VPN Setup on Linux Mint

Overview

This guide documents a practical, beginner-safe VPN setup for Linux Mint: installing the official Proton VPN Linux app (free plan, WireGuard), verifying that traffic, IPv4, and DNS actually route through the tunnel — and that everything returns to normal when you disconnect. Along the way it separates the concepts people blur together (provider vs protocol vs client), explains what a free plan can and cannot do, and covers kill-switch recovery and clean uninstall.

---

The Problem (Windows User Perspective)

On Windows, VPN setup usually means installing one app and clicking Connect. On Linux, the same topic quickly becomes confusing because people mention VPN providers, WireGuard, OpenVPN, NetworkManager, DNS leaks, kill switches, and split tunneling as if they are all the same thing.

They are not.

This guide documents a practical, beginner-safe setup for Linux Mint: using Proton VPN Free through the official Linux app, verifying that the connection actually works, and understanding the limitations before enabling advanced features.

---

Important Reality Check

A VPN that is all of the following at once is difficult to find:

• free
• open-source client
• privacy-respecting
• very fast
• reliable for streaming
• reliable for torrenting/P2P
• supports split tunneling
• has no tradeoffs

Free VPN plans almost always have limitations. Proton VPN Free is one of the safer free options, but it is still not a no-compromise replacement for a paid VPN.

Use Case	Proton VPN Free Expectation
Public Wi-Fi privacy	Good
General browsing	Good
Hiding IP from websites	Good
YouTube	Usually fine
Streaming services such as Netflix/Prime/Disney	Not guaranteed
Torrenting/P2P	Not ideal on free plan; check Proton’s current policy and server labels
Split tunneling	VPN Plus/paid feature
No speed loss	Not guaranteed

---

Key Concepts

VPN Provider vs VPN Protocol

A VPN provider is the service/company that gives you VPN servers.

Examples:

Proton VPN
Mullvad
IVPN
A self-hosted VPS running WireGuard

A VPN protocol is the tunnel technology used to connect to the VPN server.

Examples:

WireGuard
OpenVPN
IKEv2/IPsec

So:

Proton VPN = provider/service
WireGuard = protocol
OpenVPN = protocol

What Is WireGuard?

WireGuard is a modern VPN protocol. On Linux, it is especially attractive because it is fast, lightweight, and integrated into the kernel stack.

Feature	WireGuard
Speed	Usually faster than OpenVPN
CPU/battery use	Usually lower
Linux integration	Excellent
Configuration complexity	Simpler than OpenVPN, but still needs a provider/server
Best use	Daily VPN use when supported

On the tested system, Proton VPN connected using WireGuard and created a NetworkManager interface named:

proton0

What Is OpenVPN?

OpenVPN is an older and very mature VPN protocol. It is still useful because many providers offer .ovpn files and NetworkManager can import them.

Feature	OpenVPN
Speed	Often slower than WireGuard
Compatibility	Very high
Manual setup	Common through .ovpn files
Best use	Fallback when WireGuard is unavailable or blocked

The tested system already had OpenVPN support installed:

openvpn
network-manager-openvpn
network-manager-openvpn-gnome

Note: This guide verified Proton VPN through the official app using WireGuard. The OpenVPN path is explained as a fallback concept but was not fully tested end-to-end in this setup.

---

Tested System

Component	Tested Detail
OS	Linux Mint 22.3 Cinnamon
Base	Ubuntu 24.04 Noble
Session	X11
Network manager	NetworkManager 1.46.0
Proton app package	proton-vpn-gtk-app 4.16.5 when tested
Proton metapackage	proton-vpn-gnome-desktop
VPN protocol used by Proton	WireGuard
VPN interface when connected	proton0
Normal Wi-Fi interface	wlp9s0
Normal DNS before/after VPN	1.1.1.1, 8.8.8.8

---

Step 1 - Check Current VPN-Related Packages

Before installing anything, check what is already present:

nmcli --version

Then:

dpkg -l | grep -E 'wireguard|openvpn|network-manager-openvpn|network-manager-wireguard|proton'

On the tested system, OpenVPN support was already installed before Proton VPN:

network-manager-openvpn
network-manager-openvpn-gnome
openvpn

After installing Proton VPN, these packages were present:

proton-vpn-daemon
proton-vpn-gnome-desktop
proton-vpn-gtk-app
protonvpn-stable-release
python3-proton-core
python3-proton-vpn-api-core
wireguard-tools

---

Step 2 - Record the Normal Non-VPN State

Before connecting to a VPN, record your baseline state.

