A connection for each device
Create WireGuard or AmneziaWG profiles. Edit DNS and IPv6 protection without replacing the device’s keys or address.
CayVPN 2.0.1 / Free and open source
Your server.
Your VPN.
A private place to manage your connections. Run WireGuard and AmneziaWG on your own server, choose where each device connects, and keep control of your DNS, IPv6 and recovery.
One panel.
Every connection.
CayVPN runs on a server you provide. Its management panel starts private, reached through your own admin connection.
Choose the way out
Use your server’s IP, an attached additional IP, an imported provider tunnel or a compatible SOCKS5 proxy. Create an ordered backup group when you want automatic failover.
Protection that follows your route
Choose standard or ad-blocking DNS. Smart IPv6 keeps IPv4 available when IPv6 is unavailable; Require IPv6 waits for a verified dual-stack connection. An unavailable route blocks traffic instead of silently using the server’s default connection.
Keep a way back
Private owner access, encrypted backups and SSH recovery stay on your server. Signed updates install only when you approve them, with rollback if verification fails.
Start with a clean server
Install CayVPN 2.0.1
Use a dedicated Ubuntu 24.04 server with a public IPv4 address, SSH access and at least 5 GiB of free disk space. Enable a working public IPv6 address with your host for dual-stack Internet. You pay your host directly; CayVPN itself is free.
Run in your server’s SSH session
curl -fsSL https://raw.githubusercontent.com/caynetic/cayvpn/v2.0.1/bootstrap.sh | sudo bash
The version-pinned installer checks the release signature and bundled files before running the installation. It refuses conflicting VPN or service configuration.
- Install and save your recovery passphrase. Keep it somewhere private and separate from your server.
- Download the private owner kit. The installer gives you the exact download command and first-login instructions. Keep its keys and certificate private.
- Connect and add your devices. Import the admin profile in a compatible WireGuard app, follow the certificate instructions, then open the private panel to create ordinary client profiles.
Coming from CayVPN 1.x? Install 2.0 on a new, clean server and create new client profiles. Existing 1.x installations cannot be upgraded or imported in place.
Before you connect
A few things
to know.
What does self-hosted mean?
You create and manage the server with your chosen host. CayVPN does not provide a hosted VPN subscription, buy server capacity, or request your hosting account’s API credentials. CayneticVPN is a separate product.
Which devices and providers can I use?
Use a client application compatible with the WireGuard or AmneziaWG profile you create. Provider tunnels, additional IPs, UDP and IPv6 depend on the host and upstream service. CayVPN verifies supported routes before using them. Review the release’s test coverage and limits, then check your devices and network.
Does Caynetic collect my VPN activity?
CayVPN sends no application telemetry and requires no Caynetic account or hosted relay. Configuration and operational records stay on your server. Your hosting provider and selected upstream services have their own policies. Read the license and privacy notes.
Do I need a new profile after changing settings?
A DNS-mode change needs an updated profile imported on the device. IPv6 protection is enforced on the server. The panel tells you when a new import is needed.
Where can I get help?
Start with the current documentation or community issues. Never post private keys, configurations, owner kits or recovery passphrases. The old 1.x videos and PDF do not describe the 2.0 setup.
Free to use.
Yours to build on.
CayVPN’s source is MIT licensed. Optional contributions help the project and never unlock features or block setup.