Choosing the Right VPN for Batocera Linux

Batocera Linux is a retro-gaming-oriented, read-only distribution based on Buildroot. It boots into EmulationStation rather than a traditional desktop environment and doesn’t ship with apt or yum by default. Instead, the root filesystem is immutable, and custom binaries live under /userdata or /usr/local. Most users access the system via SSH (enabled in Developer Mode) and manage services through simple init scripts or hooks in /userdata/system. Given these constraints, the ideal VPN clients for Batocera will be those that:

• Provide statically linked (or easily bundled) CLI binaries
• Support lightweight protocols such as WireGuard or OpenVPN
• Require minimal dependencies so you can drop them into /userdata and run

Here’s a shortlist of VPNs well suited to this environment:

• Mullvad VPN – Statically linked WireGuard client, simple CLI.
• ProtonVPN – Official Linux CLI, WireGuard support, Python-based but packageless install possible.
• NordVPN – Official Linux client with embedded dependencies, works via straightforward binary.
• OpenVPN (community) – Pure open-source, in case you prefer managing your own .ovpn files.

Below is a comparison table focusing on Batocera’s unique requirements.

Installing and Configuring Mullvad VPN

Mullvad’s static WireGuard client is ideal for Batocera. You’ll download a tarball, extract it under /userdata, then authenticate and connect.

Steps:

1. SSH into your Batocera box (enable Developer Mode first).
2. Remount the root filesystem as writable:

mount -o remount,rw /
    

3. Download and extract the client:

cd /userdata
wget https://mullvad.net/download/app/deb/latest -O mullvad.deb
ar x mullvad.deb data.tar.xz
tar -xJf data.tar.xz ./usr/bin/mullvad
mkdir -p /usr/local/bin
cp ./usr/bin/mullvad /usr/local/bin/
chmod  x /usr/local/bin/mullvad
    

4. Log in and connect:

mullvad account login
mullvad connect wireguard
    

5. Verify:

mullvad status
    

To auto-start on boot, append the connect command into /userdata/system/.emulationstation/scripts/runcommand-onstart.sh.

Installing and Configuring ProtonVPN

ProtonVPN’s CLI is Python-based but can be self-contained in a virtual environment under /userdata. You’ll use pip on your development machine and then copy over the bundle.

1. On a separate Debian/Ubuntu box:

python3 -m venv protonvpn-env
source protonvpn-env/bin/activate
pip install protonvpn-cli
deactivate
cd protonvpn-env
tar -czf protonvpn-env.tar.gz .
    

2. Transfer and extract to Batocera:

scp protonvpn-env.tar.gz root@batocera:/userdata
ssh root@batocera
cd /userdata
tar -xzf protonvpn-env.tar.gz
    

3. Create a wrapper script /usr/local/bin/protonvpn:

#!/bin/sh
export VIRTUAL_ENV=/userdata/protonvpn-env
export PATH=VIRTUAL_ENV/bin:PATH
exec python3 -m protonvpn_cli @
    

chmod  x /usr/local/bin/protonvpn
    

4. Log in and connect:

protonvpn login your_username
protonvpn c --sc # secure core
    

Add your chosen connect command to your startup hook as above.

Installing and Configuring NordVPN

NordVPN’s official Linux client comes as a .deb. Similar to Mullvad, you’ll extract the .deb and copy the nordvpn binary plus its dependencies into /usr/local.

1. Download and extract:

cd /userdata
wget https://downloads.nordcdn.com/apps/linux/install.sh
sh install.sh --skip-install
ar x /var/cache/apt/archives/nordvpn-release_1.0.0_all.deb
ar x /var/cache/apt/archives/nordvpn_3.15.0_amd64.deb
tar -xJf data.tar.xz
    

2. Copy binaries and libs:

cp usr/bin/nordvpn /usr/local/bin/
cp -r usr/lib/nordvpn /usr/local/lib/
chmod  x /usr/local/bin/nordvpn
    

3. Initial setup:

nordvpn login
nordvpn set technology NordLynx
nordvpn connect
    

Once running, check nordvpn status to ensure you’re protected.

Wrapping Up

On Batocera, the fewer external dependencies and the more self-contained your VPN client, the smoother the experience. Mullvad, ProtonVPN and NordVPN each offer CLI tools that can be shoe-horned into Batocera’s read-only root via /userdata, letting you game in peace behind an encrypted tunnel. Tweak your startup scripts in /userdata/system and you’re all set—no desktop environment required, and no interruptions to your retro gaming marathon.