Check public IPv4:

curl -4 --max-time 10 ifconfig.me

Do not publish this IP in a public guide or screenshot.

Check active connections:

nmcli connection show --active

Normal non-VPN state should show only your Wi-Fi/Ethernet connection and loopback, for example:

NAME              TYPE      DEVICE
Auto WiFiName     wifi      wlp9s0
lo                loopback  lo

Check DNS:

nmcli dev show | grep DNS

On the tested system, the normal DNS servers were:

1.1.1.1
8.8.8.8

Check the route to a public IP:

ip route get 1.1.1.1

Before VPN, the route should go through your router and Wi-Fi/Ethernet interface, for example:

1.1.1.1 via 192.168.1.1 dev wlp9s0

---

Step 3 - Install Proton VPN on Linux Mint

Proton officially supports Ubuntu with GNOME. Their Mint support page says Linux Mint may work, but support can be limited. For Linux Mint Cinnamon, follow the Ubuntu install path but skip the optional GNOME tray icon package.

Warning: Do not install gnome-shell-extension-appindicator on Linux Mint Cinnamon just for Proton VPN. Proton’s Mint note warns that it can pull in the full GNOME desktop environment as a dependency. The VPN app works without that optional tray-icon step.

Download the Proton Repository Package

wget https://repo.protonvpn.com/debian/dists/stable/main/binary-all/protonvpn-stable-release_1.0.8_all.deb

Note: Proton occasionally ships a newer release-package version. If the URL 404s, get the current filename and checksum from protonvpn.com/support/official-linux-vpn and adjust the commands below.

Verify the Checksum

echo "0b14e71586b22e498eb20926c48c7b434b751149b1f2af9902ef1cfe6b03e180 protonvpn-stable-release_1.0.8_all.deb" | sha256sum --check -

Expected:

protonvpn-stable-release_1.0.8_all.deb: OK

If it does not say OK, stop and re-check the downloaded file.

Install the Repository Package

sudo dpkg -i ./protonvpn-stable-release_1.0.8_all.deb

Update package lists:

sudo apt update

Install the Proton VPN app:

sudo apt install proton-vpn-gnome-desktop

---

Step 4 - Connect to Proton VPN

Open the app:

Menu → Proton VPN

Then:

1. Sign in to your Proton account.
2. Use Quick Connect or choose an available free server.
3. Connect.
4. Do not enable permanent kill switch yet.
5. Do not enable auto-connect yet.
6. First verify that the basic VPN connection works.

On the tested system, Proton connected to a free Japan server using WireGuard:

ProtonVPN JP-FREE#14

The active interface was:

proton0

---

Step 5 - Verify the VPN Connection

Check active NetworkManager connections:

nmcli connection show --active

When Proton VPN is connected, expect something like:

NAME                  TYPE       DEVICE
Auto WiFiName         wifi       wlp9s0
ProtonVPN JP-FREE#14  wireguard  proton0
pvpn-killswitch-ipv6  dummy      ipv6leakintrf0
lo                    loopback   lo

The exact Proton server name will differ.

Check public IPv4:

curl -4 --max-time 10 ifconfig.me

The IP should be different from your normal ISP IP.

Check IPv4 routing:

ip route get 1.1.1.1

When VPN is active, a good sign is:

dev proton0

That means IPv4 traffic is going through the Proton WireGuard tunnel.

---

Step 6 - Verify DNS and IPv6 Leak Behavior

Check DNS from NetworkManager:

nmcli dev show | grep -E 'GENERAL.DEVICE|GENERAL.TYPE|IP4.DNS|IP6.DNS'

When Proton VPN is active, you may still see your normal DNS on the Wi-Fi device, but the Proton interface should also show Proton DNS, for example:

GENERAL.DEVICE: proton0
GENERAL.TYPE:   wireguard
IP4.DNS[1]:     10.2.0.1
IP6.DNS[1]:     2a07:b944::2:1

The more authoritative resolver view is:

resolvectl status

A good Proton-connected state looks like:

Link proton0
    Current Scopes: DNS
    Protocols: +DefaultRoute
    DNS Servers: 10.2.0.1 2a07:b944::2:1
    DNS Domain: ~.

