How to choose, use and configure a VPN in BitKey (My opinion)

Choosing the Right VPN for BitKey

BitKey is a Debian-based live distribution designed primarily for secure Bitcoin key generation and transaction signing. It boots into a minimal desktop (Fluxbox by default, with support for Openbox or LXDE if you customise your own ISO), and uses apt as its package manager. You’ll often find yourself on a read-only USB drive or SD card, so any VPN solution must either run entirely in RAM or be pre-installed on a writable persistence layer. Typical BitKey users are privacy- and security-conscious power users, used to working at the command line and comfortable with manual network configuration.

Given these constraints, the most suitable VPN services for BitKey should offer:

Official Debian repositories or easily installable .deb packages
CLI-first tooling (no heavy system-tray GUIs)
WireGuard and/or OpenVPN support
RAM-resident clients that don’t require kernel patches or background daemons outside your control

Below is a comparison of leading providers that meet these criteria.

VPN Comparison Table

Provider	Official Debian Repo	CLI Client	Protocols	RAM-Only Mode
Mullvad VPN	Yes (apt)	mullvad-cli	WireGuard, OpenVPN	Yes
Proton VPN	Yes (apt)	protonvpn-cli	OpenVPN, WireGuard	Yes
IVPN	Yes (deb package)	ivpn-cli	WireGuard, OpenVPN	Yes
NordVPN	Yes (deb package)	nordvpn	NordLynx (WireGuard), OpenVPN	Yes

Installation Configuration Guides

1. Mullvad VPN

Mullvad offers an official Debian repository and a lightweight mullvad-cli tool. It’s perfect for BitKey’s ephemeral environment.

1. Add the Mullvad repo and install:

# Fetch and register the Mullvad GPG key
sudo apt update
sudo apt install -y gnupg2 curl
curl -Ls https://mullvad.net/media/mullvad-code-signing.key  
  gpg --dearmor  sudo tee /usr/share/keyrings/mullvad-archive-keyring.gpg

# Add the repository
echo deb [signed-by=/usr/share/keyrings/mullvad-archive-keyring.gpg] 
https://repo.mullvad.net/debian/ stable main  
  sudo tee /etc/apt/sources.list.d/mullvad.list

# Install the CLI
sudo apt update
sudo apt install -y mullvad-cli

2. Log in and start the VPN:

# Log in with your account number
mullvad account login YOUR-ACCOUNT-NUMBER

# Connect using WireGuard for best performance
mullvad connect wireguard

# For OpenVPN use:
# mullvad connect openvpn

3. Verify your IP and status:

mullvad status
curl https://ifconfig.me

2. Proton VPN

Proton VPN’s CLI is pure Python and runs entirely in user space. It’s straightforward to add via Debian’s apt.

1. Add the Proton VPN repository:

sudo apt update
sudo apt install -y gnupg2 lsb-release curl
curl -fsSL https://repo.protonvpn.com/debian/public_key.asc  
  sudo gpg --dearmor -o /usr/share/keyrings/protonvpn-archive-keyring.gpg

echo deb [signed-by=/usr/share/keyrings/protonvpn-archive-keyring.gpg] 
https://repo.protonvpn.com/debian stable main  
  sudo tee /etc/apt/sources.list.d/protonvpn.list

sudo apt update
sudo apt install -y protonvpn-cli

2. Initialize and log in:

# Initialize configuration
protonvpn-cli init

# Log in with your Proton account
protonvpn-cli login your.email@example.com

3. Connect to a server:

# List available servers
protonvpn-cli servers

# Connect using WireGuard (WG) or OpenVPN
protonvpn-cli c --protocol wg
# or
protonvpn-cli c --protocol udp

3. IVPN (Bonus)

IVPN distributes a .deb package and comes with a cross-platform CLI. It’s nearly as simple as Mullvad and Proton.

# Download  install the IVPN package
curl -O https://www.ivpn.net/installables/linux/ivpn-cli_latest_amd64.deb
sudo apt install -y ./ivpn-cli_latest_amd64.deb

# After installation
ivpn login
ivpn connect

All three options above work seamlessly on BitKey, running entirely in RAM and using standard Debian tools. Choose the one that best matches your protocol preference and user-experience requirements. Safe travels in the privacy sphere!

LINUXMIND.DEV