How to Set Up a VPN on Linux (Ubuntu, Fedora & More)

To set up a VPN on Linux, install your provider's Linux app — most major providers ship one — then log in and connect from the terminal or a graphical client. If your provider has no app, you can import a WireGuard or OpenVPN config into NetworkManager instead. Linux gives you more ways to do it than Windows or Mac, so this guide covers the main three, then verifying the result.

Option 1: the provider's official app

This is the simplest route and keeps the kill switch and server list current. The exact package differs by provider, but the shape is the same on Debian and Ubuntu systems:

1. Add the provider's repository, or download their .deb package (or .rpm on Fedora and openSUSE) from the provider's site.
2. Install it with your package manager — apt install for .deb, dnf install for .rpm — and let it pull in dependencies.
3. Log in with the provider's command — often something like a login subcommand that opens a browser to authenticate — or through their GUI app if they include one.
4. Connect to a server. A single connect command joins the recommended server; you can name a country to choose a location.

Your provider's Linux documentation lists the exact package name and commands — follow those, since they change more often than the general steps. Many CLIs let you enable the kill switch and pick WireGuard with a single setting each.

Option 2: NetworkManager (GUI)

If you prefer clicking to typing, most desktops use NetworkManager, which can hold VPN connections directly. Open your network settings, choose to add a VPN, and either import a configuration file or enter the details manually. For WireGuard, importing the .conf file your provider generates is the quickest path; for OpenVPN, install the openvpn NetworkManager plugin first if your distro didn't include it, then import the .ovpn file.

Once imported, the VPN appears as a toggle in your system tray or network menu, so connecting is a single click. This route is handy when a provider offers config files but no native Linux app.

Option 3: WireGuard from the terminal

For a lightweight, always-scriptable setup, WireGuard is built into modern Linux kernels. Install the wireguard-tools package, drop the .conf file your provider gives you into the system's WireGuard directory, and bring the tunnel up with wg-quick. Bringing it down is the matching command. This is popular on servers and headless machines where no desktop is running.

Verify it's working

Confirm the tunnel is actually carrying traffic. From the terminal, fetch your public IP with a tool like curl against an IP-echo service — it should return the server's address. In a browser, run a DNS leak test and check the servers belong to the VPN. If you used the app's CLI, its status command shows the connected server and protocol. Only once your IP has changed is the setup complete.

Which option should you pick?

For a desktop, use the provider's app if they have one — it's the least fuss and includes the kill switch. Use NetworkManager when you have config files and want a GUI toggle, and use terminal WireGuard on servers or minimal systems. Whichever you choose, the principles match every platform in how to set up a VPN, and it's worth making sure your kill switch is set up whichever method you used.

Autostart and connect on boot

On a desktop, most providers' apps have a setting to launch on login and connect automatically — enable it so the tunnel is up before you start browsing. If you use a raw WireGuard tunnel with wg-quick, you can have it come up at boot by enabling the matching systemd service for your configuration, so the machine is protected from the moment it starts. On a server this is the norm; on a laptop, pair it with the app's auto-connect for untrusted networks.

Because Linux setups vary so much between distributions and desktops, treat your provider's Linux page as the authority for exact commands and service names. The concepts here — app, NetworkManager, or wg-quick — hold across distros, but the precise syntax does drift.

Common Linux setup problems

A handful of issues account for most Linux VPN trouble. If the app installs but won't connect, confirm the service or daemon it relies on is actually running, and that your user is in any group the app requires — providers document this. If DNS doesn't route through the VPN, the culprit is usually how your distro manages resolv.conf; the provider's app normally handles it, but a manual WireGuard config may need a matching DNS line to be set.

For OpenVPN through NetworkManager, a missing plugin is the classic snag — if you don't see OpenVPN as an option when adding a VPN, install the NetworkManager OpenVPN plugin package and restart NetworkManager. After any change, re-run the IP check to confirm traffic really is going through the tunnel before you trust it.

Bottom line

Linux gives you three sound routes, so match the method to the machine. On a desktop, use the provider's app when they offer one — it's the least effort and bundles the kill switch. Reach for NetworkManager when you have config files and want a graphical toggle, and use terminal WireGuard on servers or minimal systems where no desktop runs. Install from the provider's repository so updates arrive with your normal system updates, and always finish by fetching your public IP to confirm the tunnel is really carrying traffic. Because commands and package names differ across distributions and change over time, treat your provider's Linux documentation as the final word on syntax — the approach here holds, but the exact lines drift. Get the method and the kill switch right, and Linux is every bit as reliable a VPN platform as Windows or Mac.