Check IPv6 public IP:

curl -6 --max-time 10 ifconfig.me

If IPv6 is available, it should also be routed through Proton. Confirm route behavior with:

ip -6 route get 2606:4700:4700::1111

A good sign is:

dev proton0

On the tested system, IPv4, IPv6, and DNS all routed through proton0 while the VPN was connected.

---

Step 7 - Browser Leak Tests

Terminal checks are useful, but also test from the browser.

Open:

https://browserleaks.com/ip

Also test:

https://ipleak.net

Check:

Item	Expected When VPN Is Connected
Public IP	Proton/VPN IP, not normal ISP IP
DNS servers	VPN/provider DNS, not ISP DNS
WebRTC	Should not reveal the normal ISP public IP
IPv6	Should be VPN-routed or safely blocked

Do not publish screenshots that show your real non-VPN IP.

---

Step 8 - Speed and Streaming Expectations

Use the same speed test before and after VPN:

https://fast.com
https://www.speedtest.net

Test in this order:

1. VPN disconnected.
2. VPN connected to the free Proton server.
3. Compare download speed, upload speed, and latency.

Free VPN servers can be crowded or geographically far away. If you connect to a server in another region, latency may be much higher.

Symptom	Likely Cause
Speed is slightly lower	Normal VPN overhead
Speed is much lower	Crowded/free server or far server location
Streaming site blocks playback	Streaming service blocked VPN IP range
YouTube works but Netflix/Prime does not	Common free VPN limitation

A free VPN is good for privacy testing and public Wi-Fi use. It is not guaranteed to be a no-compromise streaming setup.

---

Step 9 - Torrenting and Split Tunneling Limits

Split tunneling means routing some apps through the VPN and excluding others.

Example goal:

Browser → VPN
Torrent app → normal ISP connection

Or the reverse:

Torrent app → VPN
Browser → normal ISP connection

On Proton VPN, split tunneling is a VPN Plus/paid feature. If you use Proton VPN Free, you cannot cleanly exclude a torrent client from the system-wide Proton VPN through the Proton app.

If You Need Torrent Apps Outside the VPN

If a private tracker or torrent administrator blocks VPN users, the simplest free workflow is:

Before torrenting: disconnect Proton VPN desktop app
After torrenting: reconnect Proton VPN for normal browsing

Verify before opening the torrent app:

nmcli connection show --active

If you see ProtonVPN, proton0, or pvpn-..., the system VPN is still active.

You can also check:

curl -4 --max-time 10 ifconfig.me

If it shows your normal ISP IP, Proton system VPN is disconnected.

Warning: If you exclude a torrent app from a VPN or disconnect the VPN before torrenting, your torrent traffic uses your normal ISP connection. Peers, trackers, and your ISP may see your normal public IP and torrent metadata. Only torrent legal content and understand the privacy tradeoff.

Free Workaround: Browser-Only VPN

If your main goal is browser privacy while keeping torrent apps outside the VPN, use Proton’s browser extension instead of the system-wide desktop VPN.

Workflow:

Proton desktop VPN → disconnected
Proton browser extension → connected
Torrent app → normal internet
Browser → VPN

This is the cleanest free split-style setup, but it protects only browser traffic.

Paid Option

If you upgrade to Proton VPN Plus, use:

Settings → Split tunneling

Two possible approaches:

Mode	Behavior
Exclude mode	Most apps use VPN; selected apps bypass VPN
Include mode	Only selected apps use VPN; everything else bypasses VPN

For avoiding tracker issues, Include mode can be easier to reason about: include only browsers in the VPN, leaving torrent apps outside by default.

---

Step 10 - Disconnect and Confirm Normal Routing Returns

After disconnecting Proton VPN, confirm the system is back to normal.

