a promise about other people's traffic, so its rules matter as much as its servers.

How many servers do I need, and where should they go?

Start with one server per city you want to offer. Reykjavik (Iceland), Zurich (Switzerland), Bucharest (Romania) and Amsterdam (Netherlands): every berth in every port of call, at one price. A customer who wants an exit outside the EU picks Reykjavik or Zurich; one who wants an EU address picks Amsterdam or Bucharest. The page on the best country for hosting a VPN server compares the four from the operator's side.

How much traffic can one VPN server carry?

The port speed sets the ceiling, and on Ravenquay nothing else does: no quota, no overage bill. A 1 Gbit/s port running flat out moves at most 324 TB in 30 days, and a 10 Gbit/s port 3,240 TB.

Each user's share depends on how many are active at once. A saturated 1 Gbit/s port shared by 100 active users gives each about 10 Mbit/s; shared by 20, about 50 Mbit/s.

These figures are arithmetic, not measurements: Ravenquay publishes no speed tests of its own. Encryption also costs CPU. That is why how fast WireGuard is on a 10 Gbps server depends on the processor.

Which VPN protocols should the service offer?

Offer WireGuard as the default and OpenVPN as the fallback. They solve different problems, and both run on the Linux systems we install.

• WireGuard has shipped in the Linux kernel since version 5.6, announced on 30 March 2020. It carries IP packets over UDP only. Its documentation says it does not tunnel over TCP and does not focus on obfuscation.
• OpenVPN runs over TCP or UDP. Its --tls-crypt option encrypts the control channel, hides the certificate and makes the traffic harder to identify. With --tls-crypt-v2, each client gets its own key.

Key handling decides your daily work. In WireGuard, wg set wg0 peer <key> remove drops one device and leaves every other peer connected. Client-specific tls-crypt-v2 keys let OpenVPN retire one customer alone. Users behind national blocks need more: see how to host a VPN that works in censored countries.

How do abuse complaints work when users share your IP?

Complaints about your users' traffic come to you, because the far side sees only your server. Our rules, listed in the table above, cover everything that leaves the machine, and a breach by your user is a breach on your server.

One rule already removes the commonest VPN abuse. Port 25 is closed for outgoing mail on every server, permanently, to keep spam off the network; ports 465 and 587 toward mail providers stay open.

The acceptable use policy says you answer for the logins you hand to others. Build the desk before the first customer:

• Publish an abuse address and read it every day.
• Copy our banned uses into your user terms, so you can close an account on the same grounds.
• Tie each key to one account, so one key can go without a restart.
• Decide how you answer a complaint you cannot trace. A report names your shared IP and a time, not a person. Without connection logs, it points to nobody, so write your response into your terms.

Who keeps logs: you or Ravenquay?

Logging happens on two layers, each with its own owner.

Our layer: We keep no logs at all: no connection records, no traffic records and no IP addresses of visitors or customers, whether on the website, in the dashboard or on the servers.

Your layer: the VPN software is yours, and so is its logging. What you record is your choice and, where a law requires it, your legal duty. That duty comes from the law of your company's country and of each server country. Even with logging off, WireGuard keeps each peer's latest endpoint, last handshake and transfer counters in memory; wg show prints them.

The EU Court of Justice ruled on such rules on 6 October 2020. National law may require general retention of the IP addresses assigned to the source of a connection. The Court allowed it to fight serious crime, for a period limited to what is strictly necessary. Whether a national rule reaches your service is a question of that country's law. Our overview of which European countries still have data retention laws gives the country rules. This page explains rules; it is not legal advice.

Can I build a VPN service on servers rented without KYC?

Yes, on our side. No KYC: no ID, no selfie, no documents, no card and no phone number, ever. You top up a balance with BTC, USDT, USDC, ETH, SOL, LTC, from $25, and pay each berth from it.

According to Ravenquay's survey of 30 October 2026, 11 of 18 crypto-paid, no-ID hosts with a comparable dedicated plan sold any unmetered server, and only 4 an unmetered 10 Gbit/s port. On a VPN, every download crosses your port twice, so a traffic quota is the cost that grows with success.

Service is not open everywhere. Service is not available to residents or companies of Cuba, Iran, North Korea, Syria, Russia, Belarus, China, Yemen or Western Sahara, nor in the occupied regions of Ukraine.