You want a private, reliable remote desktop that doesn’t route your traffic through someone else’s cloud, but you also don’t want to pay enterprise prices or wrestle with complicated networking.
You want a private, reliable remote desktop that doesn’t route your traffic through someone else’s cloud, but you also don’t want to pay enterprise prices or wrestle with complicated networking. This guide walks through a practical "self host remote desktop vps" setup you can run on a $5 VPS — secure enough for daily ops and cheap enough to justify self-hosting.
Why a $5 VPS is a sensible starting point
For remote desktop use cases (single user, occasional sessions), a low-end VPS is often sufficient. Common $5-ish plans (for example, a 1 vCPU / 1GB RAM / 25GB SSD droplet) on providers such as DigitalOcean, Vultr or Linode handle a single concurrent session, headless server agents, and a lightweight relay or VPN.
This guide uses Ubuntu 22.04 LTS (stable, widely supported) and assumes the VPS will be reachable over the public internet. If your needs include GPU, multi-monitor high-FPS streaming, or many concurrent users, you’ll need a bigger plan; in those cases RDP/AnyDesk/TeamViewer or a dedicated workstation may be a better fit.
Plan: what you’ll run and ports to expect
The minimal architecture here:
- VPS (Ubuntu 22.04) with public IP
- SSH for management (key-only)
- WireGuard as the secure tunnel (optional but recommended)
- Remote-desktop server (we’ll use Tenvo as an example agent) running as a systemd service
- Optional domain + Let's Encrypt TLS and nginx reverse proxy for web-based clients
Expected resource usage: the agent and VPN will sit under 500MB RAM when idle; expect 50–250 Mbps bandwidth during active sessions depending on codec and screen activity. Budget: $5/month VPS + domain (~$10/year) if you want TLS. If you prefer no public ports, see our write-up on running remote desktop without exposing ports: remote-desktop-without-port-forwarding.
Step 1 — provision the VPS and lock down access
Create a $5 VPS with Ubuntu 22.04. When creating the instance choose SSH key authentication (you can add your public key in the provider console). Example providers offer similar plans: DigitalOcean 1GB/1vCPU ($5), Vultr 1GB ($5), Linode Nanode ($5). The exact SKU varies, but the network and CPU specs are comparable.
Initial hardening commands (run as root or a sudo user):
apt update && apt upgrade -y adduser adminuser usermod -aG sudo adminuser ufw allow OpenSSH ufw enable
Edit /etc/ssh/sshd_config to disable password auth and root login (set PasswordAuthentication no and PermitRootLogin no). Restart SSH: systemctl restart sshd. This prevents brute-force attempts against your VPS.
Step 2 — firewall, fail2ban, and rate limits
Keep the firewall minimal. If you plan to use WireGuard put only the WireGuard UDP port in the public rules; if you run the remote agent directly you may need one TCP port. Example UFW rules:
ufw allow 22/tcp # SSH ufw allow 51820/udp # WireGuard (if used) ufw allow 8443/tcp # optional remote desktop web port ufw enable
Install fail2ban to automatically ban repeated attempts and reduce noise: apt install -y fail2ban. Use the default jail for sshd and tune ban times to your risk tolerance.
Step 3 — secure networking options: direct ports, VPN, or reverse relay
Three practical network patterns:
- Open port to the internet: simplest but higher attack surface. Use TLS and strong auth if you expose an app port.
- WireGuard tunnel: the most secure straightforward option. Create a private network between your client device and the VPS; only the WireGuard port is public. This is our recommended approach for self-hosting on a cheap VPS.
- Relay/Reverse-connect: some commercial tools and open-source projects do a reverse connection to a broker, avoiding inbound ports on the client. This is useful if the client is behind NAT and you don’t want to run a VPN. Read about this pattern in our overview: self-hosted-remote-desktop.
WireGuard quickstart (server on VPS):
apt install -y wireguard iproute2 wg genkey | tee /etc/wireguard/server_private.key | wg pubkey > /etc/wireguard/server_public.key # create /etc/wireguard/wg0.conf and include keys + peers systemctl enable --now wg-quick@wg0
WireGuard config specifics depend on your client platform; there are many tutorials and client apps for Linux, macOS, Windows, Android, and iOS. Using WireGuard means the remote desktop traffic is directly routed over an encrypted tunnel — no public app port required on the client machine.
