VPN on Debian: App and CLI Options

Debian has a reputation for being steady and plain. It ships with few surprises, runs for years on servers, and appears on desktops, home labs, old laptops and virtual machines. That plainness is exactly why VPN advice written for other systems sometimes fails on it: a command that works on Ubuntu may not exist, may need a package you have not installed, or may depend on a service Debian does not start by default.

This article is about the choices you have when you want a VPN on Debian, and how to pick among them. It describes three routes: a desktop app, the NetworkManager network menu, and plain command-line tools. It then deals with the issues that are specific to Debian, mainly DNS and a basic kill switch. For background on the protocols behind these tools, read OpenVPN explained, and for a general walkthrough see the Linux help guide. XPASS customers use the free VPNclient app, and your My Pass page shows what applies to your account.

What is different about Debian

Three differences matter before you touch any VPN software.

The release you run. Debian publishes a stable release every couple of years and keeps the previous one supported for a while. Package versions in stable are conservative. That is good for reliability, but it means that a very new feature mentioned in a blog post may not exist on your machine. Find your version first:

cat /etc/os-release

Administrator access. A minimal Debian install may not include sudo, because the installer lets you leave the root account enabled and skip creating a sudo user. If sudo is missing, either use su - to become root for the commands in this article, or install sudo as root and add your user to the sudo group. Do not run a graphical app as root as a shortcut.

DNS and networking. Ubuntu desktop uses systemd-resolved by default. A Debian desktop usually uses NetworkManager, which writes /etc/resolv.conf itself. A Debian server may use ifupdown or systemd-networkd. Any VPN tool that "sets DNS" has to cooperate with whichever is present, which is why DNS is the main trouble spot.

Route one: a desktop app

If you want the simplest experience, use an app with a graphical window. With XPASS, that means the free VPNclient app for Linux, whose official download link is on the download page. The general flow looks like this.

1. Download the Linux file from the official link only, not from a mirror or a forum post.
2. Follow the install instructions that come with the download and the setup notes on your My Pass page. The app is distributed as a self-contained installer for Linux, so check that it supports your Debian release before you rely on it.
3. Sign in with the VPN username and password from My Pass. These are not your website sign-in details.
4. Allow any system prompt the app asks for, because creating a network interface needs permission.
5. Open the location list, choose one and tap the connect button. Menu labels vary by version, so describe what you see rather than hunting for exact words.

Strengths of this route: fastest to start, no config files, nothing to maintain by hand. Limits: you rely on the app's own features, such as any built-in kill switch or split option, and you cannot script the connection in the way you can with command-line tools. Keep the app's default settings unless support suggests changing them.

Route two: NetworkManager and a plug-in

If you run GNOME, KDE, Xfce or another desktop on Debian, NetworkManager is probably already managing your Wi-Fi. It can also manage VPN connections through plug-ins.

sudo apt install network-manager-openvpn-gnome

For WireGuard, recent NetworkManager versions can import a .conf file directly with nmcli connection import type wireguard file. After import, the VPN appears in the network menu and can be toggled from the panel.

Why this route suits laptops: it handles moving between Wi-Fi networks gracefully, stores the password in the desktop keyring, and sets DNS through the same component that manages your connections, so there is no conflict. Why it may not suit you: it hides log detail, and the plug-in may not understand every option in a complex profile. If an import fails, go to route three and read the real error.

Route three: command-line tools

For servers, headless mini-PCs, and anyone who likes precise control, the command line is the most predictable.

sudo apt install wireguard-tools openvpn

You can then run either tool by hand or let systemd manage it. WireGuard uses wg-quick up name and the unit wg-quick@name. OpenVPN uses openvpn --config file.ovpn and the unit openvpn-client@name with the profile saved as /etc/openvpn/client/name.conf. Both need a configuration supplied by your provider or your own server. For background on which to prefer, see WireGuard vs OpenVPN; the WireGuard project site and the OpenVPN community resources hold the official documentation.

Command-line tools give you the whole log, scriptable control, and clean autostart. They cost you manual DNS handling and a bit more care with credentials and file permissions.

Which route should you choose?

