Install VpnHood! SERVER on Windows

Run your own VPN server on a Windows machine with a public IP address. Add it from VpnHood! MANAGER as a managed server, or install it as a standalone server with one PowerShell command.

Before you start

A machine with a public IP address, running Windows 10, Windows 11 or Windows Server 2016 or later, on x64. System requirements lists the limits on Windows.
On Windows 10 and 11, the server's VPN adapter needs Hyper-V turned on, as Windows' NAT comes with it, and Home editions have no Hyper-V. Without it, the server runs as a proxy only. Windows Server needs nothing turned on.
PowerShell opened as administrator, for every command on this page.
TCP port 443 open, both in the machine's firewall and in your hosting provider's. It is the port the server listens on.

Linux is recommended: Windows' NAT translates only IPv4, so only on Linux does the server handle IPv6 properly.

Install a standalone server

Run this command. It installs the server into C:\Program Files\VpnHood\VpnHoodServer and starts it. It asks three questions: press Enter at each to keep its suggestion.

[Net.ServicePointManager]::SecurityProtocol = "Tls,Tls11,Tls12"; iwr "https://github.com/vpnhood/VpnHood.App.Server/releases/latest/download/VpnHoodServer-win-x64.ps1" -UseBasicParsing | iex

Then let apps through Windows Firewall, which the installer leaves as it is.

New-NetFirewallRule -DisplayName "VpnHood SERVER" -Direction Inbound -Protocol TCP -LocalPort 443 -Action Allow

Create your first access key

A standalone server lets in only devices that hold an access key it made. Run this on the server to create one.

powershell -ExecutionPolicy Bypass -File "$Env:ProgramFiles\VpnHood\VpnHoodServer\vhserver.ps1" gen

The key is printed under --- AccessKey --- and starts with vh:; copy the whole line. A few lines above it, HostEndPoints: should show your server's public IP address.

To limit a key, add the same options as on Linux to the command.

Anyone who has the key can connect through your server. Share it the way you would share a password.

Connect

Install VpnHood! CLIENT on each device, add the key, and connect.

Start and stop the server

The server runs as the VpnHoodServer scheduled task, which starts it at boot and starts it again within a minute if it stops. So to stop the server, turn the task off first, as the second command does. The third command turns it back on.

(Get-ScheduledTask VpnHoodServer).State

Disable-ScheduledTask VpnHoodServer; powershell -ExecutionPolicy Bypass -File "$Env:ProgramFiles\VpnHood\VpnHoodServer\vhserver.ps1" stop

Enable-ScheduledTask VpnHoodServer; Start-ScheduledTask VpnHoodServer

Its log is in C:\Program Files\VpnHood\VpnHoodServer\storage\logs\server.log.

Updates

Unless you turned it off at install, the server updates itself to each new release: the VpnHoodServerUpdater task checks once a day.

To turn this off, run the standalone install command again and answer n to Keep the server up to date by itself (Y/n). The installer keeps your answer and your settings, so the server stays on its version until you run the command yourself.

Keep updates on if you can. Some releases fix security issues. An updated app still connects to an older server, but gets no UDP from one before v9.0.859, and apps support servers older than VpnHood 9.1 only until April 2027.

Uninstall

To remove the server, uninstall it from Installed apps in Windows' settings, or run its uninstaller. It stops the server and removes its tasks and its files, but keeps its settings, access keys and certificates in C:\Program Files\VpnHood\VpnHoodServer\storage for a later install.

powershell -ExecutionPolicy Bypass -File "$Env:ProgramFiles\VpnHood\VpnHoodServer\vhuninstall.ps1"

Delete its settings and keys too: devices that hold its keys can no longer connect, even to a new install

powershell -ExecutionPolicy Bypass -File "$Env:ProgramFiles\VpnHood\VpnHoodServer\vhuninstall.ps1" -purge

Remove the firewall rule too

Remove-NetFirewallRule -DisplayName "VpnHood SERVER"