How to Build a VPN Server on Hong Kong VPS: OpenVPN and WireGuard (2026)

A personal VPN server on a Hong Kong VPS with CN2 GIA routing gives you a dedicated, private tunnel — not a shared commercial VPN with unknown logging policies and overloaded servers. Traffic routes through Hong Kong, giving international users optimised access to Greater China services and giving mainland Chinese users a stable path to international content, all on infrastructure you fully control.

Legal note: VPN legality varies by jurisdiction. Ensure your use case complies with local laws. This guide is intended for legitimate use cases: corporate remote access, developer testing across regions, and secure remote work connectivity.

OpenVPN vs WireGuard: Choosing Your Protocol

Recommendation: WireGuard for speed and simplicity on most use cases. OpenVPN on TCP port 443 when traversing restrictive firewalls that block UDP.

Option A: WireGuard VPN Server (Recommended)

Install WireGuard

apt update && apt install -y wireguard ufw

# Enable IP forwarding
echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
echo "net.ipv6.conf.all.forwarding=1" >> /etc/sysctl.conf
sysctl -p

# Determine your main network interface name
ip -o -4 route show to default | awk '{print $5}'
# Note the interface name (commonly: eth0, ens3, ens18)

Generate Server Keys

cd /etc/wireguard
umask 077
wg genkey | tee server_private.key | wg pubkey > server_public.key

cat server_public.key   # Save this — clients need it
cat server_private.key  # Keep private

Server Configuration

cat > /etc/wireguard/wg0.conf << EOF
[Interface]
PrivateKey = $(cat /etc/wireguard/server_private.key)
Address = 10.8.0.1/24
ListenPort = 51820

# NAT — replace eth0 with your actual interface name
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; \
         iptables -A FORWARD -o wg0 -j ACCEPT; \
         iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; \
           iptables -D FORWARD -o wg0 -j ACCEPT; \
           iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
EOF

systemctl enable --now wg-quick@wg0
ufw allow 51820/udp

Add a Client

# Generate client keypair (do this for each device)
CLIENT_PRIVATE=$(wg genkey)
CLIENT_PUBLIC=$(echo $CLIENT_PRIVATE | wg pubkey)

echo "Client private key: $CLIENT_PRIVATE"
echo "Client public key:  $CLIENT_PUBLIC"

# Add client peer to server config
cat >> /etc/wireguard/wg0.conf << EOF

[Peer]
PublicKey = $CLIENT_PUBLIC
AllowedIPs = 10.8.0.2/32
EOF

# Apply without restarting
wg set wg0 peer $CLIENT_PUBLIC allowed-ips 10.8.0.2/32

# Verify
wg show

Client Configuration File

<code">cat > ~/client1.conf << EOF
[Interface]
PrivateKey = CLIENT_PRIVATE_KEY_HERE
Address = 10.8.0.2/24
DNS = 1.1.1.1, 8.8.8.8

[Peer]
PublicKey = $(cat /etc/wireguard/server_public.key)
Endpoint = YOUR_VPS_IP:51820
AllowedIPs = 0.0.0.0/0, ::/0    # Route all traffic through VPN
PersistentKeepalive = 25
EOF

Import this .conf file into WireGuard apps on macOS, Windows, iOS, or Android. All traffic routes through your Hong Kong VPS.

Option B: OpenVPN on TCP 443 (Firewall Bypass)

OpenVPN running on TCP port 443 is indistinguishable from HTTPS traffic at the firewall level — essential in environments that block non-standard UDP ports.

Easy Install with pivpn

<code"># pivpn automates the PKI and OpenVPN configuration
curl -L https://install.pivpn.io | bash
# Interactive installer:
# - Choose: OpenVPN
# - Port: 443
# - Protocol: TCP
# - DNS: 1.1.1.1
# - Public IP: YOUR_VPS_IP
# - Elliptic Curve: ECDSA (faster than RSA)

Add Clients

<code"># Create a client profile
pivpn add -n laptop

# Download the generated .ovpn file to your local machine
scp root@YOUR_VPS_IP:~/ovpns/laptop.ovpn ~/

# Import into OpenVPN Connect (iOS/Android/macOS/Windows)

Option C: Automated Setup with angristan/openvpn-install

<code"># One-command OpenVPN server setup
curl -O https://raw.githubusercontent.com/angristan/openvpn-install/master/openvpn-install.sh
chmod +x openvpn-install.sh
./openvpn-install.sh
# Follow prompts — creates server and first client in ~5 minutes

Multi-Client Management

WireGuard — Add More Clients

<code"># Script to add a new WireGuard client
add_wg_client() {
  NAME=$1
  IP=$2  # e.g., 10.8.0.3
  
  PRIV=$(wg genkey)
  PUB=$(echo $PRIV | wg pubkey)
  
  # Add to server
  cat >> /etc/wireguard/wg0.conf << EOF # Client: $NAME [Peer] PublicKey = $PUB AllowedIPs = $IP/32 EOF wg set wg0 peer $PUB allowed-ips $IP/32 # Generate client config cat > ~/${NAME}.conf << EOF
[Interface]
PrivateKey = $PRIV
Address = $IP/24
DNS = 1.1.1.1

[Peer]
PublicKey = $(cat /etc/wireguard/server_public.key)
Endpoint = YOUR_VPS_IP:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25
EOF
  
  echo "Client $NAME created: $IP — config at ~/${NAME}.conf"
}

add_wg_client "phone" "10.8.0.3"
add_wg_client "tablet" "10.8.0.4"
add_wg_client "office-laptop" "10.8.0.5"

Split Tunneling: Route Only Specific Traffic

By default (AllowedIPs = 0.0.0.0/0), all internet traffic routes through your Hong Kong VPS. Split tunneling routes only specific networks through the VPN:

<code"># In client config — only route traffic to specific IPs/ranges through VPN
# Example: route only China IP ranges through HK VPS, everything else direct
AllowedIPs = 203.0.0.0/8, 116.0.0.0/8, 120.0.0.0/8    # China Telecom ranges
             # (Replace with actual China CIDR list)

# Example: route only company internal network through VPN
AllowedIPs = 10.100.0.0/16    # Company private network only

Monitor Connected Clients

<code"># WireGuard — see all connected peers and traffic
wg show

# Check which clients have active sessions (handshake within last 2 minutes)
wg show wg0 latest-handshakes | while read peer ts; do
  AGE=$(($(date +%s) - ts))
  STATUS="offline"
  [ $AGE -lt 180 ] && STATUS="online (${AGE}s ago)"
  echo "Peer ${peer:0:10}...: $STATUS"
done

# Bandwidth per peer
wg show wg0 transfer

Performance: VPN Latency from Key Asia Locations

VPN overhead is additive — if your device in Shanghai needs to reach a target in the US, routing via HK VPS (30ms to HK, then 180ms HK to US) totals ~210ms versus ~200ms direct. VPN via HK VPS is most useful when: you need the HK IP address, you’re accessing Hong Kong or Greater China services, or you need to bypass geolocation restrictions.

Conclusion

A personal VPN server on a Hong Kong VPS provides a dedicated, private, CN2 GIA-connected tunnel that commercial VPN services cannot match — no shared infrastructure, no logging by third parties, and a Hong Kong exit IP that provides optimal access to Greater China services. WireGuard is the recommended protocol for its speed and simplicity; OpenVPN on TCP 443 is the fallback for restrictive network environments.

Build your private VPN: Browse Server.HK Hong Kong VPS plans — a 1–2 GB plan handles WireGuard or OpenVPN for a personal or small-team VPN alongside other services.