5 Best VPN for Linux in 2019

If you are a Linux user, then you most likely know that A VPN will keep what you do on the internet private. In this article, we will concentrate on VPN issues which specifically affect Linux users and recommend the five best Linux VPN services.

As a privacy conscious Linux user, you may find some of our privacy guides useful:

What are the best VPNs for Linux?

The services listed below are not only highly rated by our expert reviewers, but they also all offer strong VPN for Linux support. In fact, all of them offer custom Linux VPN clients.

  1. AirVPN - Very Secure | Offers a Linux GUI client | Servers in 19 countries
  2. Mullvad - Excepts anonymous payments | Offers a Linux GUI client | Servers in 32 countries
  3. ExpressVPN - Fast servers | Offers a command line client | Servers in 94 countries
  4. NordVPN - Based in Panama | Offers a Linux command line client | Servers in 61 countries
  5. CyberGhost - The cheapest VPN on the list | Great security features | Servers in 60 countries

For more information on the services above, scroll to the next section. 

Best 5 Linux VPN clients: In-depth analysis

In the list below, we take a more in-depth look at look at why we recommend these VPNs for Linux users.

1. AirVPN

AirVPN - the best VPN for Linux due to it's excellent encryption and great Linux GUI client

  • Pricing

    From $4.64 / month
  • Available on

    • Windows
    • MacOS
    • Android
    • Linux
    • iOS

AirVPN is the best VPN for Linux users. They have a strong reputation for being fanatical about its users’ privacy and for implementing the technology needed to protect it. Unfortunately, this is something of a two-edged sword, as AirVPN’s techie focus does not endear it to everyone.

We doubt this is a problem for Linux users, however, who should rejoice at the fact that AirVPN’s excellent open source “Eddie” VPN client provides the full GUI Linux VPN client experience in Linux. This means it has a kill switch, full IPv4 and IPv6 leak protection, and is effective at mitigating against WebRTC leaks.

Eddie allows Linux users to connect to its VPN servers via the Tor network for true anonymity, and to hide their VPN connections inside an SSH or SSL tunnel (stunnel) in order to defeat VPN censorship. Port forwarding is available via the web interface.

Eddie is available precompiled for a Debian, OpenSUSE, Fedora, and ArchLinux. A Tarball is also available for recompiling on any Linux platform. AirVPN keeps no logs at all (they are sent to a dev/null file), allows up to five simultaneous devices, offers 1-day free trial on request, and allows torrenting on all servers.

2. Mullvad

Mullvad VPN is an excellent choice for Linux users, it has a VPN GUI for Linux users and you can pay anonymously to ensure your privacy

  • Pricing

    From $5.50 / month
  • Available on

    • Windows
    • MacOS
    • Linux
  • Features

    • iPlayer

Mullvad is a no-logs VPN service based in Sweden, which, like AirVPN, has a very strong privacy and technology focus. Hell, it even accepts anonymous payment in cash sent to it by post! It also offers a full open-source GUI Linux VPN client with all the bells and whistles available to users of other platforms.

These include full DNS protection (with proper IPv6 support, which is very rare), a kill switch, and port forwarding. VPN through Tor is supported through manual configuration. Debian (DEB) and Fedora (RPM) install files are available from the Mullvad website, while the full code with build instructions is available from its GitHub page. 

Mullvad allows up to five devices to connect at once and now offers servers located all around the world. It is also shockingly fast.

3. ExpressVPN

ExpressVPN is a high speed service with a command line client and great set up guides for Linux users

  • Pricing

    From $6.67 / month
  • Available on

    • Windows
    • MacOS
    • Android
    • Linux
    • iOS
  • Features

    • Netflix
    • iPlayer

ExpressVPN is a no-logs VPN service, based in the British Virgin Islands, is in large part responsible for the “professionalization” of the VPN industry. It is thanks to ExpressVPN that most Tier 1 VPN services now offer 24/7 live chat support and a 30-day no quibble’s money-back guarantee. 