Your situation	Best route	Why
Debian laptop, Wi-Fi, moving around	App or NetworkManager	Handles roaming, easy toggle
Debian desktop at home on cable	Any	Choose by taste; the app is quickest
Headless server or home lab box	Command line	No desktop, scriptable, systemd autostart
Virtual machine for testing	Command line	Reproducible, easy to snapshot
You need split rules for certain apps	App with split feature, or routing config	See the split tunneling article
Shared computer with several users	App or NetworkManager per user	Keeps credentials out of shared files

If you are unsure, start with the app or the NetworkManager plug-in. You can always move to the command line later, and the experience will tell you what you actually need.

DNS on Debian: where tunnels most often break

When a VPN connects but no site loads, DNS is the first suspect. On Debian, check the following in order.

1. See what the system uses. Run cat /etc/resolv.conf. On a NetworkManager desktop it lists the servers NetworkManager currently believes in. If it names only your router, the VPN's DNS has not been applied.
2. Match the tool to the setup. wg-quick expects resolvconf. If you do not have it and need it, install resolvconf or openresolv and try again. OpenVPN needs an update script to apply pushed DNS servers unless NetworkManager does it for you.
3. Test by raw address. Ping a known numeric address. If that works but names fail, it is DNS. If it fails too, it is routing or the tunnel.
4. Avoid two managers. If both NetworkManager and a manual script write to /etc/resolv.conf, they overwrite each other. Choose one owner.
5. Check for leaks. Once names resolve, confirm that queries really follow the tunnel; the article on what a DNS leak is shows how, and split DNS explains why some setups intentionally send certain names elsewhere.

A basic kill switch with nftables

Debian uses nftables as its default firewall framework. A kill switch is a rule that stops normal traffic when the tunnel is down, so nothing leaves through the open internet by accident. Read what a kill switch is first. Here is a minimal sketch for a command-line OpenVPN setup; adjust the interface names and the server address to match yours.

sudo nft add table inet vpnguard
sudo nft add chain inet vpnguard out '{ type filter hook output priority 0 ; policy drop ; }'
sudo nft add rule inet vpnguard out oifname "lo" accept
sudo nft add rule inet vpnguard out oifname "tun0" accept
sudo nft add rule inet vpnguard out ip daddr 203.0.113.10 udp dport 1194 accept
sudo nft add rule inet vpnguard out udp dport 67 accept

What this does: it drops every outgoing packet unless it goes through the loopback interface, through the tunnel, to the VPN server itself so the tunnel can reconnect, or is a DHCP request. To remove it:

sudo nft delete table inet vpnguard

Three cautions. First, test on a machine where you have local access, because a wrong rule can lock you out of a remote server. Second, this blocks local network printers and shares too; add rules for your home range if you need them. Third, rules like this vanish at reboot unless you save them in your nftables configuration, and the app route may already have its own kill switch, in which case you do not need this.

Troubleshooting on Debian

Symptom	Likely cause	What to try
sudo: command not found	Minimal install without sudo	Use su - or install sudo as root
wg-quick: resolvconf: command not found	No DNS helper installed	Install resolvconf or openresolv
Connects, names fail	DNS not applied	Check /etc/resolv.conf, see the DNS section
Tunnel starts at boot, then fails	Network not ready yet	Delay the unit or use NetworkManager
Plug-in missing from the menu	Package not installed or session not restarted	Install the plug-in, log out and in
Handshake or TLS errors	Wrong endpoint, clock off, or blocked port	Check the time, try another network
Slow after connecting	Distance, congestion or wrong MTU	See why a VPN is slow

If a symptom does not appear here, the log is your best friend. For services, sudo journalctl -u unit-name -e shows the latest lines. Copy exact messages when you ask for help, and never include passwords or private keys.

Habits and limits

• Download from official sources only. On a system you trust with your traffic, installers and profiles deserve the same care as passwords.
• Keep Debian updated. Security updates matter for the network stack and for the VPN tools.
• A VPN is not a firewall or antivirus. It protects the path between you and the VPN server, as covered in what a VPN cannot protect you from.
• Do not run more than one VPN at a time. They compete for routes and DNS.
• Document your setup. A three-line note about which route you chose and where the config lives saves hours six months later.

Summary

On Debian you can run a VPN three ways: a desktop app for simplicity, NetworkManager with a plug-in for laptops, or command-line tools for servers and control. Debian's minimal defaults mean sudo may be missing, DNS may not be handled by systemd-resolved, and nftables is the firewall you would use for a kill switch. Choose a route that fits how you use the machine, fix DNS deliberately, and test everything before relying on it.

When you are ready to try a simple app-based setup, the pricing page shows the prepaid options that work with the free VPNclient app.