Best VPN for Linux 2026 - Ubuntu 24.04 & Fedora 41 Complete Setup

Linux is the platform where VPN clients have improved most in recent years - and also where the traps are subtlest (DNS leaks via systemd-resolved, a kill switch that disappears on reboot, NetworkManager conflicts). This guide documents what actually works in 2026 for Ubuntu 24.04 and Fedora 41, based on each provider's documented Linux capabilities and the configuration steps you can reproduce yourself.

Why Use a VPN on Linux in 2026 - Real Use Cases

Linux isn't a homogeneous platform. A developer on Pop!_OS, a sysadmin on Ubuntu Server 22.04, and a journalist on Tails have radically different needs. The four most common use cases:

Road warrior / sysadmin on the go. Connecting from a hotel or coworking space, SSH access to production servers. Without a VPN, the connection metadata is exposed on the local network (SSH encryption protects the content, not the fact that you are reaching a given host). With an active VPN, the only visible traffic on the local network is the encrypted tunnel. With a modern protocol like WireGuard/NordLynx the throughput overhead on a nearby server is typically small - generally negligible for SSH or git push. Measure it on your own line with speedtest-cli or iperf3 before and after connecting.

Privacy-conscious developer. Building sensitive tools or services without exposing your real IP to third-party services you're testing (APIs, scrapers, authorized penetration testing). Linux is the natural platform for this use case because you can bind the VPN to a specific interface, route only certain processes through the tunnel (split tunneling), or configure an isolated network namespace.

VPN server admin. Administering a WireGuard or OpenVPN server from Linux requires understanding both client and server side. This guide covers the client side; our WireGuard vs OpenVPN analysis covers server aspects and protocol details.

Privacy-conscious Linux desktop user. The GNOME or KDE user who wants to encrypt their connection at a café, access geo-restricted content, or protect their browsing. Mullvad GUI and ProtonVPN GUI on Wayland/GTK4 make this as simple as on Windows.

Criteria for Choosing a Linux-Compatible VPN

Not all VPNs are equal on Linux. Here's what actually matters:

Official signed package (.deb / .rpm). A VPN that only distributes a bare binary without a managed package creates manual maintenance - no automatic updates, no GPG verification. NordVPN, Mullvad, ProtonVPN, and ExpressVPN all publish official signed packages referenced in their own apt/dnf repositories.

Ergonomic CLI. On Linux, you often work in the terminal. An intuitive CLI (nordvpn connect, mullvad connect, protonvpn-cli connect) saves time. ExpressVPN CLI is functional but syntactically less consistent.

Native Linux kill switch. The kill switch must cut all traffic if the tunnel drops. On Linux, it goes through iptables or nftables. NordVPN and Mullvad handle this cleanly; ProtonVPN implements it via NM or iptables. For manual WireGuard, you write it yourself (see Troubleshooting section).

NetworkManager support. Useful for GNOME/KDE environments that manage network connections via NM. ProtonVPN is the only major provider offering complete NM integration with an official plugin. NordVPN and Mullvad use their own daemon.

systemd autostart. The VPN service must start at boot without intervention. NordVPN, Mullvad, and ProtonVPN all have a systemd service that enables with systemctl enable.

Multi-distro packages. Debian/Ubuntu (.deb), Fedora/RHEL (.rpm), Arch (AUR), AppImage for others. Mullvad is most complete here, additionally offering a universal AppImage.

Top 4 VPN Linux 2026 - 6-Criteria Comparison

NordVPN on Linux - The official app has existed since 2018 but genuinely matured in 2023-2024. The nordvpn CLI is the most intuitive: nordvpn connect, nordvpn set killswitch on, nordvpn set autoconnect on. The nordvpnd daemon's RAM footprint at rest is modest (a few tens of MB). Default protocol is NordLynx (custom WireGuard with double NAT for privacy), which retains a high share of raw throughput on a nearby server and adds only a few ms of latency over a short hop. Only downside: Electron GUI, not native Wayland.

Mullvad on Linux - The provider that has pushed Linux client quality furthest. Signed .deb and .rpm packages, plus a universal AppImage for Arch and exotic distros. Native Wayland GTK4 GUI, clear mullvad CLI. Documented and open-sourced nftables kill switch. One peculiarity: Mullvad account without email (just a number), payable in cash or Monero. It uses WireGuard, so throughput stays high on modern kernels (5.15+) and the daemon's RAM footprint is modest.