A new innovation that we hope will also become an industry standard is ExpressVPN’s use of RAM-only servers. Not only does this ensure that no logs can persist after a reboot, but by booting all servers from an identical image stored on read-only hard disks the risk of vulnerabilities and misconfiguration is minimized.

In addition to manual Linux support for various VPN protocols, ExpressVPN offers a command-line (CLI) Linux OpenVPN client, which is noteworthy for including DNS leak protection. It is available for Ubuntu, Fedora, Arch, and Raspbian, although its source is not available compiling yourself.

4. NordVPN

NordVPN offers excellent encryption and great CLI set up instructions for Linux Debian users

  • Pricing

    From $3.49 / month
  • Available on

    • Windows
    • MacOS
    • Android
    • iOS
  • Features

    • Netflix
    • iPlayer

NordVPN is a large no-logs VPN service is based in privacy-friendly Panama. It has a strong consumer-facing focus, and is known for its 214/7 live chat support, 30-day free trial, and its ability to unblock popular streaming services such as US Netflix and BBC iPlayer. A free full Smart DNS is included in the startling-low entry price. 

NordVPN offers a simple command-line OpenVPN tool which comes pre-configured for NordVPNs server locations, including NordVPN’s obfuscated XOR servers. It allows you to switch easily between UDP and TCP connections, which can be useful for evading VPN censorship measures. Its autofill feature also makes life easier. 

The app is available to download as a DEB or RPM package, although the CLI setup instructions assume Debian. NordVPN allows you connect up top six devices at once, offers 24/7 live chat support, and will refund your money up to 30-days after payment.

5. CyberGhost

CyberGhost VPN is cheap and it has fantastic security features making it a great Linux VPN

  • Pricing

    From $2.75 / month
  • Available on

    • Android
    • iOS
    • Windows
    • MacOS
    • Linux
  • Features

    • Netflix
    • iPlayer

CyberGhost VPN is another big-name player in the VPN market space, CyberGhost is a no-logs VPN service based in Romania (although it is very proud of the fact that’s software is developed in Germany).

 Most of its headline features are only available through its GUI apps on other platforms, but we figure most Linux enthusiasts use more than one platform. These features include split-tunneling, and WiFi protection, plus ad-blocking and tracking protection using DNS blocklists. 

CyberGhost’s CLI Linux client is little more than the open-source OpenVPN client preconfigured to use  CyberGhost’s servers, but this does provide real convenience over downloading and running the .ovpn files manually.

The client is available for Ubuntu and Fedora and appears to be optimized for different versions of those distros. The DEB and RPM packages should work on any systems that support those distribution formats, though. 

CyberGhost offers a very generous 45-day money-back guarantee, allows up to seven simultaneous connections, and offers 24/7 live chat support. A 7-day card-free trial is also available.

Why use Linux? 

Whichever version of Linux you use, be it Ubuntu, Fedora, Kali, Mint, OpenSUSE, etc.. there is a good chance that one of your main motivations for switching away from a corporate OS like Windows or macOS was to improve your privacy.

After all, we know that Windows sends a great deal of personal information back to Microsoft, and Mac OSX/MacOS is little better. On top of this, both Microsoft and Apple have in past cooperated closely with the NSA. Credible rumors also persist that both Windows and OSX have been backdoored by the NSA.

Using a VPN for Linux to protect your privacy, therefore, goes hand-in-hand with using Linux. But it’s not just for serious stuff! A Linux VPN also lets you watch shows on US Netflix or BBC iPlayer from anywhere in the world, and the right VPN will also let you torrent safely.

Why should I use a VPN for Linux?

