Related guides
Routing a Linux Server and Command-Line Tools
Updated
On Linux there are two paths, chosen by need. To route the whole machine (Docker image pulls, services that need overseas access, unattended boxes) use OpenVPN: one profile in /etc/openvpn/client/ started at boot. To route only a few commands (git, pip, npm, curl) use the web proxy: put the proxy address in the http_proxy variable and nothing else changes. Desktop Linux can also import through the network manager. This guide covers all three, the credentials file, and the commands to verify.
Path one: route the whole machine (OpenVPN)
- Install the client: Debian/Ubuntu sudo apt install openvpn, Fedora sudo dnf install openvpn, Arch sudo pacman -S openvpn.
- Log in to the site and download a region’s .ovpn from the OpenVPN page. The Linux profile does not embed credentials (network managers reject files that do), so create a credentials file: two lines, your site email then your password, chmod 600.
- Copy the .ovpn to /etc/openvpn/client/<region>.conf and add the credentials file path after auth-user-pass inside it.
- sudo systemctl enable --now openvpn-client@<region>. Check with systemctl status openvpn-client@<region> and verify with curl -s https://ipinfo.io/country, which should show your chosen region.
- For another region, download another profile and enable another unit; run only one at a time.
Path two: route only command-line tools (web proxy)
The proxy address from this site’s web-proxy page and your credentials go straight into environment variables: export https_proxy=https://user:password@proxy-address and export http_proxy=$https_proxy (URL-encode special characters in the password). From then on curl, wget, git, pip and npm in that shell take the route and nothing else is affected.
The Docker daemon ignores shell variables: put Environment= lines in /etc/systemd/system/docker.service.d/proxy.conf and restart docker; for apt, set Acquire::https::Proxy in /etc/apt/apt.conf.d/proxy.conf.
This path never drops, needs no root and changes no routes — right for company servers and for speeding up pulls only; the price is that it covers only programs that honour proxy variables.
Path three: desktop Linux through the network manager
- Install network-manager-openvpn-gnome (one click on this site’s OpenVPN page opens the software centre).
- Settings → Network → VPN → “+” → Import from file, choose the .ovpn, enter your site email and password, save.
- Toggle the VPN from the top bar or tray. For connect-at-boot, tick “Automatically connect to VPN” in the wired or wireless connection’s settings.
Verify and troubleshoot
- Exit: curl -s https://ipinfo.io should report your chosen region as country.
- DNS: in resolvectl status the VPN interface should show the DNS pushed by the route; if it leaks, add dhcp-option DNS to the profile or use the update-systemd-resolved script.
- AUTH_FAILED: a wrong credentials file or an expired account; after a password change, update the file.
- TLS handshake timeout: UDP to the server is not getting through — change region or network; on cloud servers allow outbound UDP in the security group.
- A server inside China that needs Chinese mirrors direct: everything leaves through the route once connected, so point apt / pip / npm at domestic mirrors, or use path two to route only specific commands.
Things to know
- A Linux machine counts as one device in the 5-device allowance shared with your other devices; path two’s web proxy counts per connection as well.
- The profile and credentials file are your account — never commit them to a git repository or bake them into an image.
- A password change invalidates old profiles immediately by design; update the credentials file.
- Running the route on a cloud server is subject to the provider’s terms; the service records only connection duration and total traffic.
FAQ
Why doesn’t the Linux profile embed the credentials?
Network managers reject profiles with embedded credentials and fail the import, so the Linux profile leaves them for you to enter; with systemd, they go in the credentials file.
Can only Docker take the route?
Yes — give the Docker daemon its own proxy variables (path two), or run a container with its own OpenVPN (gluetun) so only specific containers take the route.
What about the private network (Tailscale) on Linux?
The official script installs it in one line; log in with tailscale up --login-server=<this site’s control server>. Right when the machine must be reachable from outside or should stay online once configured; for faster pulls alone, OpenVPN or the proxy is simpler.
Is OpenWrt on a router the same?
Install luci-app-openvpn on OpenWrt and upload the .ovpn, and the whole LAN takes the route; a router on this site’s firmware needs none of that — just log in with the account.
Related pages
- OpenVPN page: client downloads and profiles →
- How to use OpenVPN and when to choose it →
- Routing a Synology or QNAP NAS →
- What a web proxy is and when to use one →
- Tencent Video or iQIYI Blocked Abroad? Fix It in 5 Steps →
- How to Choose a China VPN →
- Does Cisco AnyConnect Work in China? →
- Choosing a VPN Router →
- How to Import a sing-box Subscription →
- China VPN for Students Abroad →
- Free or Paid China VPN? →
- What the Private Network (Tailscale) Is →
- What the Router Firmware Does →
- How to Reach Us and Never Lose Contact →
- How We Differ from Other VPNs →
- How to Recognise a Risky VPN App →
- Which Connection Method to Choose →
- Which Region Is Fastest from Inside China →
- For the TV and the Grandparents at Home →
- Watching Home Cameras and a NAS in China from Abroad →
- What to Do When iOS Cannot Install an App →
- Cannot Connect, Slow, or Dropping: What to Check →
- Setting Up for Business Trips and Travel →
- On a Company Laptop: No Admin Rights, Corporate VPN Already On →
- Many Devices, One Setup, No Redo on a New Phone →