ProtonVPN on Linux - The only one with official NetworkManager integration via the network-manager-openvpn plugin (or WireGuard NM) - useful if you prefer managing connections from GNOME Settings without touching the terminal. protonvpn-cli available. Switzerland-based, open-source, audited. The daemon's RAM footprint is modest, higher when the GUI is open.

ExpressVPN on Linux - CLI-only client on Linux, no GUI. Simplified configuration but less granular control. No NM support. Throughput is decent over its Lightway/WireGuard protocols, but the higher price and lack of GUI make it less competitive versus NordVPN and Mullvad for desktop Linux use.

Step-by-Step Setup - Ubuntu 24.04 LTS (Noble)

NordVPN on Ubuntu 24.04

# 1. Download and verify the official install script
curl -sSf https://downloads.nordcdn.com/apps/linux/install.sh -o nordvpn-install.sh
sha256sum nordvpn-install.sh  # verify hash at nordvpn.com/download/linux/

# 2. Install
sudo sh nordvpn-install.sh

# 3. Add your user to the nordvpn group (required since v3.12)
sudo usermod -aG nordvpn $USER
newgrp nordvpn  # or log out and back in

# 4. Login (opens a link in the browser)
nordvpn login

# 5. Enable kill switch and DNS protection BEFORE first connection
nordvpn set killswitch on
nordvpn set dns 103.86.96.100 103.86.99.100  # NordVPN DNS
nordvpn set autoconnect on

# 6. Connect to the fastest server
nordvpn connect

# 7. Check status
nordvpn status
# → Status: Connected | Server: France #589 | IP: 185.234.x.x | Protocol: NordLynx

systemd autostart (Ubuntu 24.04 activates nordvpnd automatically via the package):

systemctl status nordvpnd  # should be active (running)
sudo systemctl enable nordvpnd  # if not already enabled

DNS verification after connection:

resolvectl status
# Verify that the tun0 or nordlynx interface points to NordVPN DNS servers
# If systemd-resolved interferes: see Troubleshooting section

Mullvad on Ubuntu 24.04

# 1. Add the Mullvad repository
sudo curl -fsSLo /usr/share/keyrings/mullvad-keyring.asc \
  https://repository.mullvad.net/deb/mullvad-keyring.asc
echo "deb [signed-by=/usr/share/keyrings/mullvad-keyring.asc arch=$(dpkg --print-architecture)] \
  https://repository.mullvad.net/deb/stable $(lsb_release -cs) main" | \
  sudo tee /etc/apt/sources.list.d/mullvad.list

# 2. Install
sudo apt update && sudo apt install mullvad-vpn

# 3. Connect (via GUI or CLI)
mullvad account login <your-account-number>
mullvad connect

# 4. Kill switch and autoconnect
mullvad lockdown-mode set on    # strict kill switch (blocks if VPN not connected)
mullvad auto-connect set on

# 5. Verify
mullvad status
# → Connected to se-got-wg-001 in Gothenburg, Sweden

Step-by-Step Setup - Fedora 41

dnf vs apt variation

On Fedora 41, dnf replaces apt. Official NordVPN and Mullvad .rpm packages install directly:

# NordVPN on Fedora 41
curl -sSf https://downloads.nordcdn.com/apps/linux/install.sh | sudo sh
# The script detects Fedora and uses dnf automatically

# Mullvad on Fedora 41
sudo dnf install https://mullvad.net/download/app/rpm/latest

SELinux Considerations on Fedora 41

Fedora 41 runs SELinux in enforcing mode by default. Two common situations:

NordVPN on Fedora with SELinux:

# If nordvpnd fails to start (AVC deny in journalctl)
sudo ausearch -m avc -ts recent | grep nordvpn
sudo restorecon -v /usr/sbin/nordvpn /usr/bin/nordvpn

# Verify the service starts correctly
sudo systemctl restart nordvpnd
systemctl status nordvpnd

Mullvad on Fedora 41: The .rpm includes an SELinux module since version 2024.1 - no manual intervention needed. This is one of Mullvad's advantages on Fedora.

