How to install the new beta Proton VPN app for Linux

Reading: 7 mins
Category: Proton VPN apps

Proton VPN offers both a Linux app with a graphical user interface(new window) and a Linux CLI. In this article, we explain how to install and use the early-access version of our Linux CLI.

The early-access version of the Proton VPN Linux CLI is available for many Linux Debian-based distros and Fedora 31+ (but not Archlinux/Manjaro).

The early-access version of Proton VPN’s Linux CLI gives you access to new features before they are released publicly, but it is still in development. By using the early-access version and sharing your feedback, you are helping us find and address bugs. However, if you are new to Linux or concerned about your threat model or, we recommend you download the stable version of our Proton VPN Linux CLI.

How to install the official Proton VPN Linux CLI(new window)

To use the early-access Linux CLI, you must first uninstall the official Proton Linux CLI and/or the official Linux app if they are installed. Similarly, if you wish to switch from the early-access to the stable versions of our apps, you must first uninstall the early-access CLI. You can find instructions on how to uninstall the early-access CLI at the bottom of this page, and instructions on how to uninstall the stable versions of our Linux CLI and Linux apps in the notes section of this guide.

How to install the early-access version of Linux CLI

Debian-based distros

Our command line tool officially supports the following Debian and Ubuntu-based distributions:

Debian 10
Ubuntu 18.04 (LTS)
Mint 19.3+
MX Linux 19
Kali Linux

It also works with many distros based on these Linux versions (not Ubuntu Server or Raspbian), but we cannot provide support for these at this time.

If you are using an older version of our Linux client, we recommend that you uninstall it before installing the new CLI. Please see Note 1 at the end of this article for instructions.

1. Get the early-access version of the Proton VPN repo setup DEB package

Download the Proton VPN DEB package(new window)

2. Install the Proton VPN repository

Open a terminal and run the following:

sudo apt-get install {/path/to/}protonvpn-beta-release_1.0.3_all.deb

Please don’t try to check the GPG signature of this release package (dpkg-sig –verify). Our internal release process is split into several part and the release package is signed with a GPG key, and the repo is signed with another GPG key. So the keys don’t match.

If you want to check the repo package integrity, you can check its checksum with the following command:

echo "caba770e3544a4f33b7d5718dedd8bc1d06cfcd2b2f8c4f33b5a42d15a78e74a  protonvpn-beta-release_1.0.3_all.deb" | sha256sum --check -

3. Update the apt-get package list

Enter the command:

sudo apt-get update

4. Install the Proton VPN Linux CLI

Last step! Type this command:

sudo apt-get install protonvpn-cli

Fedora 31+

Please note that our CLI does not work in earlier versions of Fedora. To upgrade your system, run:

dnf upgrade

1. Get the early-access version of the Proton VPN repo setup RPM package

Download the Proton VPN RPM package

2. Install the Proton VPN repository

Open the terminal and run the following:

sudo dnf install {/path/to/}protonvpn-beta-release-1.0.0-1.noarch.rpm

3. Update the dnf package list

Enter the command:

sudo dnf update

4. Install the Proton VPN Linux CLI

Last step! Type this command:

sudo dnf install protonvpn-cli

5. Install required dependencies for the alternative routing(new window) feature

Enter:


sudo dnf install python3-pip

Then:

pip3 install --user dnspython>=1.16.0

How to use the early-access version of Linux CLI

1. Log in using your regular Proton/Proton VPN account details using the following command (please note that these are not the OpenVPN/IKEv2 login credentials used by the older community Linux client).

 protonvpn-cli login [Proton VPN username]

You will be prompted to enter your password. If you don’t have a Proton VPN account you can sign up for one here(new window).

The CLI will remember your login details between sessions.

2. Open a list of Proton VPN servers with:

protonvpn-cli connect (or protonvpn-cli c)

3. Select a server location and click OK. Select a server at that server location and click OK.

4. Select udp or tcp(new window) (we recommend udp unless you have a reason to choose tcp).

A connection to the VPN server will now be established. To check your connection status, enter:

protonvpn-cli status (or protonvpn-cli s)

To disconnect, enter:

protonvpn-cli disconnect (or protonvpn-cli d)

Alternatively, you can disconnect using NetworkManager.

