Need help with rotvpn?
Click the “chat” button below for chat support from the developer who created it, or find similar developers for support.

About the developer

145 Stars 13 Forks 47 Commits 0 Opened issues


Run a personal VPN in the cloud. And rotate it regularly.

Services available


Need anything else?

Contributors list

# 577,732
15 commits
# 220,762
15 commits


Run a personal VPN in the cloud. And rotate it regularly.

VPN servers are a great way to hide your activity from the prying eyes of ISPs and obfuscate your location. But it's better to run your own VPN than to pay for a service, since the VPN service may be tracking you too. However, setting up a VPN is difficult. Add to that, it's probably wise to change the IP address of your VPN after a while. Usually, this means tearing the existing server down and standing up a new one in its place.

rotvpn is a pure Python utility that sets up a WireGuard full tunnel VPN with DNS (via unbound). It is designed to be ephemeral, so you can rotate to a new server with a single command.

Currently, only DigitalOcean and AWS are supported. Other providers may be added in the future... Got a favorite? Feel free to send a patch!


rotvpn installs and runs from your workstation.

You must have

in your path. You will need to create a virtual environment and install the dependencies:
python3 -m venv .env                                               # create the virtualenv
source .env/bin/activate                                           # start it up
python3 -m pip install --upgrade pip                               # upgrade installer
python3 -m pip install -r requirements.txt                         # install requirements


After you've installed the Python3 dependencies, you're ready to run your own VPN. Almost. Depending on which provider you use (Digitalocean is the default), you will need to export some variables into the environment.


You'll need to get a DigitalOcean API token. Export it into your environment:

export ROT_DO_TOKEN=123abc...

And you're ready to go.

AWS (Amazon Web Services)

You need an account ID, secret, and region, and you will need to export them into your environment like so:

export ROT_AWS_ID=AKI...
export ROT_AWS_SECRET=WM0...
export ROT_AWS_REGION=us-west-2

After that, you can run

Actually run it

If the two steps above are complete, you're ready to go. Make sure you're running in your virtualenv, and in the root of this repo. Then do something like

python3 --name my-cool-vpn

After the script runs, you should have a file named
 will be one of the providers above, and 
 will be whatever you gave rotvpn in the 
parameter. Unzip and you will have 10 peer configurations.

Here is the usage for the script:

> python3 --help

usage: [-h] [--provider PROVIDER] [--name NAME] [--do DO] [--config CONFIG]

optional arguments: -h, --help show this help message and exit --provider PROVIDER Specify the provider, i.e. digitalocean --name NAME A name for your deploy, like 'mycoolvpn'. Lets you have multiple deploys for a provider. --do DO Provision or remove your VPN: --do provision | --do remove --config CONFIG Optional JSON config for your provider


parameter is the only one that is required. rotvpn defaults to DigitalOcean for
and the default
action is
. Any time you run the prior command, any existing server matching
will be deleted, and a new server deployed with a new set of client configs (

Providers may have additional configuration fields they accept. If they do, you can use the

parameter to pass in that information. For instance, the DigitalOcean provider defaults to the
region, and the
(smallest) sized droplet. If you want to change that, you can do something like:
python3 --name my-cool-vpn --config '{"region":"nyc3","size":"s-1vcpu-2gb"}'

AWS currently supports changing the size of your instance. It defaults to

. You can modify this via
, e.g.
python3 --provider aws --name my-cool-vpn --config '{"size":"t2.medium"}'

If you're done with the VPN for a while, you can simply remove it, and save some money until you need it again:

python3 --name my-cool-vpn --do remove

Client configuration


Install the WireGuard client from the App Store.

Open it and click 'Import tunnel(s) from file'.

Select one of the files unzipped from

It will load in your WireGuard client interface:

WireGuard MacOS

Click 'Activate'. Test your connection and IP address.


Much was learned from these posts:


We use cookies. If you continue to browse the site, you agree to the use of cookies. For more information on our use of cookies please see our Privacy Policy.