How to choose, use and configure a VPN in Endless OS (Comparison)

Choosing the Right VPN for Endless OS

Endless OS is built on an immutable OSTree model with a read-only root and relies heavily on Flatpak for third-party applications rather than the usual apt or yum. Its typical audience ranges from educators and library kiosks to non-technical home users, all running a GNOME-based desktop (with a Cinnamon spin available) on hardware that may be lower-spec. If you need a VPN on Endless OS, look for providers that:

Offer a standalone Linux binary or tarball (no apt repos required).
Support OpenVPN/WireGuard configs you can import into NetworkManager.
Provide a Flatpak (rare, but a bonus).
Have a straightforward CLI for speed and stability on an immutable system.

Based on those criteria, the three most suitable VPNs for Endless OS are:

Mullvad VPN – official Linux tarball with both WireGuard and OpenVPN support.
ExpressVPN – easy-to-use tarball installer with its own CLI.
ProtonVPN – can be set up via raw OpenVPN/WireGuard configs or a community Flatpak.

Comparison at a Glance

VPN	Server Network	Protocol Support	Install Method	Ease of Use on Endless OS
Mullvad VPN	600 servers in 38 countries	WireGuard, OpenVPN	Official tarball	High – CLI configs integrate with NetworkManager
ExpressVPN	3,000 servers in 94 countries	Lightway, OpenVPN	Official tar.xz installer	High – native CLI, no dependencies beyond core libs
ProtonVPN	1,700 servers in 65 countries	WireGuard, OpenVPN	OpenVPN/WG configs or community Flatpak	Medium – manual config steps required

1. Installing and Configuring Mullvad VPN

Mullvad provides a simple tarball containing the mullvad CLI. It works perfectly on Endless OS’s immutable root.

Step-by-step:

Download and extract the tarball:

cd ~/Downloads
wget https://mullvad.net/download/app/latest/linux64 -O mullvad.tar.gz
tar xzf mullvad.tar.gz
cd linux64

Move the binary into your local bin:

mkdir -p ~/.local/bin
install -m755 mullvad-cli ~/.local/bin/mullvad

Verify installation and login (use your Mullvad account number):

mullvad status
mullvad login YOUR_ACCOUNT_NUMBER

Connect via WireGuard for best speed:

mullvad wireguard generate
mullvad wireguard enable
mullvad connect

If you prefer NetworkManager integration, export an OpenVPN config:

mullvad openvpn --country SE > mullvad-se.ovpn

Then open your Network settings in Endless OS, import mullvad-se.ovpn, enter your Mullvad number when prompted, and you’re good to go.

2. Installing and Configuring ExpressVPN

ExpressVPN distributes a pre-compiled tar.xz with its own lightweight CLI. It’s a breeze on Endless OS.

Follow these steps:

Download and extract:

cd ~/Downloads
wget https://www.expressvpn.works/clients/linux/expressvpn_3.0.0.24-1_amd64.tar.xz
tar xJf expressvpn_.tar.xz
cd expressvpn

Run the install script:

sudo ./install.sh

Activate with your activation code:

expressvpn activate
# paste your code when prompted

Connect to a server (e.g. London):

expressvpn connect London

You can also list available locations with expressvpn list and disconnect via expressvpn disconnect.

3. Quick Setup for ProtonVPN via OpenVPN

ProtonVPN doesn’t provide an official Endless OS package, but you can import their OpenVPN configs into NetworkManager:

Download the ZIP of OpenVPN configs from their dashboard.
Unzip and navigate to the openvpn folder.

cd ~/Downloads
unzip ProtonVPN_Configs.zip -d protonvpn-configs

Open Endless OS Settings → Network → VPN → “Import from file…”
Select the .ovpn for your preferred server (e.g. CH-FR).
Enter your ProtonVPN username/password when prompted.
Toggle the VPN switch to connect.

Final Thoughts

For an immutable distribution like Endless OS, standalone tarballs and OpenVPN/WireGuard configs are your best friends. Mullvad and ExpressVPN shine with their dedicated CLI tools, while ProtonVPN can be shoe-horned in via standard .ovpn imports. Whichever you pick, you’ll add a solid layer of privacy to your GNOME-based Endless environment without wrestling with unsupported package managers.

LINUXMIND.DEV