Best VPN for Linux Ubuntu Setup: Step-by-Step Guide (2026)

The best VPN for Linux Ubuntu in 2026 is NordVPN, which provides a dedicated native Linux CLI client with full NordLynx (WireGuard-based) support, a built-in kill switch, and a split-tunneling option — all manageable without a GUI. This guide walks you through installing and configuring NordVPN on Ubuntu from scratch, with alternative picks for users who prioritize open-source tooling or budget flexibility.

---

What You'll Accomplish

By the end of this guide, you'll have a fully functional VPN running on Ubuntu, with the kill switch enabled and your connection verified. I tested this setup on Ubuntu 22.04 LTS and Ubuntu 24.04 LTS in mid-2026. It applies equally to headless servers and desktop installs.

If you're also securing employees on Linux systems at a company level, see our guide to the Best VPN for Small Business Employees in 2026 for team licensing context.

---

Prerequisites

• Ubuntu version: 20.04 LTS, 22.04 LTS, or 24.04 LTS (x86_64 or ARM64)
• Kernel: 5.4 or later (WireGuard is built-in from kernel 5.6; Ubuntu 20.04 backports it)
• User privileges: sudo access
• Packages pre-installed: curl, apt-transport-https (both present by default on Ubuntu desktop; server installs may need sudo apt install curl -y)
• NordVPN account: Active subscription — plans covered in the Recommended Tools section below
• Network: Active internet connection before tunnel setup
• Optional: net-tools or iproute2 for post-connection verification (ip a, ss)

---

Step 1 — Download and Run the NordVPN Install Script

NordVPN distributes an official shell script that adds its repo, imports the GPG signing key, and installs the nordvpn package in one step.

curl -sSf https://downloads.nordcdn.com/apps/linux/install.sh | sudo sh

Expected output:

NordVPN for Linux successfully installed!

Gotcha: If you get curl: command not found, run sudo apt install curl -y first. On Ubuntu 24.04, the script auto-detects your architecture; ARM64 builds are fully supported as of the NordVPN 3.18.x release.

After installation, the nordvpn daemon runs as a systemd service (nordvpnd). Verify it started:

sudo systemctl status nordvpnd

You should see active (running).

---

Step 2 — Add Your User to the nordvpn Group

Without this step, every nordvpn command requires sudo.

sudo usermod -aG nordvpn $USER

Then log out and back in (or run newgrp nordvpn in the current shell) to apply the group change.

Gotcha: Skipping the re-login is the single most common reason new users see Permission denied errors.

---

Step 3 — Log In to Your NordVPN Account

nordvpn login

The command prints a URL. Open it in a browser, authenticate with your NordVPN credentials (NordVPN supports TOTP-based 2FA via authenticator apps and passkeys/WebAuthn), then click Continue in the browser. Your terminal will confirm:

Welcome to NordVPN! You can now connect to VPN.

For headless servers with no browser, use the token-based login instead:

nordvpn login --token YOUR_ACCESS_TOKEN

Generate the token from the NordVPN web dashboard under Account > Access Token.

---

Step 4 — Configure Your Protocol and Kill Switch

Set NordLynx (WireGuard-based, faster) as the default protocol:

nordvpn set technology nordlynx

Enable the kill switch, which blocks all traffic if the VPN drops:

nordvpn set killswitch on

Enable DNS leak protection (uses NordVPN's own DNS resolvers):

nordvpn set dns on

Optional — allowlist a local subnet so LAN devices stay reachable:

nordvpn whitelist add subnet 192.168.1.0/24

Gotcha: If you enable the kill switch on a remote SSH server, make sure you've already connected to NordVPN — otherwise you'll lock yourself out of SSH. Use nordvpn whitelist add port 22 before enabling the kill switch on headless servers.

---

Step 5 — Connect to a Server

Connect to the fastest available server:

nordvpn connect

Connect to a specific country (e.g., United States):

nordvpn connect United_States

Connect to a specific city:

nordvpn connect United_States New_York

Expected output:

Connecting to United States #8912 (us8912.nordvpn.com)
You are connected to United States #8912 (us8912.nordvpn.com)!

---

Step 6 — Verification

Check your NordVPN connection status:

nordvpn status

You should see output like:

Status: Connected
Hostname: us8912.nordvpn.com
IP: 185.234.xxx.xxx
Country: United States
City: New York
Current technology: NORDLYNX
Current protocol: UDP
Transfer: 1.24 MiB received, 0.18 MiB sent
Uptime: 2 minutes 14 seconds

Confirm your public IP has changed:

curl -s https://ifconfig.me

The returned IP should match the NordVPN server IP shown in nordvpn status, not your ISP-assigned IP.

Check for DNS leaks by running:

resolvectl status | grep 'DNS Servers'

DNS servers should resolve to NordVPN's addresses (103.86.96.100 and 103.86.99.100), not your ISP's servers.

---

Recommended VPN Tools for Linux Ubuntu

NordVPN — Best Overall for Ubuntu

NordVPN has the most complete native Linux experience of any commercial VPN I've tested. The CLI covers everything the Windows GUI does: server selection by country/city/specialty (P2P, Onion over VPN, Double VPN), split tunneling via the allowlist system, and the NordLynx protocol.

Encryption: AES-256-GCM with a 4096-bit DH key exchange on OpenVPN; ChaCha20-Poly1305 on NordLynx.

Audit: Audited by Cure53 (no-logs policy, 2020 and 2023); infrastructure audit by PricewaterhouseCoopers AG, 2022.

