About

The NordVPN Linux application provides a simple and user-friendly command line interface for accessing all the different features of NordVPN. Users can choose from a list of server locations around the world, or let the application automatically select the best server for them. They can also customize their connection settings, such as choosing a specific protocol or enabling the kill switch feature.

The application manages:

• network interfaces using WireGuard (NordLynx) and tun (OpenVPN),
• firewall with the help of nftables,
• routing via the netlink kernel interface and
• DNS using systemd-resolved, resolvconf, or NetworkManager depending on what is available on the system.

---

Versioning

The project follows semver. Version tags and release branches must be named accordingly.

Contributing

We are happy to accept contributions for the project. Please check out CONTRIBUTE.md for more details on how to do so.

Building

You can find everything related to building, testing and environment setup in BUILD.md.

Troubleshooting

Collecting diagnostics

If you run into an issue, you can collect diagnostic logs and system information to share with NordVPN support:

nordvpn diagnostics

This gathers daemon and CLI logs, network and DNS configuration, firewall rules, and system information into a zip file. The file may contain sensitive information about your system and configuration, so share it only with our support team through a secure channel.

Log level

The log verbosity of the NordVPN daemons can be changed at runtime without restarting by writing to:

• /run/nordvpn/loglevel for DEB and RPM
• /var/snap/nordvpn/common/run/nordvpn/loglevel for SNAP

Example:

echo "debug" | sudo tee /run/nordvpn/loglevel

Valid values are debug, info, warn, error, fatal and off.

libtelio log level

The verbosity of libtelio can be changed by writing to:

• /run/nordvpn/teliologlevel for DEB and RPM
• /var/snap/nordvpn/common/run/nordvpn/teliologlevel for SNAP

Example:

echo "debug" | sudo tee /run/nordvpn/teliologlevel

Valid values are debug, info, warn, error and trace.

libtelio log level is capped by the global log level. E.g. lib level logs will be printed only if global level logs are equal or higher. Global debug log level matches both debug and trace for the lib log level.

Unlike the global log level, the changes require a daemon restart to take effect.

Meshnet peer routing not working on Fedora with Docker installed

When Docker is installed on Fedora, it drops all forwarded traffic that does not come from Docker. As a result, Meshnet routing through a Fedora machine will not work.

To fix this, create /etc/docker/daemon.json with the following content:

{
  "ip-forward-no-drop": true
}

Then reboot the system, for example:

sudo reboot

Installing

For installing an already released version please follow the instructions on our official page.

Supported distros

https://nordvpn.com/download/linux/

Distributions are not supported after their end of life.

OpenVPN data channel offload (DCO)

The bundled OpenVPN can encrypt tunnel traffic in the kernel instead of userspace using Data Channel Offload. It is attempted automatically and falls back to the userspace tunnel when not available.

The bundled OpenVPN is 2.6, which needs the out-of-tree ovpn-dco-v2 module.

• Debian, Ubuntu: sudo apt install openvpn-dco-dkms
• RHEL, Rocky, AlmaLinux 8/9: sudo dnf install kmod-ovpn-dco
• openSUSE Leap: sudo zypper install ovpn-dco-kmp-<flavor> (-default for the default kernel)
• Fedora and others: build from OpenVPN/ovpn-dco

With Secure Boot enabled the module won't load until you enroll its signing key.

Then just connect:

nordvpn connect

To confirm it's active, check the interface kind while connected (ovpn-dco when offloaded, tun when not):

ip -d link show nordtun

DCO is skipped if the module isn't installed, or obfuscation is on. The in-tree ovpn driver (Linux 6.16+) requires OpenVPN 2.7 and is not used yet, so it won't be picked up instead.

To go back to the userspace tunnel, remove the module package.

---

This project is licensed under the terms of the GNU General Public License v3.0 only. The registered trademark Linux® is used pursuant to a sublicense from the Linux Foundation, the exclusive licensee of Linus Torvalds, owner of the mark on a world-wide basis.