Security · checked 2026-10-19Can I vibecode NordVPN?
NOT REALLY· don't bother
The tunnel itself is an evening's work: WireGuard on a rented server, a script that creates peers, and the official WireGuard apps as clients. What NordVPN rents out is the pool: thousands of servers in more than a hundred countries whose addresses are shared by many customers, plus a no-logs promise the company says outside auditors have checked. Your own server gives you one fixed address in one datacenter range, tied to your hosting account and often blocked by streaming sites. It covers safe café Wi-Fi and a stable IP, not country-hopping or blending into a crowd.
$14.99/moprice
$180it costs you a year
one sittingbuild time
—people replaced it
What you need on hand.
DifficultyIntermediate · Some system setup or keys.
TimeAbout an hour; most of it is the cloud account
- Claude Code, Codex or CursorAny of them can run the prompt.
- Python 3.12
- A Hetzner Cloud account and API tokenAny VPS you can SSH into works if you adapt the create step.
- The WireGuard app on each deviceOfficial and free for phones and laptops.
Before you buildNordVPN has no free plan, and its low monthly prices are intro rates for the first term. Compare the renewal price (about $11.59 a month on Basic's yearly plan) with a small server before you decide.
- 1. Install one agent: Claude Code, Codex, Cursor.
- 2. Make an empty folder and open it in the agent.
- 3. Paste the prompt below, press enter, and answer its questions as it builds.
The prompt
Build me a personal WireGuard VPN kit to replace NordVPN's tunnel for my own devices. Requirements: - Python 3.12 CLI called `vpnkit` (typer for commands, the `hcloud` package for the Hetzner Cloud API), installed with `pip install -e .`. Region, server size and DNS resolver come from vpnkit.toml; HCLOUD_TOKEN lives in .env. - `vpnkit up <region>` creates a Debian 12 server from a cloud-init file that installs WireGuard, unbound (DNS over TLS upstream), and nftables; turns on IPv4 and IPv6 forwarding; opens only UDP 51820 and SSH from my current IP; and enables unattended security upgrades. - Storage: ./data/state.json holds servers, peers and their tunnel addresses. Keys are made locally with `wg genkey`; private keys stay in ./data (chmod 600) and appear only inside that peer's config. - `vpnkit peer add <name>` registers a peer on the server over SSH with `wg set` (no tunnel restart), writes ./data/peers/<name>.conf routing 0.0.0.0/0 and ::/0 with the server as DNS, and prints a QR code (`qrcode`) for the official WireGuard app. `peer ls` and `peer rm` finish the set. - `vpnkit check` runs with the tunnel up and verifies three things: the public IPv4 reported by an echo endpoint (IP_ECHO_URL in vpnkit.toml) equals the server's address, the server's resolver answers a `dig` over the tunnel, and IPv6 either shows the server's address or fails closed. Exit 1 on any miss. - `vpnkit down <region>` destroys the server after I type its name; `vpnkit status` lists servers and their monthly cost from the Hetzner price list. - No accounts, no telemetry, local-first: outbound calls are the Hetzner API, SSH to my servers and the one echo request, all named in the README. - Out of scope: client apps (use the official WireGuard apps), multi-hop, obfuscation, streaming unblocking, a dashboard. - README: install, the .env keys and cost per month, plus three plain warnings: sites see the server's address, which is tied to my hosting account; streaming services often block datacenter ranges; the host can see traffic metadata, so this swaps trust in NordVPN for trust in the host.
Opens your agent with the prompt filled in, you press enter. Or copy it and paste it into an empty folder.
Then keep going
Next prompts, same folder.
The first prompt builds the core. Run these one at a time in the same folder to grow it into your own NordVPN.
Extend the VPN kit in this folder. Requirements: - Let vpnkit.toml define several named regions (location, server size) and make `vpnkit up` accept any of them. - Give every peer a config per region, named <peer>-<region>.conf, with distinct tunnel subnets. - `vpnkit peer add` writes configs for every running region and `peer rm` removes the peer from all of them. - `vpnkit status` prints one line per region with its address, age and monthly cost. - Update the README with how to switch regions in the WireGuard app.
Add DNS filtering to the VPN kit in this folder. Requirements: - Install AdGuard Home on the server through cloud-init, listening only on the tunnel address, with unbound or DNS over TLS as its upstream. - Preload one blocklist chosen in vpnkit.toml and refresh it weekly with a systemd timer. - `vpnkit dns allow <domain>` and `vpnkit dns block <domain>` edit the custom rules over SSH. - `vpnkit check` fails if a domain from the test list in vpnkit.toml still resolves. - Update the README with what DNS filtering does and does not block (it cannot see inside HTTPS).
Add address rotation to the VPN kit in this folder. Requirements: - `vpnkit rotate <region>` creates a new server, copies the WireGuard keys and peer list to it, waits until `vpnkit check` passes against it, and only then destroys the old one. - Peer configs use a DNS name from vpnkit.toml (a record you control, updated through the Cloudflare API with CLOUDFLARE_TOKEN in .env) instead of a raw IP, so devices keep working. - Print the old and new addresses and abort without deleting anything if any step fails. - Update the README with a note that a new address can be blocked too.
Add auto-connect to the VPN kit in this folder. Requirements: - A `vpnkit autoconnect install` command for macOS (a launchd agent plus `networksetup`) and Linux (a NetworkManager dispatcher script) that brings the tunnel up on any Wi-Fi not in TRUSTED_SSIDS in vpnkit.toml. - Keep the tunnel up when the network changes, and block non-tunnel traffic with a firewall rule until the tunnel is up (a basic kill switch). - `vpnkit autoconnect uninstall` removes everything it added. - Update the README with the limits of a software kill switch.
