A VPN for Linux you can read before you run
Native packages for Debian, Ubuntu, Fedora and Arch, plus a CLI that scripts cleanly. The client is open source, every release ships a checksum, and the tunnel is standard WireGuard if you would rather configure it yourself.
Download for LinuxBuilt the way Linux users expect
A CLI that scripts
Connect, switch location, check status and disconnect from the shell, with sane exit codes. Fine to drive from a systemd unit, a cron job or a shell function — not a GUI with a terminal bolted on.
Real packages
A .deb for Debian and Ubuntu, an .rpm for Fedora, and an Arch package. Roughly 9 MB. They install and update through your package manager rather than a bundled self-updater running as root.
Source you can audit
The client is open source and every release publishes a SHA-256 checksum. Build it yourself, compare the hash, and you have verified that the binary corresponds to code you can read. See the open source page.
Or skip the client entirely
The tunnel is standard WireGuard. Download a config file and run it with wg-quick or NetworkManager if you would rather not install anything of ours at all. Nothing about the service depends on our client.
Kill switch via nftables
Traffic is blocked at the firewall if the tunnel drops, rather than being allowed out while the client notices and reconnects. This is where most Linux VPN setups quietly leak.
DNS handled properly
Resolver configuration is applied through systemd-resolved where it exists and by direct resolv.conf management where it does not, so lookups stay inside the tunnel on either kind of system.
From the package manager
Grab the package for your distribution
The download page has a .deb, an .rpm and an Arch package, each around 9 MB, alongside the SHA-256 checksums.
Verify the checksum first
Run sha256sum against the file and compare it against the published hash before installing anything. This takes five seconds and is the entire reason we publish them.
Install and run once
Install through your package manager. On first run the client generates a random 16-digit account number locally — there is no registration step and no email address to enter.
Connect from the shell
Bring the tunnel up, choose a country from the server list, and confirm status. Everything the GUI does is available as a command.
Confirm no leaks
Check with the DNS leak test. On Linux especially, DNS handling varies between distributions and is the most common place a tunnel leaks while reporting connected.
“Trust us” is a weaker claim on Linux
A VPN sees your traffic by design. That makes the provider’s honesty the entire security model, and on every other platform you are largely taking it on faith — the client is a binary, and the promise is a page on a website.
Linux is the one place where that does not have to be true. The client source is public, releases are checksummed, and the tunnel is a documented protocol rather than something proprietary. You can read what the client does, build it, verify the binary matches, and then decide.
You can also decline the client entirely and run the tunnel with wg-quick from a config file. If a provider’s service only works through software you cannot inspect, that is worth noticing.
Common questions
Which distributions are supported?
Is there a GUI or just a command line?
Can I use it on a headless server?
Does the kill switch actually work on Linux?
Do I have to install your client at all?
Other platforms
Verify it, then trust it
Open-source client, checksummed releases, standard WireGuard underneath. Thirty days to change your mind.