As we have already noted, as a tech-savvy and privacy-minded Linux enthusiast, we reckon you know what a VPN is and why you need one. But just as a quick refresher:

A Virtual Private Network creates an encrypted connection between your PC and a VPN server operated by a VPN provider. Most VPN providers run VPN servers located in countries all over the world. This means that:

  • A VPN prevents your ISP from seeing what you get up to on the internet because the VPN server acts as a specialized proxy server. So all your ISP can see is that you have connected to a VPN server, not what you do on the internet after that.
  • You ISP also can’t see the contents of your data because it is encrypted between your PC and the VPN server.
  • Given that every government mass surveillance project in the world relies on ISPs logging your data to know what you get up to online,  what your ISP doesn’t know, neither will your government (unless it is actively investigating you as an individual, of course). 
  • The proxy works both ways, so websites you visit can’t see your real IP address. They only see the IP address of the VPN server. Note that websites also use other sneaky ways to follow you online, so a VPN should always be supplemented with anti-tracking browser add-ons
  • Like websites, P2P torrent peers can’t see your real address, allowing you to torrent away with peace of mind.
  • VPNs are great for defeating censorship, be it on political, “moral,” or copyright grounds. Simply connect to a VPN server located somewhere that doesn’t censor the internet! 
  • And because VPN servers are located all over the place, they are also very useful for unblocking BBC iPlayer and US Netflix (which has a much bigger catalog than is available to paying customers elsewhere).
  • Using a VPN protects against WiFi hackers and unreliable WiFi hosts when using public WiFi hotspots since all data between your PC and the VPN server is securely encrypted.

So if you use Linux then we think you should also use a VPN!

Using a VPN for Linux

In principle, using a VPN for Linux is no different to using a VPN for Windows or macOS. In practice, the fact that home Linux users remain a niche audience has some consequences.

Manual VPN setup

Most VPN services support Linux users with (often very good) manual setup guides. The problem is that while manual setup works well in purely VPN terms, modern GUI VPN clients on other platforms provide key benefits which are not available via manual setup. 

The key benefits of setting up your Linux VPN client are as follows:

  1. DNS leak protection

    In theory, any VPN client will route all DNS requests through the VPN tunnel to be resolved either by the VPN provider itself or be proxied by the VPN provider to a public DNS service in order to hide their originator. 

    But for a variety of reasons, Linux can sometimes route DNS requests directly to the OS-default DNS services (usually your ISP), thus bypassing the VPN’s DNS resolution. VPN clients with DNS leak protection guard against this by using firewall rules to ensure no connections are possible outside the VPN tunnel (IPv6 connections are usually just disabled). 

    Manual VPN setup in Linux, whether using NetworkManager, the CLI OpenVPN client, strongSwan, or whatever, provides no DNS leak protection. Fortunately, there are steps you can take to fix this issue, although they complicate the VPN setup process.

    You can modify resolvconf to push DNS to your VPN’s DNS servers or you can manually configure the iptables firewall to ensure all traffic (including DNS requests) cannot leave your Linux machine outside the VPN tunnel. An excellent guide to doing this is available from IVPN. 

  2. WebRTC mitigation

    Most modern browsers support WebRTC, a communication protocol that allows seamless VoIP and video chat between users inside the browser window. 

    A feature of WebRTC is that it allows easy communication through firewalls, but this is a problem for VPN users as it allows any website to ask for your real IP address and WebRTC STUN servers will just give it to them! Thus bypassing the VPN.

    Many custom VPN clients help mitigate against WebRTC leaks by tightening up VPN settings and using firewall rules, although this is never as secure as preventing WebRTC leaks at the browser level. Fortunately for manual Linux VPN users, disabling WebRTC in the browser is easy. 

  3. Kill switch

    A kill switch ensures that your IP address is not exposed in the event of a VPN dropout, during network switches, and suchlike. These days most custom VPN clients use firewall walls to ensure no connection is possible when the VPN tunnel is inactive.

    Needless to say, you don’t get this protection when a manual VPN setup method. Configuring iptables as mentioned above, however, also works as a kill switch. 

