Using a VPN on Linux

Keep your internet traffic private, hide your location, and stay safe on public WiFi.

What Does a VPN Actually Do?

Imagine your internet connection is a postcard — anyone handling it along the way can read what's on it and see where it's going. A VPN (Virtual Private Network) puts that postcard inside a locked envelope.

When you turn on a VPN, two things happen:

1. Your internet traffic gets encrypted. Nobody between you and the VPN server — not your ISP, not the coffee shop WiFi owner, not anyone snooping on the network — can see what you're doing online.
2. Your location gets hidden. Websites see the VPN server's address instead of yours, so they can't tell where you really are.

That's it. A VPN is just a secure tunnel between your computer and a server somewhere else in the world.

When Would You Want One?

• Public WiFi — Coffee shops, airports, hotels. These networks are easy to snoop on. A VPN keeps your browsing, passwords, and banking safe.
• Privacy from your ISP — Your internet provider can see every website you visit. A VPN prevents that.
• Accessing content — Some streaming services and websites are only available in certain countries. A VPN lets you connect through a server in that country.
• Avoiding censorship — In some places, certain websites are blocked. A VPN can get around those blocks.

VPN Providers That Work Well on Linux

Not all VPN services bother making Linux apps. These ones do, and they do it well:

How to Set Up a VPN

There are three ways to get a VPN running on Linux. Pick whichever feels most comfortable.

Method 1: Use the Provider's Official App (Easiest)

This is the simplest way. Most providers offer a Linux app you can download from their website. Here's how it typically works:

Mullvad

# Download the .deb or .rpm from mullvad.net, then:
# For Ubuntu/Mint/Debian:
sudo apt install ./MullvadVPN-*.deb

# For Fedora:
sudo dnf install ./MullvadVPN-*.rpm

# Then just open "Mullvad VPN" from your app menu and log in

ProtonVPN

# For Ubuntu/Mint/Debian:
# Download the .deb repository package from protonvpn.com, then:
sudo apt install ./protonvpn-stable-release_*.deb
sudo apt update
sudo apt install proton-vpn-gnome-desktop

# Open "Proton VPN" from your app menu and sign in

NordVPN

# Install the NordVPN CLI (works on most distros):
sh <(curl -sSf https://downloads.nordcdn.com/apps/linux/install.sh)

# Log in and connect:
nordvpn login
nordvpn connect

ExpressVPN

# Download the .deb or .rpm from expressvpn.com, then:
sudo apt install ./expressvpn_*.deb         # Ubuntu/Debian
sudo dnf install ./expressvpn-*.rpm         # Fedora

# Activate and connect:
expressvpn activate
expressvpn connect

Surfshark

# Download the .deb from surfshark.com, then:
sudo apt install ./surfshark-release_*.deb
sudo apt update
sudo apt install surfshark

# Open the Surfshark app from your app menu

Method 2: Through Your Desktop's Network Settings

Both GNOME and KDE have VPN support built right into their network settings. This is handy if you want to use your VPN provider's config files without installing a separate app.

You'll need to grab a config file from your VPN provider first — look for "manual setup" or "OpenVPN/WireGuard config files" on their website.

GNOME (Ubuntu, Fedora, Pop!_OS)

1. Install the VPN plugin you need:

   # For OpenVPN configs:
   sudo apt install network-manager-openvpn-gnome    # Ubuntu/Debian
   sudo dnf install NetworkManager-openvpn-gnome     # Fedora
   
   # For WireGuard configs:
   sudo apt install wireguard                         # Ubuntu/Debian
   sudo dnf install wireguard-tools                   # Fedora

2. Open Settings → Network → VPN and click the + button
3. Choose "Import from file..." and select the config file you downloaded
4. Enter your username/password if prompted, then click Add
5. Flip the VPN toggle to connect

KDE Plasma (Kubuntu, KDE Neon, openSUSE KDE)

1. Install the VPN plugin:

   # For OpenVPN:
   sudo apt install network-manager-openvpn           # Kubuntu
   sudo dnf install NetworkManager-openvpn            # Fedora KDE
   
