5 Best VPN for Linux in 2020

As a Linux user, you are probably techie enough to know what a VPN is and why you need one. So, in this article we will look at VPN issues that uniquely affect Linux users. The biggest of these is the relative lack of support for Linux by VPN services, with the knock-on effect this has on the availability of features which users on other platforms take for granted. 

 

 

Linux Related Guides

As a privacy conscious Linux user, you may find some of our privacy guides useful:

What are the best VPNs for Linux?

The services listed below are not only highly rated by our expert reviewers, but they also all offer strong VPN for Linux support. In fact, all of them offer custom Linux VPN clients.

  1. Private Internet Access - 10 simultaneous connections | No-logs policy | Dedicated clients for Linux distros
  2. AirVPN - Very Secure | Offers a Linux GUI client | Servers in 19 countries
  3. Mullvad - Excepts anonymous payments | Offers a Linux GUI client | Servers in 32 countries
  4. TorGuard - A no-logs VPN with good Linux app
  5. ExpressVPN - Fast servers | Offers a command line client | Servers in 94 countries

For more information on the services above, scroll to the next section. 

Best 5 Linux VPN clients: In-depth analysis

In the list below, we take a more in-depth look at look at why we recommend these VPNs for Linux users.

1. Private Internet Access

Private Internet Access is the best VPN for Linux with dedicated Ubuntu, Mint, Arch and Debian clients

  • Pricing

    From $2.85 - $11.95
  • Available on

    • Windows
    • macOS
    • iOS
    • Android
    • Linux
  • Unblocks

    • Netflix
    • iPlayer

Private Internet Access (PIA) now offers a 64-bit (only) custom client for Linux which is compatible with Ubuntu, Mint, Arch and Debian. PIA says that it's working on support for more Linux flavors. Interestingly, the client is downloaded as a .run file which is installed from the install directory using the command:

 sh pia-linux-1.8-04193.run 

It does everything that PIA’s other desktop apps do, including having a kill switch, “PIA Mace” (DNS ad and malware blocking), and fine-grained control over the OpenVPN encryption settings used. 

Private Internet Access is a US company but is noted for its strong no logs policy, which is almost unique in having been put to the test in court. You can connect up to a very generous 10 devices at once, and PIA boasts a 30-day money-back guarantee.

2. AirVPN

AirVPN remains one of the best VPN for Linux due to it's excellent encryption and great Linux GUI client

  • Pricing

    From $4.64 - $8.05
  • Available on

    • Windows
    • macOS
    • iOS
    • Android
    • Linux

AirVPN is great for Linux users thanks to its strong reputation for users privacy and for implementing the technology needed to protect it. Unfortunately, this is something of a two-edged sword, as AirVPN’s techie focus does not endear it to everyone.

We doubt this is a problem for Linux users, however, who should rejoice at the fact that AirVPN’s excellent open source “Eddie” VPN client provides the full GUI Linux VPN client experience in Linux. This means it has a kill switch, full IPv4 and IPv6 leak protection, and is effective at mitigating against WebRTC leaks.

Eddie allows Linux users to connect to its VPN servers via the Tor network for true anonymity, and to hide their VPN connections inside an SSH or SSL tunnel (stunnel) in order to defeat VPN censorship. Port forwarding is available via the web interface.

Eddie is available precompiled for a Debian, OpenSUSE, Fedora, and ArchLinux. A Tarball is also available for recompiling on any Linux platform. AirVPN keeps no logs at all (they are sent to a dev/null file), allows up to five simultaneous devices, offers 1-day free trial on request, and allows torrenting on all servers.

3. Mullvad

Mullvad VPN is an excellent choice for Linux users, it has a VPN GUI for Linux users and you can pay anonymously to ensure your privacy

  • Pricing

    From $5.50 - $5.60
  • Available on

    • Windows
    • macOS
    • Linux
  • Unblocks

    • iPlayer

Mullvad is a no-logs VPN service based in Sweden, which, like AirVPN, has a very strong privacy and technology focus. Hell, it even accepts anonymous payment in cash sent to it by post! It also offers a full open-source GUI Linux VPN client with all the bells and whistles available to users of other platforms.

These include full DNS protection (with proper IPv6 support, which is very rare), a kill switch, and port forwarding. VPN through Tor is supported through manual configuration. Debian (DEB) and Fedora (RPM) install files are available from the Mullvad website, while the full code with build instructions is available from its GitHub page. 

Mullvad allows up to five devices to connect at once and now offers servers located all around the world. It is also shockingly fast.