    For more information on DNS leaks, WebRTC leaks, and kill switches, please see A Complete Guide to IP Leak Protection.

Custom Linux CLI clients

An increasing number of VPN services now offer custom Linux command-line interface (CLI) clients. These are invariably wrappers to the open-source OpenVPN CLI client. As such they don’t usually offer any advanced features, although ExpressVPN’s client does feature DNS leak protection.

Linux VPN CLI Client

They do, however, make life easier, as they come pre-configured to use that services’ VPN servers.

Custom Linux VPN GUI clients

To get the full functionality enjoyed by users of custom Windows and macOS clients, however, requires a full custom graphical user interface (GUI), client. Of which only two exist on the market at the time of writing this – those from AirVPN and Mullvad.

Linux VPN GUI Client

The GUI VPN clients are effectively identical to their Windows and macOS counterparts and offer the same features. These include full DNS leak protection, WebRTC mitigation, kill switches, and other bells and whistles unique to each provider.

Linux VPN Mullvad

In addition to offering additional functionality, most people find that GUI clients are simply much easier to use thanks to the visual prompts they provide. You do, after all, need to be a seasoned Linux user to not flinch when faced with a blinking command prompt in Terminal!

Using a VPN for different Linux distros

Ubuntu is by far the most popular desktop version of Linux and is therefore widely regarded by both developers and as the “default” version of Linux. VPN services are no different, with most Linux VPN support out there heavily focused on Ubuntu users. 

Linux VPN clients

If you use a different version of Linux you are no doubt used to this, if you are Debian, Mint, Kali, or another Debian-based user, most Ubuntu guides (and DEB packages) should be useable on your distro of choice. If you use a different version of Linux entirely, then you are often on your own.

Custom Linux VPN clients

Linux is Linux, so any Linux VPN app can be re-compiled from its source code (usually in Tarball form) to work on any Linux platform. 

Most VPN providers, however, also make their apps available as executable DEB files for Debian (/Ubuntu/Mint/etc.) users and RPM files for Red Hat (Fedora, RHEL, CentOS/etc.) users. Some may even offer install packages in Snaps or Flatpack format. 

It’s fair to say, however, that installing and using a VPN client (whether GUI or CLI) works pretty much exactly the same as any other Linux app on your system.

Using NetworkManager as a Linux VPN GUI

Many Linux distros, including most Debian flavors, use NetworkManager as a GUI interface to manage their network connections. Even with distros that don’t (such as Raspbian), it is usually possible to manually install NetworkManager.

Network Manager Linux

NetworkManger provides an easy-to-use graphic interface for managing your VPN connections. Out-of-the-box it usually only supports the PPTP VPN protocol, but plugins are available for OpenVPN, L2TP/IPsec, and IKEv2 (using strongSwan). As already noted, however, it does not provide any DNS leak protection or a kill switch. 

It is worth noting that AirVPN recommends against using NetworkManager “due to multiple, critical problems.” We have not been able to ascertain what there are, though, and most VPNs are happy to provide setup guides using NetworkManger.

The command-line

Hey, this is Linux! So, of course, you can set up and run a VPN from the command line! The exact commands will depend on your distro, but apps like OpenVPN work in any Linux environment.

Linux command line client

As we have discussed, you will also need to configure iptables to enjoy a truly secure VPN experience. 

How to install a VPN on Linux

We now have a dedicated guide on how to install a VPN in Linux. It focuses primarily on Debian/Ubuntu, but in the future, we hope to expand it to include other branches of Linux.

Can I get a free VPN for Linux?

For a general look at VPN services, please see our best Free VPN List. With a strong focus on catering to the widest possible demographic, most free VPN services offer little or no support for Linux users. But luckily for us, two of the best ones do.

Both ProtonVPN and Windscribe offer command-line OpenVPN Linux tools. 

