Your ISP sees every site you visit.
It saw Pornhub at 2:14 a.m.
It saw the clinic you googled.
It saw 37 minutes on your bank’s site.
Incognito mode doesn’t hide any of this from them.
Build your own VPN for $0. Full guide inside. https://x.com/i/article/2117324592440033282
Your ISP sees every site you visit. Build your own VPN for $0
It saw Pornhub at 2:14 a.m. It saw the clinic you googled yesterday morning. It saw you spend 37 minutes on your bank's site. It saw that site you opened in incognito, thinking "no one will know."
Incognito only hides your history from your wife, your mom and your coworkers. Not from your ISP. And not from whoever it might hand the logs to later (at the government's request or in a leak).
I wanted to see it with my own eyes, so I built a small tool that shows in real time what my ISP sees. I opened a couple of sites on my phone and watched the list fill up with sites and trackers I never even clicked.
Then I turned on my VPN. The list went quiet. All that was left was one encrypted connection to my server.
In this guide I'll show you how to set up a VPN like that yourself. About 15 minutes, one command, and it can cost $0.
Who sees what
Your ISP sees every site you connect to, when you opened it and how long you stayed. It doesn't need to read your messages: the list of sites already tells the whole story.
Without your own VPN, you leave that story with your ISP. Anyone who gets those logs gets the list of sites you visited. Your own VPN changes the picture: your ISP sees one encrypted connection to your server and nothing else.
Airport and café Wi-Fi is even worse. It's often open, and sometimes it's a fake hotspot. Whoever runs it sees every site. And a fake hotspot can quietly swap your bank's login page. You type your password and card details, and they don't go to the bank. With the VPN on, the hotspot only sees ciphertext and can't redirect you anywhere.
And not every site uses HTTPS. On a site without it, everything you type (logins, passwords, card numbers) travels as plain text. Anyone on the same Wi-Fi network can read it. Your VPN encrypts the traffic the moment it leaves your phone.
ISP logs can be kept for months or years. They can be requested by court order. In some cases they leak or end up available to third parties. Your own VPN doesn't make you fully invisible: your host still sees the traffic leaving the server. But your ISP no longer sees site names. And the list of names is usually exactly what people who request the logs are after.
Why build your own
A paid VPN just moves the surveillance from your ISP to the VPN company. You have to trust that company with every site you open and take its word on logs.
With your own server there's no middleman. The keys are created on your server and never leave it. The code is open, so you can read exactly what it does. And the server itself can be free.
The script I use is called coolervpn. It installs WireGuard (the VPN built into the Linux kernel) and sets up everything else for you. I built it with Claude Code, and it's free on GitHub.
Step 1: Get a server
You need a small server running Ubuntu 22.04 or 24.04. The cheapest plan at any host is enough for a VPN.
Free: Oracle Cloud Always Free
1. Sign up at signup.cloud.oracle.com. They ask for a card to check you're a real person; Always Free servers aren't charged. Turn off any VPN while signing up: their anti-fraud rejects it.
2. Pick your home region carefully. You can't change it later. Choose a country close to you, but not your own if privacy from your own government matters to you.
3. In the console, go to Compute → Instances → Create instance.
4. Image: click Change image and choose Canonical Ubuntu 24.04.
5. Shape: click Change shape → AMD → VM.Standard.E2.1.Micro. It's marked Always Free-eligible.
6. Networking: leave the defaults and check that "Assign a public IPv4 address" is on.
7. SSH keys: choose "Generate a key pair for me" and click Save private key. Keep this file, you'll use it to log in to the server.
8. Click Create and wait for the status to turn green. Copy the Public IP address.
Other options, if you like
If Oracle won't let you in or you want a different host, any Ubuntu server works:
- Microsoft Azure: a small server free for 12 months for new accounts.
- AWS: new accounts get free credits for the first 6 months.
- A paid VPS from about $5 a month: Hetzner, DigitalOcean, Vultr and others. Take the smallest plan with Ubuntu 24.04. Most bill by the hour, so you can try it for a couple of cents and delete it.
Whatever you pick, choose a data center in another country. If your host blocks VPN traffic by default, the script will tell you what to turn on.
Step 2: Install the VPN with one command
The installer is free on GitHub: github.com/Coolerwave/coolervpn. It works on any Ubuntu server, and all you need is a terminal.
Open Terminal on a Mac (or PowerShell on Windows) and connect to the server with the IP and password your host gave you:
ssh root@YOUR_SERVER_IP
On Oracle the user is ubuntu, and you log in with the saved key file instead of a password: ssh -i ~/Downloads/your-key.key ubuntu@YOUR_SERVER_IP
If it asks about a fingerprint, type yes. When you see the server prompt, paste:
curl -O https://raw.githubusercontent.com/Coolerwave/coolervpn/main/coolervpn.sh
sudo bash coolervpn.sh
A short menu appears:
coolervpn: your own WireGuard VPN
1) Single VPN one server
2) Double VPN two servers in two countries
Choose [1]:
Press Enter to choose Single VPN. The script asks three more questions, and Enter is the right answer to all of them:
1. The server's public IP. It finds it by itself.
2. The port, 51820.
3. Which DNS your devices will use: Google by default, or Cloudflare, Quad9, or a private DNS on your own server.
It installs everything in about a minute, then asks for a device name. Type phone and press Enter.
Step 3: Connect your phone and computer
Phone
A QR code appears right in the terminal.
1. Install the WireGuard app from the App Store or Google Play.
2. Tap + → Create from QR code. Scan inside the app: the regular camera will just open a browser.
3. Name the tunnel, allow it to add a VPN configuration and switch it on.
Computer
Make a separate config for each device. On the server:
sudo bash coolervpn.sh --add laptop
The easiest way to get it onto your computer: print it on the server and copy the text.
sudo cat /etc/wireguard/clients/laptop.conf
In the WireGuard app on your computer, click + → Add Empty Tunnel, replace everything in the window with the copied text, save and click Activate.
If you log in as root, you can also download the file. Open a new Terminal window on your computer (not on the server) and run:
scp root@YOUR_SERVER_IP:/etc/wireguard/clients/laptop.conf ~/Downloads/
Then in WireGuard choose Import tunnel(s) from file and pick laptop.conf.
Run sudo bash coolervpn.sh again any time and a menu opens: add or remove a device, show a QR code again, or remove the VPN.
Step 4: Check that nothing leaks
With the VPN on, open browserleaks.com/ip. The IP should be your server's, and the IPv6 and WebRTC rows shouldn't show your real address.
Then open dnsleaktest.com and run the test. It should only show the DNS you chose (Google, Cloudflare and so on). If your home ISP's name shows up, your DNS is leaking.
Both tests came back clean for me on the first try.
Want more? Double VPN
With two servers in two countries, no single server knows both who you are and which sites you open. If the second server goes down, traffic stops instead of going straight out through the first one.
1. On the second server (exit), run the script and choose 2 → EXIT. It prints a long key.
2. On the first server (entry), choose 2 → ENTRY and paste the key.
3. Scan the QR code from the entry server.
What a VPN doesn't do
It hides the sites you visit from your ISP. It doesn't protect you from viruses or phishing, and it can't hide who you are once you log in to an account. Your host can see the traffic leaving the server, the same way your ISP used to.
15 minutes. One command. $0.
Or leave everything as it is and keep hoping the logs never surface.
Where to get it
The script and the dashboard from the screenshots are free and open source: github.com/Coolerwave/coolervpn
Built with Claude Code. Questions? Drop them in the replies.