4. TorGuard

A good service with a great GUI Linux app

  • Pricing

    From $4.16 - $9.99
  • Available on

    • Windows
    • macOS
    • iOS
    • Android
    • Linux

TorGuard is a US-based VPN service. It keeps no logs, offers a 7-day refund, operates some 3000 bare metal servers in 55 countries, and is dab hand at unblocking Netflix and many other streaming services. And as its name suggests, it has no problem with people torrening on its servers. 


Its full GUI Linux client uses OpenVPN in UDP mode by default, but also supports TCP mode,  and even Cisco OpenConnect (/AnyConnect). In OpenVPN you can choose from a selection of useful ports to use (for example OpenVPN TCP port 443 for onffuscatio), or you can use stunnel to hide the VPN connections inside a TLS/SSL tunnel. 


The client includes a kill switch, as well as allowing you to select programs to terminate if the VPN fails. The client can be downloaded as a DEB (Ubuntu/Debian) or RPM (RedHat/Fedora/CentOS) file, or as a tarball for compiling in ARCH. 

5. ExpressVPN

ExpressVPN is a high speed service with a command line client and great set up guides for Linux users

  • Pricing

    From $6.67 - $12.95
  • Available on

    • Windows
    • macOS
    • iOS
    • Android
    • Linux
  • Unblocks

    • Netflix
    • iPlayer

ExpressVPN is a no-logs VPN service, based in the British Virgin Islands, is in large part responsible for the “professionalization” of the VPN industry. It is thanks to ExpressVPN that most Tier 1 VPN services now offer 24/7 live chat support and a 30-day no quibble’s money-back guarantee. 

A new innovation that we hope will also become an industry standard is ExpressVPN’s use of RAM-only servers. Not only does this ensure that no logs can persist after a reboot, but by booting all servers from an identical image stored on read-only hard disks the risk of vulnerabilities and misconfiguration is minimized.

In addition to manual Linux support for various VPN protocols, ExpressVPN offers a command-line (CLI) Linux OpenVPN client, which is noteworthy for including DNS leak protection. It is available for Ubuntu, Fedora, Arch, and Raspbian, although its source is not available compiling yourself.

Why use Linux? 

Whichever version of Linux you use, be it Ubuntu, Fedora, Kali, Mint, OpenSUSE, etc.. there is a good chance that one of your main motivations for switching away from a corporate OS like Windows or macOS was to improve your privacy.

After all, we know that Windows sends a great deal of personal information back to Microsoft, and Mac OS X/macOS is little better. On top of this, both Microsoft and Apple have in past cooperated closely with the NSA. Credible rumors also persist that the NSA has implemented backdoors in both Windows and OS X.

Using a VPN for Linux to protect your privacy, therefore, goes hand-in-hand with using Linux. But it’s not just for serious stuff! A Linux VPN also lets you watch shows on US Netflix or BBC iPlayer from anywhere in the world, and the right VPN will also let you torrent safely.

Why should I use a VPN for Linux?

As we have already noted, as a tech-savvy and privacy-minded Linux enthusiast, we reckon you know what a VPN is and why you need one. But just as a quick refresher:

A Virtual Private Network creates an encrypted connection between your PC and a VPN server operated by a VPN provider. Most VPN providers run VPN servers in countries all over the world. This means that:

So if you use Linux, then we think you should also use a VPN!

Using a VPN for Linux

In principle, using a VPN for Linux is no different to using a VPN for Windows or macOS. In practice, the fact that home Linux users remain a niche audience has some consequences.

Manual VPN setup

Most VPN services support Linux users with (often very good) manual setup guides. The problem is that while manual setup works well in purely VPN terms, modern GUI VPN clients on other platforms provide key benefits which are not available via manual setup. These are:

  1. DNS leak protection

    In theory, any VPN client will route all DNS requests through the VPN tunnel to be resolved either by the VPN provider itself or be proxied by the VPN provider to a public DNS service in order to hide their originator. 

    But for a variety of reasons, Linux can sometimes route DNS requests directly to the OS-default DNS services (usually your ISP), thus bypassing the VPN’s DNS resolution. VPN clients with DNS leak protection guard against this by using firewall rules to ensure no connections are possible outside the VPN tunnel (IPv6 connections are usually just disabled). 

    Manual VPN setup in Linux, whether using NetworkManager, the CLI OpenVPN client, strongSwan, or whatever, provides no DNS leak protection. Fortunately, there are steps you can take to fix this issue, although they complicate the VPN setup process.

