Why I Run Both
I get this question frequently after publishing my GL.iNet Flint 2 review: "If I have WireGuard on my router, do I still need a commercial VPN service?" The answer is: it depends entirely on what you're trying to accomplish. I run both because they serve different purposes that don't overlap.
What a Commercial VPN Service Does
A commercial VPN (Mullvad, ProtonVPN, NordVPN, etc.) routes your traffic through their servers in many countries. You choose a server location, your traffic exits from that IP address, and your ISP sees only encrypted traffic going to the VPN server — not where you're actually connecting.
What it's good for:
- Privacy from your ISP — they see encrypted traffic to VPN server, not your actual activity
- Accessing content that's geographically restricted — connecting to a server in another country
- Using public WiFi safely — coffee shop, hotel, airport networks
- Hiding your home IP from websites and services you connect to
What it doesn't do:
- Give you access to your home network remotely — the VPN exits through the provider's servers, not your home
- Guarantee privacy from the VPN provider themselves — you're trusting them with your traffic
- Protect devices that don't run the VPN client (unless you use a VPN router in client mode)
What a Self-Hosted WireGuard Server Does
Running WireGuard server mode on a GL.iNet Flint 2 creates a VPN that lets you connect to your home network from anywhere. Your phone in a coffee shop connects to your home's WireGuard server — all traffic from your phone goes through your home internet connection, as if you were sitting at home.
What it's good for:
- Accessing your home NAS, server, or local services from outside
- Using your home internet connection's IP when traveling
- Securing public WiFi by routing through your trusted home connection
- One-time hardware cost, no monthly subscription
What it doesn't do:
- Let you appear to be in a different country — your traffic exits through your home ISP's IP address
- Provide server locations in 50+ countries
- Work if your ISP uses CGNAT (Starlink, some mobile carriers) — no public IP to connect to (Tailscale solves this)
Side-by-Side Comparison
| Feature | Commercial VPN Service | Self-Hosted WireGuard (Flint 2) |
|---|---|---|
| Monthly cost | $5–15/month | $0 (hardware is one-time) |
| Country selection | Yes — 50+ countries | No — exits through your home ISP |
| Access home network remotely | No | Yes — full access |
| ISP privacy | Yes (ISP sees VPN server only) | No (ISP sees your own traffic) |
| Covers all home devices | Only with VPN router in client mode | Yes — if router set to server mode |
| Speed (WireGuard) | Depends on provider — 400–900 Mbps typical | ~780 Mbps (limited by home upload) |
| Trust model | Trust the VPN provider | Trust only yourself |
How I Use Both Together
My GL.iNet Flint 2 runs WireGuard in client mode connecting to Mullvad (a commercial VPN provider) for all home traffic. This gives ISP privacy and routes home traffic through a Swiss IP address. Separately, the Flint 2 also runs WireGuard server mode — when I'm traveling, my phone connects to the WireGuard server, which lets me access my home NAS and other local services. The commercial VPN is for privacy and IP location; the self-hosted WireGuard server is for remote home access. They serve different use cases and are both running simultaneously.
Who Should Use Which
Commercial VPN only: You mainly want ISP privacy and/or geographic flexibility for streaming. You don't need remote access to your home network. You prefer paying monthly to avoid hardware setup complexity.
Self-hosted WireGuard server only: You mainly want remote access to your home network (NAS, cameras, local services). Privacy from your ISP isn't a primary concern. You want zero recurring cost after the hardware purchase.
Both: You want ISP privacy AND remote home network access, and you're comfortable managing both setups. The GL.iNet Flint 2 runs both simultaneously without conflict.
FAQ
Is a self-hosted VPN actually private if my ISP knows where I live?
For protecting your data from the ISP: no — your traffic exits through your home IP, so your ISP sees all your traffic. For accessing home services remotely from a coffee shop: yes — the coffee shop network only sees encrypted WireGuard traffic going to your home. For hiding your IP from websites: partially — websites see your home IP, not your actual travel location. Each tool serves its specific purpose.
What's the best commercial VPN to pair with the GL.iNet Flint 2?
Any commercial VPN that provides WireGuard config files (most major providers do): Mullvad, ProtonVPN, NordVPN, Surfshark. The GL.iNet interface accepts standard WireGuard config files — download from your provider, upload to the router, connect. I use Mullvad for its privacy focus and clear no-logs policy.