ProtonVPN on Fedora: If using NetworkManager integration, install the WireGuard NM plugin:

sudo dnf install NetworkManager-wireguard
# Then import the ProtonVPN config via GNOME Settings > VPN

Firewalld vs iptables: Fedora uses firewalld by default. NordVPN and Mullvad manage iptables directly - conflicts can appear. Recommended solution:

# Check conflicts
sudo firewall-cmd --list-all
# If NordVPN blocks: switch firewalld to direct mode or use nftables
sudo systemctl stop firewalld  # temporary, for testing
nordvpn connect

Manual WireGuard for Advanced Users

For a VPS server, a NAS config, or anyone who wants full control without a third-party daemon:

Installation

# Ubuntu/Debian
sudo apt install wireguard wireguard-tools

# Fedora/RHEL
sudo dnf install wireguard-tools

# Verify kernel module
sudo modprobe wireguard && echo "WireGuard OK"

Key Generation

cd /etc/wireguard
umask 077  # restrictive permissions MANDATORY
wg genkey | sudo tee privatekey | wg pubkey | sudo tee publickey

Configuration file wg0.conf

[Interface]
PrivateKey = <your-private-key>
Address = 10.0.0.2/24
DNS = 103.86.96.100  # NordVPN DNS, or 10.64.0.1 for Mullvad
PostUp = resolvectl dns %i 103.86.96.100; resolvectl domain %i '~.'
PreDown = resolvectl revert %i

[Peer]
PublicKey = <vpn-server-public-key>
AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = <server-ip>:51820
PersistentKeepalive = 25

Start and autostart

# Start the tunnel
sudo wg-quick up wg0

# Verify connection
sudo wg show
curl ifconfig.me  # should return the VPN server IP

# Autostart on boot
sudo systemctl enable wg-quick@wg0
sudo systemctl start wg-quick@wg0

Routing and firewall (ufw/firewalld)

# ufw (Ubuntu/Debian) - allow WireGuard
sudo ufw allow 51820/udp
sudo ufw reload

# firewalld (Fedora) - add WireGuard to trusted zone
sudo firewall-cmd --add-interface=wg0 --zone=trusted --permanent
sudo firewall-cmd --reload

Troubleshooting - Common Problems

DNS Leak via systemd-resolved

Symptom: curl ifconfig.me returns the VPN IP but nslookup google.com uses your ISP's DNS.

Diagnosis:

resolvectl status | grep -A5 "DNS Servers"
# If the main interface (eth0/ens3) keeps ISP DNS, there's a leak

Fix:

# Force VPN DNS on the tunnel interface
sudo resolvectl dns tun0 103.86.96.100  # replace tun0 with your VPN interface
sudo resolvectl domain tun0 '~.'        # route all DNS via tun0

# Verification test
nslookup google.com
# Must respond via NordVPN DNS, not ISP DNS

Kill Switch via nftables (Manual WireGuard)

nftables rules to block all traffic when wg0 is down:

sudo nft add table inet vpn_killswitch
sudo nft add chain inet vpn_killswitch output "{ type filter hook output priority 0; policy drop; }"
sudo nft add rule inet vpn_killswitch output oifname "lo" accept
sudo nft add rule inet vpn_killswitch output oifname "wg0" accept
sudo nft add rule inet vpn_killswitch output ip daddr <server-ip> accept  # outgoing WG traffic

# Save for reboot persistence
sudo nft list ruleset > /etc/nftables.conf
sudo systemctl enable nftables

NetworkManager Conflicts

Symptom: NM reconfigures DNS after NordVPN/Mullvad has set them.

Fix:

# Disable DNS management by NM (if you're not using NM integration)
sudo nano /etc/NetworkManager/NetworkManager.conf
# Add under [main]:
# dns=none

sudo systemctl restart NetworkManager

Boot Autostart Not Working

# Check the service
sudo systemctl status nordvpnd  # or mullvad-daemon

# Enable explicitly
sudo systemctl enable nordvpnd
sudo systemctl enable --now nordvpnd  # enable + start immediately

# For NordVPN: enable autoconnect IN the app
nordvpn set autoconnect on

Going further. Related reading: Best VPN for Mac M3 M4 2026.

For advanced protocol configurations (choosing WireGuard vs OpenVPN based on your network), see our technical WireGuard vs OpenVPN analysis 2026. Comparing NordVPN vs Surfshark for your Linux use case? Our Surfshark vs NordVPN comparison covers Linux apps too. For journalists and activists using Linux, the VPN journalist activist guide 2026 covers the specific threat model. And if you're evaluating Mullvad specifically, our Mullvad vs IVPN comparison goes deep on the privacy-first VPN segment.