    You can modify resolvconf to push DNS to your VPN’s DNS servers or you can manually configure the iptables firewall to ensure all traffic (including DNS requests) cannot leave your Linux machine outside the VPN tunnel. An excellent guide to doing this is available from IVPN. 

  2. WebRTC mitigation

    Most modern browsers support WebRTC, a communication protocol that allows seamless VoIP and video chat between users inside the browser window. 

    A feature of WebRTC is that it allows easy communication through firewalls, but this is a problem for VPN users as it allows any website to ask for your real IP address and WebRTC STUN servers will just give it to them! Thus bypassing the VPN.

    Many custom VPN clients help mitigate against WebRTC leaks by tightening up VPN settings and using firewall rules, although this is never as secure as preventing WebRTC leaks at the browser level. Fortunately for manual Linux VPN users, disabling WebRTC in the browser is easy. 

  3. Kill switch

    A kill switch ensures that your IP address is not exposed in the event of a VPN dropout, during network switches, and suchlike. These days, most custom VPN clients use firewall walls to ensure no connection is possible when the VPN tunnel is inactive.

    Needless to say, you don’t get this protection when a manual VPN setup method. Configuring iptables as mentioned above, however, also works as a kill switch. 

    For more information on DNS leaks, WebRTC leaks, and kill switches, please see A Complete Guide to IP Leak Protection.

Custom Linux CLI clients

An increasing number of VPN services now offer custom Linux command-line interface (CLI) clients. These are invariably wrappers to the open-source OpenVPN CLI client. As such, they don’t usually offer any advanced features, although ExpressVPN’s client does feature DNS leak protection.

Linux VPN CLI Client

They do, however, make life easier, as they come pre-configured to use that services’ VPN servers.

Custom Linux VPN GUI clients

To get the full functionality enjoyed by users of custom Windows and macOS clients, however, requires a full custom graphical user interface (GUI), client. Of which only two exist on the market at the time of writing this – those from Private Internet Access,  AirVPN and Mullvad.

The GUI VPN clients are effectively identical to their Windows and macOS counterparts and offer the same features. These include full DNS leak protection, WebRTC mitigation, kill switches, and other bells and whistles unique to each provider.

Linux VPN GUI Client

In addition to offering additional functionality, most people find that GUI clients are simply much easier to use thanks to the visual prompts they provide. You do, after all, need to be a seasoned Linux user to not flinch when faced with a blinking command prompt in Terminal!

Linux VPN Mullvad

Using a VPN for different Linux distros

Ubuntu is by far the most popular desktop version of Linux and is, therefore, widely regarded by both developers and as the “default” version of Linux. VPN services are no different, with most Linux VPN support out there heavily focused on Ubuntu users. 

Linux VPN clients

If you use a different version of Linux, you are no doubt used to this, if you are Debian, Mint, Kali, or another Debian-based user, most Ubuntu guides (and DEB packages) should be useable on your distro of choice. If you use a different version of Linux entirely, then you are often on your own.

Custom Linux VPN clients

Linux is Linux, so any Linux VPN app can be re-compiled from its source code (usually in Tarball form) to work on any Linux platform. 

Most VPN providers, however, also make their apps available as executable DEB files for Debian (/Ubuntu/Mint/etc.) users and RPM files for Red Hat (Fedora, RHEL, CentOS/etc.) users. Some may even offer install packages in Snaps or Flatpack format. 

However, it’s fair to say that installing and using a VPN client (whether GUI or CLI) works pretty much exactly the same as any other Linux app on your system.

Using NetworkManager as a Linux VPN GUI

Many Linux distros, including most Debian flavors, use NetworkManager as a GUI interface to manage their network connections. Even with distros that don’t (such as Raspbian), it is usually possible to manually install NetworkManager.

Network Manager Linux

NetworkManger provides an easy-to-use graphic interface for managing your VPN connections. Out-of-the-box it usually only supports the PPTP VPN protocol, but plugins are available for OpenVPN, L2TP/IPsec, and IKEv2 (using strongSwan). As already noted, however, it does not provide any DNS leak protection or a kill switch. 

It is worth noting that AirVPN recommends against using NetworkManager “due to multiple, critical problems.” We have not been able to ascertain what there are, though, and most VPNs are happy to provide setup guides using NetworkManger.

The command-line

With this being Linux, it's only natural that you can set up and run a VPN from the command line! The exact commands will depend on your distro, but apps like OpenVPN work in any Linux environment.

