Routing a Linux Server and Command-Line Tools

1. Install the client. Debian/Ubuntu: sudo apt install openvpn Fedora: sudo dnf install openvpn Arch: sudo pacman -S openvpn
2. Log in to the site and download a region’s .ovpn from the OpenVPN page. The Linux profile does not embed credentials (network managers reject files that do), so create a credentials file: two lines, your site email then your password. Then restrict it so only you can read it: chmod 600 <credentials-file>
3. Copy the .ovpn to /etc/openvpn/client/<region>.conf and add the credentials file path after auth-user-pass inside it.
4. Enable and start it: sudo systemctl enable --now openvpn-client@<region> Check the status: systemctl status openvpn-client@<region> Verify the exit — it should show your chosen region: curl -s https://ipinfo.io/country
5. For another region, download another profile and enable another unit; run only one at a time.

The proxy address from this site’s web-proxy page and your credentials go straight into environment variables (URL-encode special characters in the password): export https_proxy=https://user:password@proxy-address export http_proxy=$https_proxy From then on curl, wget, git, pip and npm in that shell take the route and nothing else is affected.

The Docker daemon ignores shell variables: put Environment= lines in /etc/systemd/system/docker.service.d/proxy.conf and restart docker; for apt, set Acquire::https::Proxy in /etc/apt/apt.conf.d/proxy.conf.

On this path there is by design no connection to drop; it needs no root and changes no routes — right for company servers and for speeding up pulls only; it covers the programs that honour proxy variables.

1. Install network-manager-openvpn-gnome (one click on this site’s OpenVPN page opens the software centre).
2. Settings → Network → VPN → “+” → Import from file, choose the .ovpn, enter your site email and password, save.
3. Toggle the VPN from the top bar or tray. For connect-at-boot, tick “Automatically connect to VPN” in the wired or wireless connection’s settings.

• Exit — country in the output should be your chosen region: curl -s https://ipinfo.io
• DNS — the VPN interface should show the DNS pushed by the route: resolvectl status If it leaks, add dhcp-option DNS to the profile or use the update-systemd-resolved script.
• AUTH_FAILED: a wrong credentials file or an expired account; after a password change, update the file.
• TLS handshake timeout: UDP to the server is not getting through — change region or network; on cloud servers allow outbound UDP in the security group.
• A server inside China that needs Chinese mirrors direct: everything leaves through the route once connected, so point apt / pip / npm at domestic mirrors, or use path two to route only specific commands.

• A Linux machine counts as one device in your tier’s online-device allowance (2 Personal, 4 Family, 8 Enterprise), shared with your other devices; path two’s web proxy counts per connection as well.
• The profile and credentials file are your account — never commit them to a git repository or bake them into an image.
• A password change invalidates old profiles immediately by design; update the credentials file.
• Running the route on a cloud server is subject to the provider’s terms; the service records only connection duration and total traffic.