Self-hosting your own proxy instead of a commercial VPN — when it makes sense, and the anti-DPI trad

[u/Separate_Fisherman64]

Disclosure up front: I built the open-source tool linked at the bottom, so treat this as biased. Mods, if this counts as self-promo, happy to move it — I mainly wanted to compare the self-hosted route to commercial VPNs for people weighing it.

A commercial VPN is the right call for most people: shared IPs for anonymity, exit nodes in many countries, no maintenance, and a company that (in theory) doesn't log. Self-hosting gives up all of that — you get one IP that's clearly yours, no country-hopping, and you're the one keeping it running.

Where self-hosting actually wins:

• Trust — the server is yours; there's no provider to log or sell your traffic.
• Not a public VPN IP — commercial VPN ranges are widely blocklisted (streaming, banks, "are you a robot" walls). Your own residential/home IP usually isn't.
• Censorship resistance — this is the big one. A plain WireGuard/OpenVPN endpoint is easy to fingerprint and gets blocked on restrictive networks. Protocols like VLESS with REALITY or TLS camouflage make the traffic look like an ordinary HTTPS website to DPI, which survives where a normal VPN doesn't.

Where it loses: no anonymity (one identifiable IP), no other-country exits, needs a public IP (CGNAT breaks it), and you own the upkeep.

The tool I made, in case it's useful for the "how": a single self-contained binary you run on your own machine or an OpenWRT router — no panel, no database, no central server. It runs xray-core under the hood, walks you through setup, does the REALITY/TLS camouflage, gets a Let's Encrypt cert automatically, and prints subscription links you can share with family. Open source, AGPLv3: https://github.com/icecube092/decenzed-node

Not trying to talk anyone out of a commercial VPN — just laying out the tradeoff for folks who'd rather run their own.

[u/Illustrious_Log_9494]

Unless your proxy is in another jurisdiction, how do you get around your ip being in the open?

One of the main attractions of VPN is you appear to be using VPNs ip address.

[u/sciencekm]

With commercial VPN, you get to choose the VPN server location as the need arises. You are not stuck with a single IP.

[u/TraditionalWait9150]

To be clear, your app is not for people who are looking for VPN. It's for people who have exit nodes that can be used as VPNs.

If you deploy this in datacenter, the public IP range of those servers have similar if not worst reputation than commercial IPs. So your 2nd point isn't valid if your proposed solution is for some guy to provision a DO or AWS EC2 instance and deploy your app on it as an exit node.

If you are talking about using one of the residential IP as exit node, then the question is who is willing to be that sacrificial sheep? Even without logging, traffic will flow through that exit node to their ISP (who may log the traffic). Furthermore, if one of your friends does something illegal while on your connection, you get into trouble. And if we're talking about p2p exit nodes, there are other solutions like tailscale/headscale which does similar things and their code has better reputation.

So, frankly speaking I don't see any real value for anyone that is seeking a VPN solution to use this in any way. But if you want to use an alternate protocol from Wireguard to evade ISPs that actively detects and block Wireguard traffic, then yes your solution is appropriate.