Reading this alone?
Do it with peers — bi-weekly calls, $29/mo founding.
What it does
A VPN routes your internet traffic through a server somewhere else, so websites see that server's location and IP instead of yours. Most people rent this from a VPN company — but you're trusting a middleman with every packet you send, and paying $10–13/mo for the privilege. This guide does the opposite: you spin up your own VPN server on a cloud account you control, for about the price of a coffee a month.
The engine is Algo (open source, by Trail of Bits). It provisions a tiny cloud server and configures native IKEv2 — the VPN protocol already built into macOS, iPhone, iPad, and Windows. No sketchy third-party app: you install a profile and toggle it on from Settings. We drive the whole thing with the ax-vpn skill in Claude Code, which turns Algo's wizard into a guided install and adds a fleet view and one-command teardown.
Why we use it
You own it, end to end. The server is on your cloud account, the keys are on your machine, and the only logs are the ones you decide to keep (Algo ships with none). A commercial VPN asks you to take their “no-logs” promise on faith. Here there's nothing to trust — you can SSH in and see for yourself.
It's cheaper and you pick the exit country. A smallest-tier cloud box runs roughly €4–6/mo and a VPN is near-zero load, so you never need more. Want to appear in Germany, Finland, the US, or Singapore? Deploy there. Region-locked site, a service that's geoblocked where you are, testing how your own app looks from another country — you just choose the city when you create the server, and delete it when you're done.
Skip the manual work
Get the done-for-you ax-vpn skill
The steps below are the guided flow. Want it hands-off? Grab the free ax-vpn skill — drop it into Claude Code and it runs the whole create / status / delete flow for you. Enter your email and I'll send the download link. Requires Claude Code (it builds the server from your terminal).
Setup checklist
Create a cloud account and generate an API token
Any of Hetzner, DigitalOcean, Vultr, or Linode works — Hetzner is the cheapest and has great EU locations, so we default to it. Sign up at console.hetzner.cloud, create a Project, then go to Security → API Tokens → Generate API Token and choose Read & Write. Copy it immediately — it's shown only once. This token is what lets the installer create the server on your behalf; it never leaves your machine.
Install Algo and the ax-vpn skill
If you run Claude Code with the ax-vpn skill, this is automatic — the skill clones Algo, builds its Python environment, and keeps the cloud libraries current for you. Prefer to do it by hand? Clone github.com/trailofbits/algo, then run python3 -m venv .venv and .venv/bin/pip install -r requirements.txt inside it. You need Python 3.11+.
Save your token (without pasting it into chat)
The skill ships a helper that reads the token straight from your clipboard on any OS. Copy the token, then type (don't paste, so the clipboard stays intact) ~/.axtoken hetzner. It writes the token to a locked-down file (chmod 600) and prints only the character count. The token is never stored in the project, never committed, and never shown back to you.
Create the VPN — pick region and size
Run /ax-vpn create. It pulls the live list of locations and prices from the provider (so you always see what's actually in stock, not a stale table) and asks you to pick a region and the smallest box. Confirm the monthly price and it deploys with native IKEv2 — about 8–12 minutes while it builds the server, certificates, and per-device profiles. Wait for it to finish before you try to connect.
Install the profile on your Mac
When it's done you get a set of .mobileconfig profiles (one per device). Double-click laptop.mobileconfig, then open System Settings → General → VPN & Device Management, click the downloaded profile, and Install. The VPN now appears under System Settings → VPN — toggle it on whenever you want it.
Install on your iPhone
Get phone.mobileconfig onto the phone — the easiest way is to AirDrop it from your Mac. Then follow these steps:
Action steps
- 1Tap the file — iOS says “Profile Downloaded”
- 2Open Settings → General → VPN & Device Management
- 3Tap the downloaded profile, then Install (enter your passcode)
- 4Turn it on under Settings → VPN
Verify your new location
With the VPN on, open a browser or terminal and check the exit country — it should show your server's country, not your home one. Then load whatever you set this up for and confirm the location is accepted.
Confirm your exit country (terminal)
curl -s https://ipinfo.io/country # prints e.g. FI when connected to a Helsinki server
Manage the fleet
/ax-vpn status shows every VPN you've created — region, whether it's reachable, and monthly cost — including any you built before. When you're done with a server, /ax-vpn delete destroys it at the provider and cleans up locally, so the billing stops. Spin them up and tear them down like cattle; there's no subscription tying you to anything.
Pro tips
Match the exit country to the goal — if a service is geoblocked, pick a region where it's allowed. Some services block specific countries (for example the US and France), so a German or Finnish exit is a safe default in Europe. The status view flags this for you as a hint.
Always take the smallest box — a VPN barely uses any CPU or RAM. The cheapest tier a provider offers is more than enough; paying for a bigger server buys you nothing.
Watch for “out of stock” — cheap shared instances sometimes sell out at a given location. If your first choice isn't available, try a nearby city or wait an hour; stock usually returns quickly.
Delete what you're not using — a server keeps billing until it's destroyed. If you only needed the exit for an afternoon, tear it down after; you can always create a fresh one in minutes.
The whole workflow, start to finish
# 1. Save your provider token (type this, don't paste — keeps the token on your clipboard) ~/.axtoken hetzner # 2. Create a VPN — guided: pick provider, region, smallest box /ax-vpn create # 3. See every VPN you own (region, status, cost) /ax-vpn status # 4. Verify your exit country once connected curl -s https://ipinfo.io/country # 5. Tear one down when you're done (stops billing) /ax-vpn delete
Mistakes to avoid
- ✕Using a free VPN app — if you're not paying, your traffic is the product; free VPNs routinely log and sell it
- ✕Trying to connect before the deploy finishes — wait for the “done” confirmation, or the tunnel will start and stall
- ✕Picking an exit country that the service you want blocks — check the region before you deploy, not after
- ✕Leaving a server running you forgot about — it bills every month until you delete it; check /ax-vpn status now and then
- ✕Pasting your API token into a chat or committing it to a repo — keep it in the local chmod-600 file the helper writes, and rotate it if it ever leaks
- ✕Over-sizing the server — a VPN needs the smallest instance; anything bigger is wasted money
Reading this and want to actually do it with others?
The community is bi-weekly live calls, async accountability, and a group of builders shipping in parallel. Founding seats are $29/mo.