How to use the kill switch

The Proton VPN official Linux CLI includes a kill switch(new window). The basic kill switch will block all your internet connections when the VPN is running and the connection to one of our servers fails. To enable it, enter:

protonvpn-cli ks --on

The CLI also features a permanent kill switch(new window). This prevents all internet connections unless the VPN is running and connected to one of our servers. To enable it, enter:

protonvpn-cli ks --permanent

You can disable the Kill Switch by entering:

protonvpn-cli ks --off

How to use NetShield Ad-blocker

NetShield Ad-blocker(new window) is a DNS filtering feature. You can choose between three levels of NetShield protection:

Off
Block malware only (default)
Block malware, ads, & trackers (only available if you have a paid Proton VPN plan)

To turn NetShield off, use the command

protonvpn-cli netshield --off

protonvpn-cli ns --off

To block malware only:

protonvpn-cli netshield --malware

protonvpn-cli ns --malware

To block malware, ads, and trackers, use the command

protonvpn-cli netshield --ads-malware

protonvpn-cli ns --ads-malware

How to connect using the command line

To see the full list of connection options, enter:

protonvpn-cli c --help

To connect to the fastest Proton VPN server for your location, for example, enter:

protonvpn-cli c -f

Or to connect to the fastest Tor server (Plus and Visionary users only), enter:

protonvpn-cli c --tor

Additional connection options, including specifying a custom DNS server, can be found by entering:

protonvpn-cli config --help

Entering protonvpn-cli h (or protonvpn-cli –help) will always show the latest commands supported by the command line tool.

How to uninstall the early-access version of Linux CLI

If you wish to uninstall the Proton VPN early-access Linux CLI, open Terminal and disable the kill switch (if it is running). To do this, enter:

protonvpn-cli ks --off

Then:

Debian distros

1. Uninstall the CLI with:

sudo apt-get autoremove protonvpn

2. Remove the early-access repo and keys:

sudo apt purge protonvpn-beta-release

3. Remove any leftover files:

rm -rf ~/.cache/protonvpn

And

rm -rf ~/.config/protonvpn

Fedora 31+

1. Remove the early-access repo and keys:

sudo dnf remove protonvpn-beta-release

2. Then run:

sudo dnf remove protonvpn -y; sudo dnf autoremove -y; sudo dnf clean packages

3. Check if all Proton VPN packages are uninstalled:

yum list installed | grep proton

dns list installed | grep proton

4. Check if any Proton VPN folders remain on your system:

ls -ld /usr/lib/python3.*/site-packages/proton*

If any folders are found then remove them using:

sudo rm -rf /usr/lib/python3.*/site-packages/proton*

5. Check again that all folders are removed (see Step 4 above).

Notes

1. Uninstall the official Proton VPN CLI or Proton VPN app

The instructions to uninstall the official Linux CLI or official Linux app are identical to the instructions for uninstalling the early-access CLI (see above), except that to remove the stable repo and keys, use the following command instead (DEB):

sudo apt purge protonvpn-stable-release

Or (RPM):

sudo dnf remove protonvpn-stable-release

2. Uninstall the older community Proton VPN app

To uninstall the older community Proton VPN app, run:

protonvpn configure

Select option 7) Purge Configuration. Then uninstall through the package manager you used for installation. For Debian, if the package is installed system-wide then use the command:

sudo pip3 uninstall protonvpn-cli

If not, then use:

pip3 uninstall protonvpn-cli

3. Disable the kill switch if you have uninstalled the app

The kill switch can be easily disabled from within the official Linux CLI app, but this will not be possible if you have uninstalled the CLI app first without disabling the kill switch. This may result in your system being unable to access the internet. To remove the kill switch after the CLI app has been uninstalled:

a) Identify Proton VPN connection names by running the command:

nmcli connection show --active

This will display a list of all your system’s active connections.

b) Look for any connections with the pvpn- prefix. This usually includes pvpn-killswitch and pvpn-ipv6leak-protection, and may include pvpn-routed-killswitch. Delete all these connections using the following command:

nmcli connection delete [connection name]

For example:

nmcli connection delete pvpn-killswitch

c) Re-run the following command to verify that Proton VPN connections have been deleted:

nmcli connection show --active

If any Proton VPN connections remain, delete them as described above.

4. Required dependencies

Our Linux CLI needs one of the following dependencies installed in order to work. Installing both of these dependencies is not recommended as it may cause problems:

KWallet or
Gnome-keyring

Note that most distros come pre-installed with one of these dependencies, so usually no additional configuration is required. Also required is:

systems

5. Supported distros

The Proton VPN Linux CLI is currently officially supported on the following distros:

Debian 10
Ubuntu 18.04 +
Mint 19.3+
MX Linux 19+
Kali Linux
Fedora 31+

We are working on adding official support for more distros, but we cannot offer support for unsupported distros and versions. The Debian client should work on many Debian-based distros, and we invite users to test-run our software on their systems. But we cannot provide support if things don’t work on these unsupported systems.