How to choose, use and configure a VPN in YunoHost (Tutorial)

Choosing the Right VPN for YunoHost

YunoHost is a Debian‐based distribution tailored for self-hosting enthusiasts in need of a streamlined server experience. It relies on the APT package manager, exposes a web admin panel, and is often deployed headlessly or alongside lightweight desktop environments (Xfce, Openbox, LXQt). Most users interact via SSH or the web UI rather than a full GNOME/KDE desktop. In this context, VPN clients must:

Install cleanly on Debian/Ubuntu via apt or a single .deb package.
Support CLI operation (no GUI dependencies) for headless setups.
Offer modern protocols (WireGuard, OpenVPN) and a reliable kill-switch.
Be lightweight, stable on low-RAM devices (Raspberry Pi, Intel NUC, VPS).

Below is a shortlist of the most suitable VPN providers for YunoHost’s typical environment.

Comparison Table

Service	Debian Package	Protocols	Kill-Switch (CLI)	CLI Client
Mullvad VPN	Official `.deb`	WireGuard, OpenVPN	Yes	mullvad
ProtonVPN	APT Repo	WireGuard, OpenVPN	Yes	protonvpn
NordVPN	Official `.deb`	NordLynx (WireGuard), OpenVPN	Yes	nordvpn

Installation Configuration Guides

Mullvad VPN

Mullvad offers a straightforward Debian package. It supports both WireGuard and OpenVPN, plus a built-in kill-switch.

Download and install the official package:

wget https://mullvad.net/download/app/deb/latest -O mullvad.deb
sudo apt update
sudo apt install ./mullvad.deb

mullvad login YOUR_ACCOUNT_NUMBER

Enable the system-wide kill-switch (blocks all traffic on drop):

mullvad relay set-port 51820
mullvad wireguard enable
mullvad disconnect  mullvad connect

Use mullvad status to verify connection and kill-switch status.

ProtonVPN

ProtonVPN provides an official APT repository with a robust CLI client. It integrates smoothly with headless Debian setups.

Install dependencies and add the official repo:

sudo apt update
sudo apt install -y wget gnupg lsb-release
wget -qO - https://repo.protonvpn.com/debian/public_key.asc  sudo apt-key add -
echo deb https://repo.protonvpn.com/debian stable main  sudo tee /etc/apt/sources.list.d/protonvpn.list
sudo apt update

Install the CLI client:

sudo apt install protonvpn-cli

Authenticate and connect:

protonvpn-cli login your@protonmail.com
protonvpn-cli c --fastest

Enable the kill-switch:

protonvpn-cli ks --on

Check status with protonvpn-cli s.

NordVPN

NordVPN’s Debian package includes its nordvpn CLI tool with support for NordLynx (WireGuard).

Download and install:

wget https://downloads.nordcdn.com/apps/linux/install.sh
chmod  x install.sh
sudo ./install.sh

nordvpn login
nordvpn connect

Enable the kill-switch and auto-connect:

nordvpn set killswitch on
nordvpn set autoconnect on

Verify with nordvpn status. NordVPN will now reconnect automatically on boot or network drop.

Wrapping Up

For YunoHost home servers and headless deployments, Mullvad, ProtonVPN, and NordVPN stand out due to their Debian packaging, CLI-first tools and modern protocol support. Choose based on your preferred protocol (WireGuard vs OpenVPN), geographic needs and privacy policies—rest assured these three integrate cleanly with YunoHost’s Debian core and lightweight environment.

LINUXMIND.DEV