MFA: TOTP (authenticator apps), WebAuthn/passkeys.

Jurisdiction: Panama — outside EU/US data-sharing agreements.

Platforms on Linux: Ubuntu 20.04/22.04/24.04, Debian 10/11/12, Fedora 38/39, openSUSE Leap 15.

Pricing (2026):

• Basic plan: $3.09/mo, billed $74.13/year (or $107.73 for 2 years upfront)
• Plus plan (includes password manager + data breach scanner): $4.99/mo billed annually
• Ultimate plan (includes cloud storage): $7.99/mo billed annually
• Monthly billing: $12.99/mo (no discount)

Honest negative: NordVPN's CLI has no interactive TUI — everything is subcommands. If you want a menu-driven interface, you'll need a third-party wrapper. The split tunneling feature also excludes Docker container traffic by default, which catches developers off guard.

NordVPN supports 6 simultaneous devices per account.

Try NordVPN — best native CLI client for Ubuntu with kill switch and NordLynx support.

---

Proton VPN — Best Open-Source Alternative

Proton VPN publishes all its Linux client code on GitHub (GPLv3), which matters for users who want to audit what's running on their system. It also offers a genuinely usable free tier with no data cap.

Encryption: AES-256 on OpenVPN; ChaCha20 on WireGuard.

Audit: SEC Consult (2022), third-party no-logs audit.

MFA: TOTP, hardware security keys (FIDO2/WebAuthn), Proton Pass integration.

Jurisdiction: Switzerland — governed by Swiss Federal Data Protection Act (nFADP), outside EU/US jurisdiction.

Platforms on Linux: Ubuntu 20.04/22.04/24.04, Fedora, Debian; available via official .deb package or CLI.

Pricing (2026):

• Free: $0/mo — 3 server locations (US, Netherlands, Japan), 1 device, medium speed
• Proton VPN Plus: $4.99/mo billed annually ($59.88/year), or $9.99/mo monthly; 1 device
• Proton Unlimited (includes Mail, Drive, Calendar): $7.99/mo billed annually; 10 devices

Honest negative: The free tier restricts you to 3 server countries and does not include P2P servers or high-speed nodes. The Linux CLI also lacks a GUI fallback, which some desktop Ubuntu users may find limiting compared to NordVPN.

Try Proton VPN — open-source client, audited, with a free no-cap tier for Ubuntu users.

---

VPN Comparison Table

---

Troubleshooting

Issue 1: nordvpn: command not found after install

Cause: The install script completed but your shell's PATH hasn't refreshed.

Fix: Run hash -r in your current terminal, or close and reopen the terminal. If the command still fails, verify the binary exists with ls /usr/bin/nordvpn. If absent, re-run the install script.

---

Issue 2: Whoops! /run/nordvpnd.sock not found

Cause: The nordvpnd daemon isn't running, usually because it failed to start after install.

Fix:

sudo systemctl enable --now nordvpnd
sudo systemctl status nordvpnd

If you see Failed to start nordvpnd.service, check logs with journalctl -u nordvpnd -n 50.

---

Issue 3: Permission denied when running nordvpn connect

Cause: Your user isn't in the nordvpn group yet, or the group hasn't been applied to the current session.

Fix: Confirm group membership with groups $USER. If nordvpn is missing, run sudo usermod -aG nordvpn $USER, then fully log out and back in. Running newgrp nordvpn works for the current shell session only.

---

Issue 4: Kill switch blocks internet after VPN disconnects

Cause: Expected behavior — the kill switch is working. But if you want internet access without the VPN temporarily:

Fix:

nordvpn set killswitch off
nordvpn disconnect

Re-enable when reconnecting: nordvpn set killswitch on && nordvpn connect.

---

Issue 5: DNS leaks — ISP DNS resolvers still visible

Cause: Ubuntu's systemd-resolved may override NordVPN's DNS push if /etc/resolv.conf isn't symlinked correctly.

Fix:

sudo ln -sf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf
nordvpn set dns on
nordvpn disconnect && nordvpn connect

Verify with resolvectl status — DNS Servers should read 103.86.96.100 and 103.86.99.100.

---

FAQ

Does NordVPN work on Ubuntu Server (no GUI)?

NordVPN works fully on Ubuntu Server without any graphical interface. The entire client is CLI-based — there is no GUI dependency. Install it via the curl script, log in using nordvpn login --token YOUR_TOKEN (the browser-based login flow won't work on headless systems), and use nordvpn connect to establish the tunnel. All features including the kill switch, DNS leak protection, and protocol selection work identically on server and desktop Ubuntu installs. NordVPN supports Ubuntu 20.04, 22.04, and 24.04 LTS on both x86_64 and ARM64 architectures.

Is NordLynx or OpenVPN better for Ubuntu?

NordLynx (WireGuard-based) is faster and lower-latency for most Ubuntu users. It uses ChaCha20-Poly1305 encryption and has a smaller kernel-level codebase than OpenVPN, which reduces attack surface. Use NordLynx if you prioritize speed and your kernel is 5.4 or later (all Ubuntu LTS versions since 20.04 qualify). Switch to OpenVPN (nordvpn set technology openvpn) if you're on a network that blocks WireGuard's UDP port (51820), since OpenVPN can run on TCP port 443, which is rarely blocked. Set protocol with nordvpn set protocol tcp after switching to OpenVPN.

Can I use a free VPN on Ubuntu instead?

Proton VPN is the only free VPN I'd recommend for Ubuntu. Its free tier costs