Best way to install a VPN on Universal Blue?

I recently installed Bluefin on one of my computers, and I have been really liking it so far. As a new user I have been reading a lot and learning a lot a long the way, and loving it!

As a long time user of Mullvad VPN, I have been reading and thinking about the best way to get that up and running on Bluefin.

It seems like a VPN is not the sort of application that would run well from a FlatPak. As I understand things it is best to avoid layering when possible in the interest of stability so I have been looking for other options.

Are any of you using Mullvad VPN? How did you install it? Does it work well on your system?

Thanks!

OSTree Layering Option

Mullvad is a great, privacy-conscious VPN Provider, which is really useful for when youā€™re on the road or donā€™t trust the coffee shop wifi. I was very concerned at first that getting a VPN running in Kinoite would be tough, but it turned out to be easy. First, Download the RPM. Then sudo rpm-ostree install /path/to/mullvad.rpm. Then reboot, because youā€™ve layered a package, and thenā€¦

Downloads | Mullvad VPN

sudo systemctl enable --now mullvad-daemon

Then it ā€˜just worksā€™, including the GUI.

Source:
https://wstyler.ucsd.edu/posts/silverblue_fixes.html

Use WireGuard for VPN

Instructions from Mullvad website.

Source

Run Mullvad VPN in Distrobox

This Redditor seems to have done that with Proton VPN.

Source
https://www.reddit.com/r/Fedora/comments/te6m53/comment/i0smcfm/

Use OpenGuard for VPN

Instructions from Mullvad website.

Source
https://wiki.archlinux.org/title/Mullvad

Thanks again!

3 Likes

The wireguard instructions should work on Bluefin since it includes the wireguard tools. (though it would be great if we could confirm that they work!).

Iā€™m also not sure if the layered install will pull in the repo, so you might want to make sure that this repo file is in /etc/yum.repos.d so that youā€™re getting updates.

Iā€™m using Mullvad in a different way, I buy it through tailscale so itā€™s integrated right into the tailscale UI so thereā€™s almost zero config, though that might not be the way you wanna run it. Hope this helps!

I followed the WireGuard instructions on the Mullvad VPN website as you suggested, and the connection test page confirmed that it worked. I always used the application in Ubuntu so turning the VPN on and off from the command line is a little different, but not a problem at all.

Thank you so much for all of the work you are doing on this project. It really does feel like the future!

2 Likes

I was sent here by my buddy Matt H as I may be facing the same issue for installation on Aurora soon, when I move from Fedora 40 to Aurora on my Framework 13. Iā€™ll definitely miss the point-and-click app though, any ideas for the RPM?

1 Like

You wonā€™t really miss it.

Flatpaks - installed via the store.
Containers - I really need something using RPMs, okay, install Fedora via Box Buddy and have at it. many applications can be run with created launchers in Bluefin. I do this with a testing release of KDENLive.
Homebrew - Lots of CLI stuff here, much of it for devs.

rpm-ostree layering - Absolute last resort and honestly, worth rethinking the app if it needs it. But if one must, hereā€™s the general idea.

All of that said, as others have indicated, this should work.

2 Likes

Besides that, Bluefin specifically, has Tailscale rolled in.

Heh, interesting. Iā€™d do a DNS leak test to confirm myself post-install, but ā€œapparentlyā€ you can do this with RMP installs of VPNs through distrobox. Assuming Box Buddy app export the icon out to the host for in-container launching. Never tried it, but it sounds interesting. Reddit - Dive into anything

1 Like

Oooh ok Iā€™ll continue testing Aurora on my corebooted Thinkpad C13 Yoga and look towards moving to Bluefin on FW13

Awesome! :slight_smile:

Just to be sure, i can use wireguard in Bazzite as well, no?

1 Like

GNOME extension, yes. Also found this, although I am on Bluefin ATM.

Iā€™ve been using wg-quick

1 Like

I am using Gnome, and their implementation of network manager allows you to ā€œimport from fileā€ to set up a VPN. This turns the VPN toggle into one of their quick buttons in the menu bar, and you can configure it to select from multiple different nodes or auto-connect on sign-in.

Highest recommendation for integration and ease of use.

I havenā€™t tried it on KDE plasma, but I have done it on XFCE, and it was also just as painless to set up and easy to manage.

Once you sign into your mullvad account on their site, you need to go to the download section for the wireguard configurations and download the files for each node you want to appear in your drop down menus.

Then import them in your DEā€™s VPN settings, name them whatever you like, and youā€™re off to the races.

edit: Screenshot for what the result looks like in Gnome

1 Like

I can confirm Proton VPN works perfectly from Flatpak on Aurora.

3 Likes

Have you figured a way to enable killswitch? In case connection drops or vpn server is down for maintenance.

I have not, but what has happened in those instances for me is that I lose all access to the internet until I switch off the VPN. I donā€™t think it has all of the benefits of a dedicated killswitch per-se, but it was what I personally want to happen in that scenario.

How have you set it up?
The goal: shut down internet access if vpn server is down. so that we can switch to another server from network-manager list.

1 Like

I have a corporate VPN I am required to use.
Here is the name of the package.
ps-pulse-linux-22.5r1.0-b25375-64bit-installer.rpm
I have tried two approaches:

  • installation into a fedora distrobox, which I then distrobox-export
  • rpm-ostree install ps-pulse-linux-22.5r1.0-b25375-64bit-installer.rpm

Both approaches ultimately fail giving the same error.
Before failing, the basic stuff works, i.e., starting the UI, ā€¦
Here is the error.

/opt/pulsesecure/bin/pulseUI 
dsOpenSSL Start - dsENGINE_register_ECDSA
dsOpenSSL End - dsENGINE_register_ECDSA
DBUS api call failed with code: 2 - message:GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: The name is not activatable 
DBUS api call failed with code: 2 - message:GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: The name is not activatable 
DBUS api call failed with code: 2 - message:GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: The name is not activatable 
DBUS api call failed with code: 2 - message:GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: The name is not activatable 
Segmentation fault (core dumped)

Any advice?

Is it permitted to install the corporate vpn on a router or are you required to install it on the pc? Then again perhaps you have to travel for work.

Yes, I am traveling.
Installing the VPN on a router is a good point though.
If I am unable to get this working on UB, I do have an OrangePi that I could potentially recruit as router, but that sounds like a fair bit of work.