WireGuard VPN in Czechia: why we run WireGuard only and how to set it up in a minute.
State of things on 18 October 2026: Pevnost is in private beta. The first server, in Hluboká nad Vltavou, is live with our DNS resolver inside the tunnel at 10.8.0.1. Accounts are paid by bank transfer; Bitcoin on-chain is the preferred way to pay; card and bank transfer also work; Lightning opens once our channel is funded, Monero and cash by post later. Windows app 0.3.1 beta and Android app 0.1.0 beta (APK) are on the Apps page; iOS and macOS use the official WireGuard app. Last reviewed 18 October 2026.
Pevnost is a WireGuard VPN with its server in the Czech Republic and nothing else: no OpenVPN, no IPsec, no protocol of our own. This post is for people looking for a WireGuard VPN in Czechia who want two things answered: why we bet everything on one protocol, and how long it takes to get running. The second one first: with the official WireGuard app, about a minute, including creating the account.
What WireGuard is
WireGuard is a tunnelling protocol designed by Jason Donenfeld and part of the mainline Linux kernel since version 5.6. The whole implementation is a few thousand lines; OpenVPN plus the TLS library it stands on runs to hundreds of thousands. WireGuard negotiates nothing: one key exchange from the Noise framework, one set of primitives (Curve25519, ChaCha20-Poly1305, BLAKE2s), no cipher suites to misconfigure. Each device has a key pair; the public key is its identity and the protocol knows nothing else about it.
Why WireGuard only
It runs in the kernel
On our nodes packets go from the network card into the Linux kernel, are decrypted and forwarded there, and leave again without passing through a user-space process. No daemon with root privileges parses input from the internet. For the operator that means a smaller attack surface; for you it means speed, because a single rented server forwards traffic at close to its line rate.
Speed: around 300 Mbit/s in the first test
Our first node, prg1 in Hluboká nad Vltavou, delivered around 300 Mbit/s to a single client in a short test. We will publish longer measurements on the status page once there are enough of them to mean something. For Czech users there is a second dimension: the server is in the country, so traffic to Czech sites does not take a detour abroad and back.
It holds minimal state
The protocol decides what the server must know about you. WireGuard holds, per device, a public key, a tunnel address, the last endpoint and the time of the last handshake, all in memory; the endpoint is overwritten and disappears with the connection. No login, no session, no state file. For a no-log VPN that is the ideal starting point: there is nothing to refrain from writing, because the protocol creates nothing durable. Our nodes add running from RAM with no writable disk. The longer comparison is in WireGuard vs OpenVPN.
Keys are made at your end
The device key pair is generated in your browser or in our app; only the public half reaches us. The private key never leaves the device, so we cannot lose it, hand it over or misuse it. Lose the device and you delete the key in your account and make a new one; it takes a minute.
What we give up
WireGuard runs over UDP only and is easy to recognise on the wire. On a network that blocks UDP or actively filters VPNs you will not connect, and we do not disguise it. Anyone who needs to get through a hostile network needs a different tool. We would rather say that than add a second protocol with a login and a state file.
Set up in a minute
The procedure is the same on every platform: account, device key, one file, app. The full guide with exact menu names is the WireGuard setup guide; this is the short version.
- Account. On app.pevnost.net press Create an account. No name, email or password; you get a 24-character ID, which you keep. Every new account has two free hours to try (one trial per connection, one device), then 120 CZK for 30 days or 1 200 CZK a year.
- Device key. Press Generate device key. The browser makes the key pair locally and downloads
pevnost-prg1.conf; only the public half is sent to us. - App. On Windows our Pevnost app (beta 0.3.1, with kill switch and key rotation; it makes its own key and needs no file) or the official WireGuard. On Android our app (beta 0.1.0, APK) or the official WireGuard from Google Play or F-Droid. On iPhone, macOS and Linux the official WireGuard app: Import tunnel(s) from file, pick the .conf, activate. On Linux
wg-quick up pevnostis enough. - Check. Your public address should be our server’s and DNS should be answered by 10.8.0.1 inside the tunnel. The full procedure including IPv6 is in the leak test guide.
Kill switch by platform
WireGuard itself does not block traffic outside the tunnel; the app or the system does. Our Windows app has it on whenever the tunnel is up; the official app has Block untunneled traffic. On Android turn on Always-on VPN and Block connections without VPN in system settings, the strongest kill switch a phone has. iOS offers On-demand activation and does not let third-party apps block everything else. On Linux it is nftables rules.
Who it is for
People who want a Czech VPN on WireGuard under Czech law, at close to line speed, with keys made at home and an operator who says what the protocol cannot do. If you want exits in ten countries or disguise against a corporate firewall, you will need something else. Everyone else: create an account, try the two free hours and measure it yourself.