The NordVPN Linux application provides a simple and user-friendly command line interface for accessing all the different features of NordVPN. Users can choose from a list of server locations around the world, or let the application automatically select the best server for them. They can also customize their connection settings, such as choosing a specific protocol or enabling the kill switch feature.
The application manages:
- network interfaces using WireGuard (NordLynx) and tun (OpenVPN),
- firewall with the help of nftables,
- routing via the netlink kernel interface and
- DNS using systemd-resolved, resolvconf, or NetworkManager depending on what is available on the system.
The project follows semver. Version tags and release branches must be named accordingly.
We are happy to accept contributions for the project. Please check out CONTRIBUTE.md for more details on how to do so.
You can find everything related to building, testing and environment setup in BUILD.md.
If you run into an issue, you can collect diagnostic logs and system information to share with NordVPN support:
nordvpn diagnosticsThis gathers daemon and CLI logs, network and DNS configuration, firewall rules, and system information into a zip file. The file may contain sensitive information about your system and configuration, so share it only with our support team through a secure channel.
The log verbosity of the NordVPN daemons can be changed at runtime without restarting by writing to:
/run/nordvpn/loglevelfor DEB and RPM/var/snap/nordvpn/common/run/nordvpn/loglevelfor SNAP
Example:
echo "debug" | sudo tee /run/nordvpn/loglevelValid values are debug, info, warn, error, fatal and off.
The verbosity of libtelio can be changed by writing to:
/run/nordvpn/teliologlevelfor DEB and RPM/var/snap/nordvpn/common/run/nordvpn/teliologlevelfor SNAP
Example:
echo "debug" | sudo tee /run/nordvpn/teliologlevelValid values are debug, info, warn, error and trace.
libtelio log level is capped by the global log level. E.g. lib level logs will be printed only if global level
logs are equal or higher. Global debug log level matches both debug and trace for the lib log level.
Unlike the global log level, the changes require a daemon restart to take effect.
When Docker is installed on Fedora, it drops all forwarded traffic that does not come from Docker. As a result, Meshnet routing through a Fedora machine will not work.
To fix this, create /etc/docker/daemon.json with the following content:
{
"ip-forward-no-drop": true
}Then reboot the system, for example:
sudo rebootFor installing an already released version please follow the instructions on our official page.
https://nordvpn.com/download/linux/
Distributions are not supported after their end of life.
The bundled OpenVPN can encrypt tunnel traffic in the kernel instead of userspace using Data Channel Offload. It is attempted automatically and falls back to the userspace tunnel when not available.
The bundled OpenVPN is 2.6, which needs the out-of-tree ovpn-dco-v2
module.
- Debian, Ubuntu:
sudo apt install openvpn-dco-dkms - RHEL, Rocky, AlmaLinux 8/9:
sudo dnf install kmod-ovpn-dco - openSUSE Leap:
sudo zypper install ovpn-dco-kmp-<flavor>(-defaultfor the default kernel) - Fedora and others: build from OpenVPN/ovpn-dco
With Secure Boot enabled the module won't load until you enroll its signing key.
Then just connect:
nordvpn connectTo confirm it's active, check the interface kind while connected
(ovpn-dco when offloaded, tun when not):
ip -d link show nordtunDCO is skipped if the module isn't installed, or obfuscation is on. The
in-tree ovpn driver (Linux 6.16+) requires OpenVPN 2.7 and is not used
yet, so it won't be picked up instead.
To go back to the userspace tunnel, remove the module package.
This project is licensed under the terms of the GNU General Public License v3.0 only. The registered trademark Linux® is used pursuant to a sublicense from the Linux Foundation, the exclusive licensee of Linus Torvalds, owner of the mark on a world-wide basis.