How to Install NordVPN on an Ubuntu VPS (2026)

Running a VPN on a VPS isn't just for privacy — it's useful for securing outbound traffic, routing through a different exit node for region-sensitive services, and building private networks between servers using NordVPN's Meshnet feature. This guide covers installing NordVPN on an Ubuntu 22.04 server, configuring it for headless operation, enabling the kill switch safely, and optionally setting up Meshnet for private server-to-server networking.

Prerequisites

• An Ubuntu 22.04 LTS VPS with sudo access (connected via SSH)
• A NordVPN account — get one here if you don't have one yet
• Basic familiarity with the Linux command line

This guide is written for Ubuntu 22.04. The same steps work on Ubuntu 20.04 and 24.04, and with minor adjustments (replacing apt with yum or dnf) on Debian, Fedora, RHEL, and CentOS.

Step 1: Install NordVPN

NordVPN provides an official installation script that adds the signed package repository and installs the client automatically.

1curl -sSf https://downloads.nordcdn.com/apps/linux/install.sh | sh

The script detects your distribution and configures the correct apt repository. If you prefer to add the repository manually:

1wget -qO - https://repo.nordvpn.com/gpg/nordvpn_public.asc | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/nordvpn.gpg > /dev/null
2echo "deb https://repo.nordvpn.com/deb/nordvpn/debian stable main" | sudo tee /etc/apt/sources.list.d/nordvpn.list
3sudo apt update && sudo apt install nordvpn

After installation, add your current user to the nordvpn group. This is required — the nordvpn CLI will return permission errors if you skip it.

1sudo usermod -aG nordvpn $USER

Log out and back in (or start a new SSH session) for the group membership to take effect. Verify with:

1groups $USER

You should see nordvpn in the output.

Step 2: Log In

Authentication on a headless server works through a URL-based flow. Run:

1nordvpn login

NordVPN will print a login URL. Copy the URL, open it on your local machine (laptop, desktop — anywhere with a browser), complete the authentication, and the server session will be linked to your account. You don't need a display or browser on the VPS itself.

Verify the login succeeded:

1nordvpn account

This should print your account email address and subscription status.

Step 3: Set NordLynx as the Protocol

NordLynx is NordVPN's WireGuard implementation. It's significantly more efficient than OpenVPN in terms of CPU overhead and latency, which matters on a VPS where you're paying for compute resources.

1nordvpn set technology nordlynx

NordLynx becomes the active protocol for all subsequent connections. If you're on a network that restricts WireGuard traffic (some corporate environments or restrictive hosting providers), switch to OpenVPN:

1nordvpn set technology openvpn
2nordvpn set protocol tcp   # TCP over port 443 is hardest to block

Step 4: Allowlist SSH Before Enabling the Kill Switch

This step must happen before you enable the kill switch. If you enable the kill switch first and the VPN drops, the kill switch blocks all traffic — including your SSH connection — and you lose access to the server.

Allowlist your SSH port so it remains accessible even when the kill switch fires:

1nordvpn whitelist add port 22

If you use a non-standard SSH port, substitute accordingly:

1nordvpn whitelist add port 2222   # example for port 2222

Confirm the allowlist:

1nordvpn settings

Look for Whitelisted ports in the output. Verify your SSH port is listed before proceeding.

Step 5: Enable the Kill Switch

With the SSH port allowlisted, enable the kill switch:

1nordvpn set killswitch on

The kill switch blocks all network traffic if the VPN tunnel drops unexpectedly. For servers that should only communicate through the VPN — for security, anonymity, or to prevent routing sensitive traffic outside the tunnel — the kill switch is essential. With the SSH port allowlisted, you retain SSH access even during a VPN interruption.

Step 6: Connect and Verify

Connect to the fastest available server:

1nordvpn connect

Or connect to a specific country:

1nordvpn connect US      # United States
2nordvpn connect GB      # United Kingdom
3nordvpn connect DE      # Germany

Or a specific server by name:

1nordvpn connect us8921

Check the connection status:

1nordvpn status

Verify that your outbound IP has changed:

1curl ifconfig.me

The IP returned should be a NordVPN server address, not your VPS's original IP.

Step 7: Enable Auto-Connect on Boot

If you want NordVPN to connect automatically when the server reboots:

1nordvpn set autoconnect on

To connect to a specific country automatically:

1nordvpn set autoconnect on US

Verify:

1nordvpn settings

Auto-connect should show as enabled.

Step 8: Configure Meshnet (Optional)

Meshnet creates an encrypted private network between your NordVPN-connected devices. Use cases: connect a home workstation to a VPS without exposing ports, link two VPS nodes on a private channel, or access self-hosted services securely without a public IP.

Enable Meshnet:

1nordvpn set meshnet on

List devices in your Meshnet:

1nordvpn meshnet peer list

Devices appear with a 100.64.x.x Meshnet IP address. You can SSH, rsync, or use any TCP service between Meshnet devices using these addresses, without either device exposing a public port.

To allow a Meshnet peer to route its traffic through your VPS (using your VPS as an exit node for other devices on your Meshnet):

1nordvpn meshnet peer routing allow <peer-name>

Troubleshooting

Permission denied when running nordvpn commands. You're not in the nordvpn group yet. Run sudo usermod -aG nordvpn $USER and start a new SSH session.

Login URL doesn't open / authentication doesn't complete. The URL must be opened in a browser — copy it from the terminal output, paste it on your local machine. If the URL expires, run nordvpn login again.

Lost SSH access after enabling kill switch. If you forgot to allowlist your SSH port before enabling the kill switch and lost access, you'll need to use your VPS provider's emergency console (available in DigitalOcean, Contabo, and most providers' dashboards) to run nordvpn set killswitch off or nordvpn disconnect, then re-establish SSH and add the allowlist before re-enabling.

VPN connects but traffic still shows original IP. Check nordvpn status — if it shows Connected but the IP isn't changing, verify the technology is set to NordLynx with nordvpn settings. Try disconnecting and reconnecting.

Meshnet peers not appearing. Both devices must have Meshnet enabled (nordvpn set meshnet on) and be logged into the same NordVPN account. Run nordvpn meshnet peer list on each device and confirm they see each other.

Next Steps

With NordVPN installed and configured, you have a reliable encrypted outbound path, a kill switch for traffic protection, and optionally a private Meshnet network between your servers. For a full breakdown of NordVPN's Linux features, pricing tiers, and how it compares to alternatives, see the NordVPN Linux VPS review.