# Proton VPN Proton VPN is [[Proton]]'s [[Virtual Private Network (VPN)|VPN]] service: Swiss, no-logs (independently audited, and tested in court), open-source clients on every platform, and the only major VPN with a free tier that has no data cap, no ads, and no speed throttling beyond server choice. It runs on [[WireGuard]] by default, with OpenVPN for legacy devices and Proton's own Stealth protocol for networks that block VPNs. ## Features worth knowing - **Kill switch**, plus a **permanent kill switch** that blocks all traffic whenever the VPN is off, not only when the tunnel drops - **NetShield**: DNS-level blocking of malware, ads, and trackers, with two levels - **Secure Core**: route through a hardened server in Switzerland, Iceland, or Sweden before the exit server, so the exit node never sees your real IP - **Split tunneling**: include or exclude specific apps or IPs from the tunnel - **Port forwarding** (NAT-PMP) for torrenting and self-hosted services - **Stealth** protocol (WireGuard over TLS) to look like normal HTTPS on hostile networks, and **Smart Protocol** that picks whichever one gets through - **VPN Accelerator**: their throughput optimisation, on by default - **Moderate NAT** for gaming and peer-to-peer - **Custom DNS**, **IPv6** support, Tor-over-VPN servers, and a Chrome/Firefox extension that tunnels only the browser - 10 devices per account on paid plans; servers in 110+ countries ## Linux This is the part I actually use. Proton maintains a native GTK app and a CLI, and Arch is one of the officially supported distros alongside Debian, Ubuntu, and Fedora (GNOME variants). A Snap and a Flatpak exist; the Snap lacks Proton's protocols, Stealth, split tunneling, and ARM support, so prefer native packages. ### Install on Omarchy / Arch Both packages live in the `extra` repository (community-maintained; Proton says official Arch support is in progress). No AUR needed: ```bash sudo pacman -S proton-vpn-gtk-app proton-vpn-cli ``` Dependencies to have in place: - `gnome-keyring` (the app stores the session in the keyring; KWallet may work but isn't supported) - `NetworkManager` (the app manages the tunnel as an NM connection) - `systemd-resolved`, only if you want split tunneling in the GUI - `proton-vpn-daemon` is pulled in for the split-tunneling service On [[Omarchy]] the first two are already there. After a version bump, if the app refuses to connect, the usual fix is to delete the stale `ProtonVPN` connection in NetworkManager and reconnect. ### The CLI ```bash protonvpn signin <username> # once; password + 2FA prompted protonvpn connect # fastest server protonvpn connect --country CH # or "Switzerland"; case-insensitive protonvpn connect --city Zurich protonvpn connect CH#242 # a specific server protonvpn disconnect protonvpn signout protonvpn config list # every option protonvpn config set kill-switch on protonvpn config set netshield <level> protonvpn config set port-forwarding on protonvpn config set ipv6 on protonvpn config set moderate-nat on protonvpn config set vpn-accelerator on protonvpn config set custom-dns <ip> protonvpn config set anonymous-crash-reports off ``` Secure Core, Tor, and P2P selection aren't exposed in the CLI as of v1.0; use the GUI for those, or pick a server by name. There's also an older `protonvpn-cli-community` package in the AUR; ignore it, it's the pre-2023 community client. ### Manual WireGuard For a headless box, a router, or a machine where you don't want the app at all: generate a WireGuard config in the Proton account dashboard (Downloads → WireGuard configuration), pick the server and the features (NetShield, Moderate NAT, port forwarding are baked into the config as options), then `wg-quick up` it like any other tunnel. See [[WireGuard]]. That's how I'd put it on a [[Network Attached Storage (NAS)|NAS]]. ## When it's the wrong tool A commercial VPN hides your traffic from the local network and your IP from the destination. It does nothing for device-to-device access. For reaching my own machines I use [[Tailscale]], and the two coexist fine: Tailscale for the mesh, Proton for the exit. ## References - Website: https://protonvpn.com/ - Linux install (Arch): https://protonvpn.com/support/official-linux-vpn-arch - Linux overview and supported distros: https://protonvpn.com/support/linux-vpn-setup - Linux CLI usage: https://protonvpn.com/support/use-linux-cli - Source: https://github.com/ProtonVPN - Arch package: https://archlinux.org/packages/extra/any/proton-vpn-gtk-app/ ## Related - [[Proton]] - [[Virtual Private Network (VPN)]] - [[WireGuard]] - [[Tailscale]] - [[Omarchy]] - [[Arch Linux]] - [[Linux]] - [[Network Attached Storage (NAS)]] - [[Proton Mail]] - [[Proton Pass]] - [[Proton Drive]]