ProtonVPN provides guidance on installing its CLI Linux VPN tool on Ubuntu, Archlinux, Manjaro, Solus, and Fedora, while Winscribe not only supports Ubuntu, Debian, Fedora, and CentOS, but also different versions of its tool optimized for different versions of each distro. 

FAQs

If you still haven't found what you are looking for, take a look at the FAQs below for a list of common questions related to Linux VPN services.

Written by: Douglas Crawford

Has worked for almost six years as senior staff writer and resident tech and VPN industry expert at ProPrivacy.com. Widely quoted on issues relating cybersecurity and digital privacy in the UK national press (The Independent & Daily Mail Online) and international technology publications such as Ars Technica.

17 Comments

  1. Not Given

    on November 21, 2018
    Reply

    Hi, Mullvad are dropping their 32-bit Linux client, so you shouldn't really list them in this article.

    1. PureVPN ? replied to Not Given

      on December 1, 2018
      Reply

      PureVPN Helped the FBI with Logs. In October 2017, a document related to US District Court of Massachusetts shows that contrary to the company's claims, PureVPN does log user IP addresses as it was able to provide this information to the FBI.

      1. douglas replied to PureVPN ?

        on December 3, 2018
        Reply

        Hi PureVPN?, Indeed https://proprivacy.com/privacy-news/fbi-solves-case-vpn-lies/ .

    2. Nerd replied to Not Given

      on December 4, 2018
      Reply

      Who even has 32bit only hardware? Give me a break. If you are still only using 32bit, go back to the 1990s.

    3. douglas replied to Not Given

      on November 22, 2018
      Reply

      Hi Not Given, Can you please point to a source for this? The latest stable version (from just last week!) update includes improvements to the Linux client (https://www.mullvad.net/en/blog/2018/11/15/update-your-app-new-stable-version-20185/ ).

  2. Louis A. Coleman

    on July 3, 2018
    Reply

    Virtual Private Network helps you to secure your connection.By the way thanks for sharing this informative article!.

  3. Richard G

    on May 18, 2018
    Reply

    Mullvad does support UK servers, it has 2 that I know of - one in London and one in Manchester

    1. Douglas Crawford replied to Richard G

      on May 21, 2018
      Reply

      Hi Richard, Indeed, and thanks to pointing this out. The provider summary in this article is outdated (although I have just fixed this issue). As I clearly state in my full Mullvad Review, Mulvad does now support UK servers. We are currently working on a way to ensure summary details across our articles stay as up-to-date as possible).

  4. JorkanoFaln

    on February 24, 2018
    Reply

    Hi, You forgot about perfect privacy vpn in your review this vpn has a linux GUI client and complies with privacytools.io criteria. I don't understand why NordVPN is the second best VPN for Linux, if the latter doesn't even have a client for Linux. The VPN services, I know have a Linux client are: Perfect-Privacy (GUI), Mullvad (GUI), AirVPN (GUI), Private Internet Access (GUI) as well as Expressvpn (CLI). Could you also write an article on the best VPNs for hackers (white hat) and tech professionals?

    1. Douglas Crawford replied to JorkanoFaln

      on February 26, 2018
      Reply

      Hi JorkanoFaln, Yeah. I have raised this point with our team before. Our 5 Best lists are a group decision, and the team decided the overall advantages of NordVPN and CyberGhost outweighed the fact that they don't have dedicated Linux clients. Pefect Privacy and PIA are both good VPN services, however, so I will raise the issue again.

Write Your Own Comment

Your comment has been sent to the queue. It will appear shortly.

Your comment has been sent to the queue. It will appear shortly.

Your comment has been sent to the queue. It will appear shortly.

  Your comment has been sent to the queue. It will appear shortly.

We recommend you check out one of these alternatives:

Large brand with very good value, and a budget price

The fastest VPN we test, unblocks everything, with amazing service all round

Longtime top ranked VPN, with great price and speeds

One of the cheapest VPNs out there, but still a good service