   # For WireGuard:
   sudo apt install wireguard                          # Kubuntu
   sudo dnf install wireguard-tools                    # Fedora KDE

2. Open System Settings → Connections
3. Click + and choose "Import VPN connection..."
4. Pick your config file, fill in any credentials, and save
5. Click the network icon in your system tray and select the VPN connection

Method 3: OpenVPN / WireGuard from the Terminal

# Install WireGuard
sudo apt install wireguard                    # Ubuntu/Debian/Mint
sudo dnf install wireguard-tools              # Fedora
sudo pacman -S wireguard-tools                # Arch/Manjaro
sudo zypper install wireguard-tools           # openSUSE

# Download a WireGuard config file from your VPN provider
# (usually a .conf file). Save it to /etc/wireguard/

sudo cp ~/Downloads/wg0.conf /etc/wireguard/wg0.conf

# Make sure only root can read it (it contains your private key)
sudo chmod 600 /etc/wireguard/wg0.conf

# Connect
sudo wg-quick up wg0

# Disconnect
sudo wg-quick down wg0

# Check status
sudo wg show

# Auto-connect on boot
sudo systemctl enable wg-quick@wg0

# Install OpenVPN
sudo apt install openvpn                      # Ubuntu/Debian/Mint
sudo dnf install openvpn                      # Fedora
sudo pacman -S openvpn                        # Arch/Manjaro
sudo zypper install openvpn                   # openSUSE

# Download an OpenVPN config file from your VPN provider
# (usually a .ovpn file)

# Connect (it will ask for your username and password)
sudo openvpn --config ~/Downloads/server.ovpn

# The terminal will stay open while connected.
# Press Ctrl+C to disconnect.

# To run it in the background instead:
sudo openvpn --config /etc/openvpn/client/server.conf --daemon

WireGuard vs OpenVPN

These are the two main VPN protocols — the technology that actually creates the encrypted tunnel. Here's how they compare:

Bottom line: Use WireGuard if your provider supports it. It's faster, lighter on your battery, and just as secure. Only use OpenVPN if WireGuard isn't available or you need a specific feature OpenVPN has.

A Warning About Free VPNs

The answer is usually one or more of these:

• Selling your browsing data — Defeating the entire purpose of using a VPN
• Injecting ads into the websites you visit
• Selling your bandwidth — Other people's traffic gets routed through your connection
• Logging everything and handing it over when asked

If you need a free option, ProtonVPN's free tier is the safest choice. It's run by the same team behind Proton Mail, they have a clear business model (paid subscribers fund the free tier), and they've been independently audited.

Kill Switch: What Happens If the VPN Drops?

Sometimes VPN connections drop for a moment — your WiFi glitches, the server hiccups, whatever. When that happens, your computer might send traffic over your normal, unprotected connection without you noticing. A kill switch prevents this.

When a kill switch is enabled, it blocks all internet traffic unless it's going through the VPN. If the VPN disconnects, your internet stops working until the VPN reconnects. No accidental leaks.

How to enable it depends on your provider:

• Mullvad: On by default (they call it "Always require VPN")
• ProtonVPN: On by default in the app
• NordVPN CLI: nordvpn set killswitch enabled
• ExpressVPN CLI: expressvpn preferences set network_lock on
• WireGuard manual setup: Add PostUp and PreDown firewall rules to your config (see the DNS leak section below for related tips)

# In your WireGuard config file (/etc/wireguard/wg0.conf),
# make sure the [Interface] section includes a DNS line:
[Interface]
PrivateKey = your-private-key
Address = 10.x.x.x/32
DNS = 10.64.0.1     # Use your VPN provider's DNS server address

# You can also use privacy-respecting public DNS:
# DNS = 9.9.9.9          # Quad9
# DNS = 1.1.1.1          # Cloudflare

script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf

Per-Distro Install Commands

Here are quick install commands for common VPN tools across different distros.

WireGuard

OpenVPN

NetworkManager VPN Plugins (for desktop integration)