Difficulty setting up Standalone ProtonVPN Service

I am having problems setting up a ProtonVPN Net Qube to use as the Net vm for my Personal, Untrusted and Work vm’s. My Mullvad fedora (installed as per Micah Lee instructions) has recently become glitchy, requiring shutting down in-use vm’s, then restarting the MullvadVPN qube, before restarting the other vms. So I’d like to try Proton, as I already have an account.
What I have done so far:
from the following thread below,

How I can install vpn template (protonvpn)?

trying to install ProtonVPN via the gui method would not work.
So I’m now trying Proton’s official protonvpn-cli method with fedora-36.
Standalone fedora-36 vm created and updated. Enabled auto start on reboot and added Network Manager in the Services tab. Everything seems successful, after following the Proton instructions to the end of the installation. But then trying to log in to my Proton account for the ProtonVPN came to a crashing halt, when I used their suggested login method. From Terminal in my new protonvpn-cli vm, entering

protonvpn-cli login [Proton VPN username] , while substituting my Proton username, I get an error message, that protonvpn-cli is an unrecognized command. Cannot get past this point, using the Proton instructions.
However after rebooting and having my new protonvpn vm automatically start up, I do now have an unconfigured Network Manager applet in the top menu bar, with an option to set up a vpn connection. Hoping not to completely botch up the process completely by messing up the settings in the applet, has anybody set this up successfully before and can they please point me in the right direction? many thanks

Try manually using the Proton client to connect the VPN, it should show the NM applet as connected with the lock/vpn icon.

I’m using ProtonVPN with the Debian 11 template, and I have a .desktop file for automatically connecting the VPN after the qube starts.

Thanks renehoj for your reply. Unfortunately I’m having trouble with that. Here are the instructions from Proton for the cli:

How to use the early-access version of Linux CLI

  1. Log in using your regular Proton/Proton VPN account details using the following command (please note that these are not the OpenVPN/IKEv2 login credentials used by the older community Linux client).

protonvpn-cli login [Proton VPN username]

You will be prompted to enter your password. If you don’t have a Proton VPN account you can sign up for one here.

The CLI will remember your login details between sessions.

  1. Open a list of Proton VPN servers with:

protonvpn-cli connect (or protonvpn-cli c)

  1. Select a server location and click OK . Select a server at that server location and click OK .

  2. Select udp or tcp (we recommend udp unless you have a reason to choose tcp).

A connection to the VPN server will now be established. To check your connection status, enter:

protonvpn-cli status (or protonvpn-cli s)

To disconnect, enter:

protonvpn-cli disconnect (or protonvpn-cli d)

Alternatively, you can disconnect using NetworkManager.

After setting (for example) my stock Untrusted vm to use the new Proton-cli vm as its NetworkConnection vm, I cannot connect through the vpn vm. I do believe, that I need to configure the vpn connection through the new NetworkManager applet at the top of the screen. But I’m not sure, what I need to enter in there. I have opened side by side the vpn vm configuration pages for my Mullvad and new Proton vpn vm’s and for my usually workiing Mullvad vpn Services vm, the configuration page from the applet has entries for Gateway, user name, password and CA certificate. I do have a Proton username and password that I can use, but nothing else. A search does find openvpn files in the proton-cli vm including the file openvpn-plugin-auth-pam.so in the usr/lib64/openvpn/plugins folder. But I don’t know if this is required with the configuration. I might be way off base there.

You don’t configure the connection using the NM applet, it’s just there to show you if you are connected. When connecting it will do the swirl animation and when connected it will get the lock icon showing you the vpn connection is active.

You need to install the ProtonVPN client, when you log in to the ProtonVPN client and select the server/country you want to use it with configure NetworkManager to use that server.

If you only want to use the NM applet you need to log into the ProtonVPN website and download the OpenVPN config file for the server you want to use, you can open that file in the applet.

The username and password you need to use for the VPN is listed in the same place you download the config file.

Aha… Thank you renehoj. I will follow that advice. Hopefully I’ll have everything up and running tomorrow and will report back on success. cheers

Still not crystal clear, I’m afraid. Decided that, as suggested, I would choose not to log into Proton via the applet and use the working vm instead with a client. I tried installing the protonvpn-cli client in one of my working vm’s - Debian Personal. I got as far as successfully entering my protonmail account password and a server, but it wouldn’t connect. So I rebooted to see if it would reset but lost the persistence of the installation and there was no proton in the Personal vm. Now I’m thinking, that I need to install protonvpn-cli in my debian-11 template, to have it persistent and available to all vm’s using that template. Am I now on the proper track? If so, could I be corrected in any errors in thinking for my plan below, if I only want to use the client in the vm to enable proton?

  • I can delete my previously made standalone vpn debian vm, into which I was trying to install protonvpn-cli.
  • Instead of trying to install protonvpn-cli in my working vm’s, I should be installing it directly into my debian-11 Template.
  • If the above are true, I will need to remove my mullvad-vpn Network vm from being the Network vm for my debian-11 Template. I should therefore use my default sys-firewall as the Network vm for my debian-11 Template.

I’ve been making a number of changes to my system on this and so far everything but the vpn still works. I’d like to keep it that way and not blunder into something, that I will have trouble fixing. cheers

This is how I made it work.