Linux command line client

As we have discussed, you will also need to configure iptables to enjoy a truly secure VPN experience. 

How to install a VPN on Linux

We now have a dedicated guide on how to install a VPN in Linux. It focuses primarily on Debian/Ubuntu, but in the future, we hope to expand it to include other branches of Linux.

Can I get a free VPN for Linux?

For a general look at VPN services, please see our best Free VPN List. With a strong focus on catering to the widest demographic, most free VPN services offer little or no support for Linux users. But luckily for us, two of the best ones do.

Both ProtonVPN and Windscribe offer command-line OpenVPN Linux tools. 

ProtonVPN provides guidance on installing its CLI Linux VPN tool on Ubuntu, Archlinux, Manjaro, Solus, and Fedora, while Winscribe not only supports Ubuntu, Debian, Fedora, and CentOS, but also different versions of its tool optimized for different versions of each distro. 

FAQs

If you still haven't found what you are looking for, check out the FAQs below for a list of common questions related to Linux VPN services.

Written by: Douglas Crawford

Has worked for almost six years as senior staff writer and resident tech and VPN industry expert at ProPrivacy.com. Widely quoted on issues relating cybersecurity and digital privacy in the UK national press (The Independent & Daily Mail Online) and international technology publications such as Ars Technica.

18 Comments

Bela
on April 22, 2020
Reply
Hi there, Have you ever considered the SurfShark? I'm just a happy customer ATM nothing more, I chosen 'cos 1., all OS-s are supported (myself use on Win/Linux/Android) 2., have 7 (?) dedicated nodes for Netflix next to the enormous amount of servers worldwide in 3., unlimited amount of devices allowed 4., easy to use 5., fast, even nowadays (no problem to watching 4K from the states :) ) aaand cheap (or it was cheap at the time when I contracted a 2 years service for less than €50)
Not Given
on November 21, 2018
Reply
Hi, Mullvad are dropping their 32-bit Linux client, so you shouldn't really list them in this article.
PureVPN ? replied to Not Given
on December 1, 2018
Reply
PureVPN Helped the FBI with Logs. In October 2017, a document related to US District Court of Massachusetts shows that contrary to the company's claims, PureVPN does log user IP addresses as it was able to provide this information to the FBI.
https://cdn.proprivacy.com/storage/images/proprivacy/02/member-dougjpg-avatar-image-default-1png-avatar-image-default-minpng-avatar_image-small.png
douglas replied to PureVPN ?
on December 3, 2018
Reply
Hi PureVPN?, Indeed https://proprivacy.com/privacy-news/fbi-solves-case-vpn-lies/ .
Nerd replied to Not Given
on December 4, 2018
Reply
Who even has 32bit only hardware? Give me a break. If you are still only using 32bit, go back to the 1990s.
https://cdn.proprivacy.com/storage/images/proprivacy/02/member-dougjpg-avatar-image-default-1png-avatar-image-default-minpng-avatar_image-small.png
douglas replied to Not Given
on November 22, 2018
Reply
Hi Not Given, Can you please point to a source for this? The latest stable version (from just last week!) update includes improvements to the Linux client (https://www.mullvad.net/en/blog/2018/11/15/update-your-app-new-stable-version-20185/ ).
Louis A. Coleman
on July 3, 2018
Reply
Virtual Private Network helps you to secure your connection.By the way thanks for sharing this informative article!.
Richard G
on May 18, 2018
Reply
Mullvad does support UK servers, it has 2 that I know of - one in London and one in Manchester
https://cdn.proprivacy.com/storage/images/proprivacy/02/member-dougjpg-avatar-image-default-1png-avatar-image-default-minpng-avatar_image-small.png
Douglas Crawford replied to Richard G
on May 21, 2018
Reply
Hi Richard, Indeed, and thanks to pointing this out. The provider summary in this article is outdated (although I have just fixed this issue). As I clearly state in my full Mullvad Review, Mulvad does now support UK servers. We are currently working on a way to ensure summary details across our articles stay as up-to-date as possible).
Show More Got Something to Say?

Write Your Own Comment

Your comment has been sent to the queue. It will appear shortly.

Your comment has been sent to the queue. It will appear shortly.

Your comment has been sent to the queue. It will appear shortly.

  Your comment has been sent to the queue. It will appear shortly.

We recommend you check out one of these alternatives:

The fastest VPN we test, unblocks everything, with amazing service all round

Longtime top ranked VPN, with great price and speeds

One of the largest VPNs, voted best VPN by Reddit

Strong presence, no-logs policy