How to choose, use and configure a VPN in NetBSD (My opinion)

Choosing the Right VPN for NetBSD

NetBSD’s portability and clean design make it a favourite among system administrators, network engineers and security-conscious hobbyists. It uses pkgsrc as its package manager and typically relies on lightweight desktop environments such as Xfce, Lumina or KDE, although many NetBSD users simply work from the command line. When picking a VPN provider for this BSD distribution, you need one that:

Provides native or easily compiled support for OpenVPN and WireGuard via pkgsrc.
Offers clear, configuration-file-based setup (no proprietary GUI clients).
Maintains strong documentation for Unix-style manual installation.

Following these criteria, the top candidates are:

Mullvad – Excellent WireGuard and OpenVPN support, straightforward .conf files.
ProtonVPN – Solid OpenVPN support plus community guides for BSD.
IVPN – Privacy-focused, good OpenVPN profiles and WireGuard configs.

Comparison Table

Provider	Protocols	pkgsrc Packages	CLI-only	DNS Leak Protection	IPv6 Support
Mullvad	WireGuard, OpenVPN	net/wireguard-tools, net/openvpn	Yes	Yes	Yes
ProtonVPN	OpenVPN	net/openvpn	Yes	Yes	No (workaround via tun6)
IVPN	WireGuard, OpenVPN	net/wireguard-tools, net/openvpn	Yes	Yes	Yes

Installing and Configuring Mullvad on NetBSD

Mullvad’s clean config files make installation straightforward.

1. Install Required Packages

# As root or via sudo
pkg_add -v wireguard-tools openvpn
# Or if using pkgin:
pkgin install wireguard-tools openvpn

2. WireGuard Configuration

1. Log in to your Mullvad account and generate a WireGuard keypair and config file.
2. Save the supplied mullvad-wg-.conf to /etc/wireguard/mullvad.conf.

# Bring up the tunnel
wg-quick up /etc/wireguard/mullvad.conf

# To stop:
wg-quick down /etc/wireguard/mullvad.conf

Ensure net.inet.ip.forwarding=1 in /etc/sysctl.conf if routing between interfaces.

3. OpenVPN Configuration

1. Download the OpenVPN ZIP from Mullvad’s website.
2. Extract and place your desired .ovpn file in /etc/openvpn/client/mullvad.conf.

# Start OpenVPN
openvpn --config /etc/openvpn/client/mullvad.conf

# For background daemon mode
openvpn --daemon --config /etc/openvpn/client/mullvad.conf

Installing and Configuring ProtonVPN on NetBSD

ProtonVPN doesn’t yet offer WireGuard configs for BSD, but its OpenVPN profiles work flawlessly.

1. Install OpenVPN

pkg_add -v openvpn
# or
pkgin install openvpn

2. Setup Credentials

Create a file /etc/openvpn/protonvpn-auth.txt with:

your_protonvpn_username
your_protonvpn_password

Secure it:

chmod 600 /etc/openvpn/protonvpn-auth.txt

3. Download and Edit ProtonVPN Config

Grab the .ovpn profiles from the ProtonVPN dashboard and place, for example, protonvpn-us.ovpn into /etc/openvpn/client/. Edit it to add:

auth-user-pass /etc/openvpn/protonvpn-auth.txt

4. Launch OpenVPN

openvpn --config /etc/openvpn/client/protonvpn-us.ovpn

Final Tips for NetBSD Users

Always run VPN processes as root (or via sudo) to ensure tunnel device creation (/dev/tun and /dev/tun6).
Use netstat -nr and ifconfig to verify route and interface setup.
For persistent tunnels, consider adding startup scripts to /etc/rc.conf.local.

With these steps, your NetBSD system will enjoy encrypted traffic over a reliable VPN, tailored to the platform’s package management and network stack.

LINUXMIND.DEV