Make a debian 11 qube that provides network with autostart and has the network-manager service.

In the template, install the protonvpn client

You should now be able to test the vpn works by using the gui client.

If everything is working, you can make a logon script that uses the cli client to automatically connect the vpn at boot time.

Assign the vpn as netvm for the qubes you want to use the vpn.

1 Like

Finally got it thanks. Installed the Protonvpn in a new Fedora 36 vm and used the gui to get the vpn running. But I’m not a scripter (and too old at this stage to become adept at it). So for an auto-start script I borrowed Micah Lee’s Mullvad vpn startup script and used vim to change the autovpn.sh file’s mullvad_ca value to “Proton VPN CA#24” where 24 is a sample server number and the quotes were used due to the spaces in the default Proton config file. After doing the rest of his mods, everything now works great. ProtonVPN starts up on boot and if I then shut the vpn vm down and open another vm, which uses the Proton vm for networking, the Proton opens up automatically. Very happy. Thanks again

You can use protonvpn-cli c --cc CA, cc is country code and automatically selects the best server available for that country.

I use the cc option and very rarely get a server that is overloaded.

Thanks renehoj. I will definitely give that a try. cheers

thank you for the solution, renehoj.
if the logon script (for automatically connecting the vpn at boot time) is based on Micah Lee’s Mullvad VPN walkthrough, then the following modification is suggested for autovpn.sh:


if nmcli con | grep -Fq tun0


if nmcli con | grep -q proton0

I just add an ProtonVPNstart.desktop to ~/.config/autostart, which runs my connect script when the qube starts.

This is the script I use to connect, it picks a random EU country each restart



i=$(($RANDOM % $s))

/usr/bin/protonvpn-cli ks --off
/usr/bin/protonvpn-cli c --cc ${cc[$i]} -p udp

I tried using the nmcli client, but I couldn’t get it to work with the ProtonVPN client. If you use the protonvpn-cli client you can use the GUI client to switch server if you need it.

thank you for sharing the script
i tried adding the vpn autostart script to both /rw/config/ and /home/user/.config, but the app vm does not automatically run the script during boot.

there are no issues connecting to the vpn server after running the script manually in the vm’s terminal window
i am using a debian-11 app vm. below is the modified script (autovpn.sh) derived from Micah Lee’s writeup:

while [ "true" ]
	if nmcli con |grep -q proton0
		echo "Already connected, sleeping 5"
		sleep 5
		echo "Connecting"
		protonvpn-cli c --cc NL

which operating system are you using?
are you running the vpn service through an app vm or a standalone vm?

I’m using Debian 11 appVM.

protonvpn-cli needs access to the gnone keyring, which is why I use the autostart option, autorun runs the file after login when the desktop is ready.

I have got I working with rc.local, but you need to check when the dbus file is created, it was just easier to use autorun.

You just need to make a .desktop file in /home/user/.config/autorun, and this file can be used to execute your connect script.

1 Like

Having trouble getting protonvpn with the gui to run on debian 11. My Fedora based Protonvpn vm stopped working reliably for some reason, so I made a new app vm based of a debian 11 template, set it to provide networking to other app vms, network-manager, autostart and installed the Protonvpn debian 10+ app in the vm, as per Proton’s instructions. But there is no gui system tray icon and the Proton webpage says, “Please note that we don’t support the system tray icon on Debian 11 because the package gir1.2-appindicator3-0.1 has been deprecated and is not present on Debian 11”. How do I start the protonvpn app gui, after a fresh reboot of the computer. The vpn networking widget in the tray shows an unconfigured vpn listing, but clicking on that shows a grayed-out listing. I was using the cli client with fedora before, but I’d like to use the gui client if possible.

I can start the GUI client from the terminal and start menu.

The tray icon also doesn’t work for me, but the network manager icon will show if the VPN is connected, with the lock icon.

Do you get an error if you run the protonvpn command from the command line?

I’m confused on this renehoj. It was a while since I set up the previous cli proton instance and I’m a little fuzzy on the commands. For this new debian 11 instance, I installed the client on the ProtonVPN-debian11 vm and then installed the files as per Proton’s instructions into that vm. Now I am trying to start the protonvpn session directly in that vm also. But I’m not sure of the exact command to enter in Terminal. Entering anything “protonvpn” yields the result protonvpn command not recognized. Was I supposed to install the client in each and every vm, which will be using the ProtonVPN-debian11 vm for their networking instead of in the proton vm? I tried entering “protonvpn login” in the terminals of both the protonvpn vm and also a vm using protonvpn for its networking.

The command protonvpn should start the GUI client.

Did you run the command sudo apt install protonvpn?

The deb package you downloaded from the proton website only installs the repository needed to install the VPN client, it doesn’t install the client itself.

You don’t need to install the client in all VMs, you only need to install it in one VM, and that VM will be the netVM for the qubes that need to use the VPN.

Aha. Maybe that’s where I went wrong. After sudo apt–get install didn’t do anything, I just used sudo dpkg -i filename, so I guess, that I just installed the repo. Wait… no go I’m afraid. sudo apt install protonvpn yields “Unable to locate package protonvpn”.