Step 4 — install the remote desktop server (Tenvo example)
Pick the server agent you want to host. Tenvo is an open-source remote desktop option you can self-host; download the Linux release from /download and follow the binary installation instructions supplied there. If you prefer other software (RustDesk, VNC, RDP), adjust the steps below. Note: for GUI forwarding you might need desktop packages on the client side — the VPS is just the broker or VPN endpoint in many cases.
Example: installing a generic remote agent as a systemd service (replace the binary and flags with the agent you choose):
mkdir -p /opt/tenvo # scp or wget the server binary to /opt/tenvo/tenvo-server chown root:root /opt/tenvo/tenvo-server chmod +x /opt/tenvo/tenvo-server cat >/etc/systemd/system/tenvo.service <<'EOF' [Unit] Description=Tenvo remote agent After=network.target [Service] ExecStart=/opt/tenvo/tenvo-server --config /etc/tenvo/config.yaml Restart=on-failure [Install] WantedBy=multi-user.target EOF systemctl daemon-reload systemctl enable --now tenvo.service
Configure the agent with a strong key or password and, if supported, restrict which client public keys are allowed. If you use WireGuard, configure the agent to bind to the WireGuard interface or to the loopback address so it's not reachable via the public IP.
TLS, domain, and reverse proxy (optional)
If you have a web-based client (or an admin UI), put nginx in front and use Let's Encrypt for TLS. Practical certbot commands on Ubuntu 22.04:
apt install -y nginx certbot python3-certbot-nginx # create nginx site for example.com and proxy_pass to localhost:8443 certbot --nginx -d example.com
Keep the TLS certificate auto-renewal cron active (certbot sets this up). If you use a domain, point an A record to your VPS IP and use the domain in your client configurations. TLS protects web UIs and browser-based clients; it doesn't replace strong agent authentication.
Testing and verification
Basic checks:
- SSH: attempt a password login — it should fail.
- WireGuard: bring up the client and ping the VPS WireGuard IP.
- Agent: connect from your client to the agent over the WireGuard interface or TLS endpoint; verify latency and audio/video quality.
- Logs: check
journalctl -u tenvo -fand /var/log/nginx/error.log while connecting.
Measure bandwidth and CPU during a session. If you observe high CPU on the VPS, reduce the encoding quality, lower frame rate, or move the session broker to a more capable instance.
Maintenance: updates, backups, and monitoring
Schedule OS updates and reboot windows during low-use periods. Use unattended-upgrades for security patches but test major upgrades manually. Snapshot your VPS disk via the provider before risky changes, and store a copy off-site for recovery.
Monitoring tips: enable basic monitoring in your provider console (most show CPU, bandwidth, and disk) and consider a simple alerting setup (email on out-of-disk or high CPU). Keep your SSH keys rotated yearly and revoke any lost keys immediately.
When this isn't the right choice
Self-hosting on a $5 VPS is great for personal use, small teams, or hobby projects. It’s not ideal if you need:
- Enterprise-grade SLAs, global low-latency relay networks, or integrated support — vendors like TeamViewer/AnyDesk excel at those.
- GPU-accelerated streaming or many simultaneous users — those need larger instances or dedicated hardware.
For security-minded readers, also read our deeper piece on securing remote access: remote-desktop-security. If you need a comparison of hosted vs self-hosted options, see our articles on self-hosted solutions and best free alternatives.
Wrap up and next steps
Self-hosting a remote desktop on a $5 VPS is a pragmatic, low-cost way to regain control over your remote access. Key takeaways: use SSH keys, lock down services with a firewall, prefer WireGuard to expose fewer application ports, and run the agent as a managed systemd service. If you choose Tenvo, download the binaries from /download and follow the packaged instructions for your OS.
Ready to try it? Grab the Tenvo binary and docs at /download and spin up a $5 VPS to test the steps above. If you want to compare hosted alternatives and pricing, check /pricing before committing.
Ready to try it yourself?
Free for 30 devices, no credit card. Up and connected in two minutes.