Is Horizon VPN useful for developers?

Yes. It adds privacy when using repositories, dashboards, docs, package mirrors, and remote systems.

Can I use it on Ubuntu?

Use the latest download instructions for currently supported Linux distributions and setup methods.

Does Linux VPN protect terminal traffic?

When connected at the network level, traffic from terminal tools follows the protected route unless excluded.

🐧HORIZONVPN FOR LINUX

Native WireGuard,
zero compromise,
all distros.

HorizonVPN on Linux uses the native WireGuard kernel module — no userspace wrappers, no DKMS patches. Integrates with NetworkManager, supports headless servers via systemd, and enforces a bulletproof iptables kill switch.

94 Mbps

Avg download speed

Kernel 5.6+

WireGuard native

systemd

Auto-start service

View install guide Download .deb / .rpm / AUR ↗

UbuntuDebianFedoraArchopenSUSECLI + GUI

DISTRO SUPPORT

One VPN, every distribution

Native packages for APT, DNF, Zypper, and AUR. Install in under 60 seconds.

Ubuntu

24.04 LTS

✓

Debian

12 Bookworm

✓

Fedora

39 / 40

✓

Arch Linux

Rolling

✓

openSUSE

Tumbleweed

✓

Manjaro

Rolling

✓

RHEL

9 / CentOS

✓

Mint

21.x

✓

Pop!_OS

22.04

✓

Elementary

7 Horus

✓

INSTALLATION

Up and running in under 60 seconds

HorizonVPN ships native packages for every major package manager. No manual compilation, no broken dependencies. One command installs the CLI, the daemon, and the NetworkManager plugin.

1

Add repository

Add the HorizonVPN signed package repository to your system.

2

Install package

apt/dnf/pacman handles all WireGuard dependencies automatically.

3

Connect

Run horizonvpn connect from any terminal or use the GUI.

Ubuntu · Debian · Mint · Pop!_OS

# Add HorizonVPN repository key

$curl -fsSL https://pkg.horizonvpn.org/gpg | sudo gpg \

·  --dearmor -o /usr/share/keyrings/horizonvpn.gpg

$echo "deb [signed-by=/usr/share/keyrings/horizonvpn.gpg] \

·  https://pkg.horizonvpn.org/apt stable main" | \

·  sudo tee /etc/apt/sources.list.d/horizonvpn.list

$sudo apt update && sudo apt install horizonvpn

# Connect

$horizonvpn connect --country netherlands

  ✓ Connected — Amsterdam · 12ms · WireGuard

Built for the Linux way of doing things

No Electron app, no browser extension required. A real daemon, a real CLI, real kernel integration.

⚡

Native WireGuard kernel module

Uses the WireGuard module built into Linux 5.6+. No DKMS patches, no userspace fallback — pure kernel-speed encryption.

🔒

iptables kill switch

DROP rules block all non-VPN traffic the moment the tunnel drops. IPv6 leaks blocked by default. Rules removed cleanly on disconnect.

🌐

NetworkManager integration

Connections appear as native WireGuard interfaces in nmtui and nmcli. DNS push handled automatically via resolv.conf or systemd-resolved.

🖥️

Headless server mode

Run on a VPS, NAS, or Raspberry Pi with no desktop required. Configure once, runs as a systemd service that auto-connects after reboot.

🔀

Split tunneling via cgroups

Route specific processes through the VPN while others use your direct connection. Works at the process level using Linux cgroups v2.

🔐

DNS over TLS

All DNS queries encrypted via DoT. Works with systemd-resolved and dnsmasq. No plain-text DNS leaks regardless of tunnel state.

/etc/systemd/system/horizonvpn.service

[Unit]

Description=HorizonVPN Daemon

After=network.target

[Service]

ExecStart=/usr/bin/horizonvpnd

Restart=on-failure

RestartSec=5s

[Install]

WantedBy=multi-user.target

$ sudo systemctl enable --now horizonvpn

 Created symlink /etc/systemd/system/multi-user.target.wants/horizonvpn.service

 ✓ Service enabled and started

HEADLESS MODE

A real systemd service, not a background process

HorizonVPN's daemon integrates with systemd like any other Linux service — not a hacky background app. Enable it once and the VPN auto-connects on boot, survives reboots, and restarts automatically if the process crashes.

✓Survives reboots — reconnects on boot automatically

✓Journald logging — journalctl -u horizonvpn for full logs

✓cgroup memory limits respected on constrained servers

✓Works over SSH — no display server needed

System requirements

Kernel5.6+ (WireGuard built-in)

Architecturex86_64, ARM64, ARMv7

init systemsystemd (v232+)

DNSsystemd-resolved or resolveconf

NetworkNetworkManager 1.26+ (optional)

RAM64 MB daemon footprint

What's included

🖥️

CLI tool

horizonvpn connect / disconnect / status / list — full scripting support

🖼️

GTK GUI

Optional desktop app for GNOME, KDE, and XFCE — or skip it entirely

🌐

NM plugin

NetworkManager plugin so connections show up in nmtui and nmcli

🛡️

Kill switch

Automatic iptables/nftables rules — can't be accidentally bypassed

Frequently asked questions

Do I need to be root to run HorizonVPN on Linux?

Only for the initial connection setup. Once the WireGuard interface and iptables kill switch rules are configured, the daemon runs as a system service under its own user. You connect and disconnect as a regular user after that.

Does it work with NetworkManager?

Yes. HorizonVPN integrates with NetworkManager via the WireGuard plugin. Connections appear as standard WireGuard tunnels in nmtui and nmcli, and DNS push is handled automatically via systemd-resolved.

Can I run HorizonVPN on a headless server?

Absolutely. The CLI works perfectly on headless servers with no X11 or Wayland. Configure once and run as a systemd service for persistent connections that survive reboots.

Which kernel version do I need?

WireGuard is included in the mainline Linux kernel since version 5.6 (March 2020). Ubuntu 20.04+, Debian 11+, Fedora 32+, and current Arch all have it. Older kernels can use the DKMS module as a fallback.

Does the kill switch work reliably on Linux?

Yes — via iptables/nftables DROP rules that block all non-VPN traffic the instant the tunnel drops. IPv6 leaks are blocked by default. Rules are removed cleanly when you disconnect intentionally.

Is split tunneling available?

Yes, via Linux cgroups v2. You can route specific applications or entire systemd slices through the VPN while others use your direct connection. Requires kernel 5.10+ for full cgroups v2 support.

🐧

The fastest VPN on Linux.
By a long way.

Native WireGuard kernel module. iptables kill switch. systemd integration. No Electron, no bloat. Just a clean Linux citizen that does one thing excellently.

View install guide ← Back to hub

Related guides