Active connections should show only Wi-Fi/Ethernet and loopback:

nmcli connection show --active

Expected shape:

NAME              TYPE      DEVICE
Auto WiFiName     wifi      wlp9s0
lo                loopback  lo

Check route:

ip route get 1.1.1.1

Expected shape:

1.1.1.1 via 192.168.1.1 dev wlp9s0

Check DNS:

resolvectl status

Expected shape:

Link wlp9s0
    Current Scopes: DNS
    DNS Servers: 1.1.1.1 8.8.8.8

On the tested system, disconnecting Proton restored the previous normal Wi-Fi routing and DNS state.

---

Step 11 - Kill Switch Caution and Recovery

A kill switch blocks internet traffic if the VPN disconnects unexpectedly. It can be useful, but do not enable permanent kill switch until you have tested basic VPN behavior.

Why be careful? If the app is uninstalled or misconfigured while kill-switch NetworkManager profiles remain, internet can appear broken.

Check active Proton-related connections:

nmcli connection show --active

Look for names beginning with:

pvpn-

If internet is blocked after uninstalling Proton VPN, remove leftover Proton kill-switch connections:

nmcli connection show

Then delete Proton kill-switch connections by name, for example:

nmcli connection delete pvpn-killswitch
nmcli connection delete pvpn-ipv6leak-protection
nmcli connection delete pvpn-routed-killswitch

The exact names may differ. Delete only Proton pvpn-... connections you understand.

---

Step 12 - Uninstall Proton VPN

To remove the official Proton VPN app and repository package:

sudo apt autoremove proton-vpn-gnome-desktop
sudo apt purge protonvpn-stable-release
sudo apt update

Then check for leftover active Proton connections:

nmcli connection show --active

If no ProtonVPN, proton0, or pvpn-... entries remain, routing should be back to normal.

---

OpenVPN Fallback Notes

Because this system already had OpenVPN support installed, it can import .ovpn files from providers that offer manual OpenVPN configs.

Typical GUI path:

Network Settings → VPN → Add → Import from file

Choose the provider’s .ovpn file, then enter credentials if required.

Useful packages:

sudo apt install openvpn network-manager-openvpn network-manager-openvpn-gnome

OpenVPN is a good fallback if:

• the Proton app does not work on your distro,
• WireGuard is blocked on a network,
• another VPN provider only gives OpenVPN configs,
• you need a manually managed NetworkManager VPN profile.

But for this tested setup, Proton’s official app used WireGuard successfully, so OpenVPN was not needed.

---

Recommended Setup for This Laptop

For the tested Linux Mint ThinkPad setup:

Need	Recommendation
Free reputable VPN	Proton VPN Free desktop app
Best performance protocol	WireGuard, automatically used by Proton in this test
Public Wi-Fi privacy	Use Proton desktop app
Browser-only VPN while torrent apps stay outside VPN	Use Proton browser extension instead of desktop VPN
Torrent app outside VPN on free plan	Disconnect Proton desktop VPN before torrenting
Split tunneling	Requires Proton VPN Plus/paid plan
Streaming reliability	Do not expect free VPN servers to be reliable
Advanced kill switch	Enable only after basic testing

---

Quick Command Reference

Check active connections:

nmcli connection show --active

Check public IPv4:

curl -4 --max-time 10 ifconfig.me

Check DNS:

resolvectl status

Check route:

ip route get 1.1.1.1

Check IPv6 route:

ip -6 route get 2606:4700:4700::1111

Check installed VPN packages:

dpkg -l | grep -E 'proton|wireguard|openvpn|network-manager-openvpn|network-manager-wireguard'

---

Final Notes

A VPN is useful, but it is not magic privacy armor.

A VPN can:

• hide your normal public IP from websites,
• protect traffic on public Wi-Fi,
• route DNS through the VPN provider,
• reduce some ISP visibility into destination websites.

A VPN cannot:

• make unsafe downloads safe,
• guarantee streaming access,
• make account logins anonymous,
• prevent tracking by cookies or browser fingerprinting,
• protect torrent traffic if you intentionally route torrent apps outside the VPN.

For this setup, Proton VPN Free is a good starting point, WireGuard worked correctly, and disconnecting Proton cleanly restored normal Linux Mint networking.