Best VPS for Self-Hosting: Renting Only What You Can't Run at Home

If you already run things at home, most “best VPS for self-hosting” advice is answering a question you don’t have. Your NAS has more storage than any VPS you’d rent, and probably more RAM.

There are four jobs that genuinely can’t live at home, and a VPS exists to do those and nothing else.

The four jobs

1. A public entry point. Your residential connection is behind NAT or CGNAT, your IP changes, and inbound ports may be blocked. A cheap VPS with a static IP is a fixed address the internet can reach.

2. Off-site backup. A backup in the same building as the original isn’t a backup. This is the job most homelabs skip and most regret.

3. An outbound mail relay. Residential IP ranges are widely blocklisted for SMTP, so mail sent directly from home largely doesn’t arrive. A relay on a clean IP fixes deliverability — though for transactional volume a dedicated sending service is still the better answer.

4. Anything needing an address your ISP won’t sell you. A static IP, a reverse DNS record, an IPv4 that isn’t shared.

Notice what isn’t on that list: storage, compute and databases. Those stay at home, where they’re cheaper and already paid for.

Bandwidth is the decisive number

An entry node’s job is passing traffic, so the pricing model for egress dominates everything else. At 5 TB/month through the node:

That’s roughly a hundredfold spread for moving the same bytes. Nothing about the technical work differs — it’s purely the billing model, and for a homelab entry node it’s the only spec that matters at scale.

The practical rule: never put a homelab entry node on a metered-egress platform. Flat-rate hosting with generous included transfer is the entire product category you want, and it’s cheap.

One caveat worth carrying: included transfer allowances vary sharply by region. Hetzner’s plan data shows markedly smaller allowances at its US and Singapore locations than in Europe, with a higher overage rate in Singapore — so check the allowance for the region you’re actually buying, not the one in the review.

Storage, if you must

Off-site backup is the one job where you’re buying capacity rather than connectivity. Prices for 500 GB:

Object storage is the right instrument for backups and block storage is the wrong one — a fivefold difference for data you touch rarely. And watch for products that bill more when idle, which is precisely the state a backup volume lives in.

For anything beyond a few hundred gigabytes, a dedicated backup service or a second NAS at a friend’s house beats renting block storage.

The architecture worth copying

The version that keeps your attack surface honest:

The VPS is the only thing exposed to the internet. Everything valuable stays home.

1. Install Tailscale (or WireGuard directly) on the VPS and on your home server. They join a private network; nothing at home listens on a public port.
2. The VPS runs a reverse proxy — Caddy is two lines of config and handles TLS automatically — terminating public HTTPS.
3. It forwards requests over the private network to services at home.
4. Your home firewall accepts no inbound connections at all. The tunnel is outbound-initiated from home.

What this buys you: a compromise of the VPS gets an attacker a cheap Linux box and whatever the reverse proxy could reach — not your NAS, not your backups, not your LAN. The blast radius is a rebuild, and the VPS holds nothing you’d miss.

Two things to get right:

Harden the VPS properly, because it is your entire public surface: key-only SSH, no root login, a default-deny firewall, automatic security updates. The full checklist applies exactly.

Don’t put credentials on it. The proxy needs no database passwords and no API keys. If you find yourself putting secrets on the entry node, the architecture has drifted.

For a worked version of this pattern, Tailscale on a VPS covers the setup.

Sizing, which is smaller than you think

An entry node forwarding traffic is not a demanding workload.

1GB is genuinely enough for a reverse proxy and a tunnel. The temptation to buy 4GB “for headroom” is the temptation to run services on it — which defeats the point, because those services are cheaper at home.

What to buy

Hetzner is the classic homelab answer on price and its European traffic allowances are the most generous here. Two caveats: its cost-optimized CX tier has been showing as unavailable, and the CPX line you’d fall back to is €11.99 for 2GB after its June 2026 repricing. Check the traffic allowance for your specific region.

Hostinger is the cheapest capable option with 4TB of transfer included — $6.49 promotional and $11.99 at renewal for 4GB. More than you need for an entry node, but the price per gigabyte is the best among plans you can currently buy.