What you lose
- A choice of servers in over a hundred countries, where your own server sits in one place
- A shared pool of addresses, so a website cannot tie the IP to you
- Access to streaming libraries that block datacenter address ranges
- Polished apps with a kill switch and one-tap server switching on every platform
- The ad, phishing and malware filtering, and on higher plans the antivirus and password manager
Why people still pay
People rent a VPN to look like someone else, not only to encrypt: a shared address in another country is what opens a foreign catalogue, a local price or a blocked site. The apps work on every device with one tap, and the monthly cost is lower than a server plus the evenings spent when it breaks. A self-hosted tunnel only moves your trust from NordVPN to your hosting company.
NordVPN or your own copy?
Over
Your usage
3h ×$/h
NordVPN, 1 yr$180
Your own copy, 1 yr$77running + build session
You keep$103pays for itself in the first month
Estimate · A one-core server at a budget host costs a few dollars a month and includes terabytes of traffic; each extra country is another server at the same price. The build is token usage on your agent plan.
Take your data, then cancel.
1 · Take your data out of NordVPN
- 1A VPN keeps no library of yours, so there is nothing to export: note the server picks, protocol (NordLynx or OpenVPN), split-tunnelling rules and any Dedicated IP you rely on.
- 2On the Complete and Prime plans, export your NordPass vault and copy anything out of the 1 TB cloud storage before the plan ends.
- 3Build and test the replacement first: stand up the WireGuard server and run both for a week before cancelling.
2 · Cancel NordVPN
- 1Log in to your Nord Account and open the Billing tab.
- 2Click Cancel next to Auto-renewal, then choose Cancel auto-renewal.
- 3The status changes to Off and a confirmation email arrives; the plan runs until the paid term ends.
- 4Subscribed through the Apple App Store, Google Play or Amazon Appstore? Cancel there, as NordVPN cannot cancel those for you.
- The 30-day money-back guarantee covers only the first purchase; once the plan renews it no longer applies, unless local law requires it.
- Refunds go through live chat: support sends a link to your Nord Account where eligible payments show a Refund button. Apple purchases are refunded by Apple and retailer purchases by the retailer.
- Intro prices end at renewal, so switch off auto-renewal well before the date rather than on it.
- The same steps cancel NordPass, NordLocker, a Dedicated IP and bundles.
The escape hatch
Don't feel like building it? These are already free.
wg-easyOpen sourceAGPL-3.0 WireGuard server with a web page to add and remove peers; runs in one Docker container.★ 27k · active Oct 2026 · docker to self-host
Web, LinuxVisit ↗Algo VPNOpen sourceAGPL-3.0 Ansible scripts from Trail of Bits that set up a hardened WireGuard and IPsec server at a cloud provider.★ 30k · active Oct 2026 · self-host, real ops
CLI, LinuxVisit ↗AmneziaVPNOpen sourceGPL-3.0 client that installs and manages a VPN on your own server over SSH, with protocols meant to survive censorship.★ 15k · active Oct 2026 · one-click install
Windows, macOS, Linux, iOS, AndroidVisit ↗
Web, LinuxVisit ↗Algo VPNOpen sourceAGPL-3.0 Ansible scripts from Trail of Bits that set up a hardened WireGuard and IPsec server at a cloud provider.★ 30k · active Oct 2026 · self-host, real ops
CLI, LinuxVisit ↗AmneziaVPNOpen sourceGPL-3.0 client that installs and manages a VPN on your own server over SSH, with protocols meant to survive censorship.★ 15k · active Oct 2026 · one-click install
Windows, macOS, Linux, iOS, AndroidVisit ↗
The numbers
NordVPN pricing
| Plan | Monthly | Annual, per month | What you get |
|---|---|---|---|
| Basic | $14.99 | $5.49 | The VPN plus ad, phishing and malware blocking; NordVPN's marketing and reviews cite up to 10 devices at once. |
| Complete | $19.99 | $6.49 | Basic plus antivirus, scam and spam protection, a password manager, 1 TB of cloud storage and bank-transaction and email monitoring. |
| Prime | $29.99 | $9.49 | Complete plus Coveron identity protection against cybercrime. |
- Billing
- Monthly, 1-year or 2-year terms, billed up front for the term and renewed automatically at the standard price. The 30-day money-back guarantee covers only the first purchase; once a plan renews it no longer applies, unless local law says otherwise. Sales tax may apply.
- Hidden costs
- The headline per-month prices are intro rates for the first term only and jump at renewal (Basic from $5.49 to about $11.59 a month on the yearly plan). A Dedicated IP and the bundled NordPass or NordLocker services are managed separately.
- Source
- nordvpn.com
Also on the list
Related apps
No free plan; there is a 30-day money-back guarantee on the first purchase.
Not really. People rent a VPN to look like someone else, not only to encrypt: a shared address in another country is what opens a foreign catalogue, a local price or a blocked site. The apps work on every device with one tap, and the monthly cost is lower than a server plus the evenings spent when it breaks. A self-hosted tunnel only moves your trust from NordVPN to your hosting company. The prompt on this page builds the closest honest substitute.
About $14.99 a month on the Basic plan, $179.88 a year (checked 2026-10-19).
A choice of servers in over a hundred countries, where your own server sits in one place; A shared pool of addresses, so a website cannot tie the IP to you; Access to streaming libraries that block datacenter address ranges; Polished apps with a kill switch and one-tap server switching on every platform; The ad, phishing and malware filtering, and on higher plans the antivirus and password manager. If any of those matter to you, keep paying.
Yes: wg-easy (open source), Algo VPN (open source), AmneziaVPN (open source).