How to choose, use and configure a VPN in Tails (The Amnesic Incognito Live System) (Comparison)

Choosing the Right VPN for Tails

Working daily with Tails (The Amnesic Incognito Live System) in London’s tech scene, I’ve noticed many privacy-minded users want to combine Tails’ amnesic, live-only environment with a reliable VPN. Tails runs off Debian’s APT packages, boots into a GNOME (or occasionally IceWM) desktop, and discards all changes on shutdown unless you explicitly enable a Persistent Storage volume. That means any VPN client you install must be installed each session (unless you store it in Persistent Storage under “Additional Software”) and play nicely with NetworkManager’s OpenVPN plugin. You also need a provider that provides standalone OpenVPN configuration files and doesn’t rely on heavyweight GUIs or package repositories that Tails blocks by default.

Based on those technical peculiarities, here are the three most suitable VPNs for Tails:

Mullvad VPN – Offers easy-to-download .ovpn profiles, Debian-friendly instructions, and a small footprint.
ProtonVPN – Provides official OpenVPN configs and detailed CLI guides, plus good privacy credentials.
Private Internet Access (PIA) – Built with privacy in mind, offers .ovpn bundles, strong DNS leak protection and plenty of advanced options, but can be slightly more advanced to set up.

Comparison Table

Feature	Mullvad VPN	ProtonVPN	Private Internet Access
OpenVPN Profiles	Mullvad VPN	ProtonVPN	Private Internet Access
NetworkManager Plugin	network-manager-openvpn	network-manager-openvpn	network-manager-openvpn
CLI-Friendly	Yes	Yes	Yes
Persistent Storage Support	Yes (Additional Software)	Yes (Additional Software)	Yes (Additional Software)
Obfuscation/Stealth	No	Yes (Stealth Servers)	Yes (Obfuscated/port-randomized OpenVPN)
Recommended for Tails Users	Beginner to Intermediate	Intermediate	Intermediate to Advanced

Installing Configuring on Tails

Before you start, ensure you’ve enabled Persistent Storage and added network-manager-openvpn and network-manager-openvpn-gnome under “Additional Software.” This lets you keep the VPN plugin across reboots.

Mullvad VPN Setup

Download your OpenVPN ZIP bundle from Mullvad VPN.
Copy the ZIP into your Persistent Storage and unzip:

cd ~/Persistent
unzip mullvad-config-openvpn-.zip -d mullvad-config

Open Network settings → VPN → Add → Import from file, then select your desired .ovpn file from ~/Persistent/mullvad-config.
Enter your Mullvad account number when prompted (no username/password required).
Connect and verify by browsing to am.i.mullvad.net.

ProtonVPN Setup

Fetch Proton’s OpenVPN configs via:

cd ~/Persistent
wget https://protonvpn.com/download/ProtonVPN_Configs.zip
unzip ProtonVPN_Configs.zip -d proton-config

Go to GNOME’s Network → VPN → Add → Import from file. Point to one of the .ovpn files under ~/Persistent/proton-config.
When prompted for credentials, use your ProtonVPN username amp password.
Optionally select a Stealth server group if you’re in a censored region.
Click “Connect” and confirm your IP change on What is my IP.

Private Internet Access (PIA) Setup

Log into your PIA account area in the browser and download the OpenVPN configuration bundle (usually a ZIP file with multiple regions).

cd ~/Persistent
unzip pia-openvpn-configs.zip -d pia-config

In GNOME’s Network panel, go to Network → VPN → Add → Import from file, and choose one of the .ovpn files under ~/Persistent/pia-config.
When prompted, enter your PIA username and password (or the OpenVPN-specific credentials from your account panel).
If you need extra obfuscation, edit the connection’s advanced settings to use TCP over port 443 or another PIA-supported port that blends in with regular HTTPS traffic.
Connect and verify your new IP and location on PIA’s “What’s My IP” page.

With these steps, you’ll have a robust VPN layered atop Tails’ Tor circuits, giving you an extra shield of privacy. Safe browsing from London and beyond!

LINUXMIND.DEV