IONOS is worth pricing for its unlimited traffic claim and its core count — four vCPU on a 4GB plan at $11 — with a three-month promotional window, so budget the renewal rate from the start.

DigitalOcean is the choice for documentation and API predictability at $6 for 1GB, which is exactly the right size for this job. Its tracked link isn’t working on our end, so we’ve named it without linking.

UltaHost advertises unlimited bandwidth on several tiers and its 2-year discounted rate is also its renewal rate. Confirm the plan specs in writing.

Cloudzy bills month-to-month with no term — $4.17 for 1GB — which suits an entry node you might reconfigure or drop.

For the full normalised comparison, VPS price per GB of RAM ranks the market on one number.

How we checked this

Egress and storage rates are the providers’ published figures read in August 2026: AWS at $0.09/GB after the first 100GB free, Vercel Pro at $0.15/GB after its 1TB allowance, Railway at $0.05/GB, DigitalOcean’s 4TB included on a 4GB droplet with roughly $0.01/GB overage and $0.10/GiB block storage, its Spaces object storage at $5 for 250GiB then $0.02/GiB, and Hetzner’s European overage of about €1/TB. The 5TB and 500GB comparisons are our arithmetic on those rates.

The regional traffic caveat is important and we’ve flagged it before. Hetzner’s own plan data shows substantially smaller included allowances at its US and Singapore locations than in Europe, and a higher Singapore overage rate. We could not confirm the per-plan allowances on the rendered pricing page, so check the allowance for the exact plan and region you’re buying — the hundredfold spread above assumes a generous European allowance.

Plan pricing is from our VPS index. UltaHost’s and IONOS’s unlimited-traffic claims are their own marketing, and “unlimited” in hosting generally means “subject to an acceptable use policy we don’t publish a number for” — treat it as generous rather than infinite, and don’t build a video CDN on it.

What we did not do: we haven’t built this architecture for the article, measured throughput through a Tailscale exit node, or tested any provider’s real bandwidth behaviour at 5TB. The architecture described is a standard pattern rather than a deployment we ran, and the sizing figures are conventional for a reverse proxy rather than measured.

One thing we’d emphasise over anything measured: the security property is the reason to build it this way. A public entry node holding no credentials, with home services reachable only over an outbound-initiated tunnel, limits a compromise to a machine you can rebuild in an hour. That’s an architectural claim you can verify by reasoning about it, not one that needs a benchmark.

The host links above are affiliate links. The advice that storage and compute should stay on hardware you already own points away from buying more hosting.

FAQ

Do I need a VPS if I already self-host at home?

Only for four jobs: a public entry point with a static IP, off-site backup, an outbound mail relay, and anything needing an address your ISP won’t provide. Storage and compute are cheaper on hardware you already own.

How much RAM does a homelab entry node need?

1GB is genuinely enough for a reverse proxy and a Tailscale tunnel. Buying more invites you to run services on it, which defeats the purpose.

Why not use a cloud platform for my entry node?

Egress billing. Passing 5TB a month costs roughly $450 on AWS-style pricing or $614 on Vercel Pro, against about €4.50 on flat-rate European hosting — a hundredfold spread for identical work.

What’s the safest way to expose home services?

Put the VPS on a private network with your home server via Tailscale or WireGuard, run a reverse proxy on the VPS, and accept no inbound connections at home. A VPS compromise then reaches a rebuildable box, not your NAS.

Can I send email from my home server?

Not reliably — residential IP ranges are widely blocklisted for SMTP. Relay through a VPS on a clean IP, or better, use a dedicated sending service for anything transactional.

Is object storage or block storage better for off-site backups?

Object storage, by a wide margin — roughly $10/month for 500GB against $50 on block storage. And avoid anything that bills more when idle, which is a backup volume’s normal state.

Does unlimited bandwidth really mean unlimited?

It means generous, subject to an acceptable use policy that usually doesn’t state a number. Fine for an entry node; don’t plan a media CDN around it.