SandVPN Comes to Linux: a Real CLI VPN, Installed with apt

Linux users have always been an afterthought for VPN providers: a config file to download, a wiki page, good luck. Today that changes for SandVPN. Our Linux client is out — and it was built the way Linux software should be: a clean CLI, a systemd daemon, a signed APT repository, and updates that arrive with your regular apt upgrade.

Install it in one line

curl -fsSL https://sandvpn.com/install.sh | sh

The script detects your distribution: on Debian, Ubuntu or Mint it configures our GPG-signed repository and installs the package; on any other systemd distribution it falls back to a tarball. Prefer to type the three apt commands yourself? They are on the Linux download page, along with a full command reference.

Built for the terminal

sandvpn login [email protected]
sandvpn connect paris --killswitch
sandvpn status
sandvpn disconnect

The CLI runs as your normal user; the privileged work — tunnels, routes, firewall — lives in a small systemd daemon the CLI talks to over a Unix socket. Connecting from a remote machine over SSH? sandvpn connect paris --bypass <your-ip> keeps your session outside the tunnel so it never drops.

The part most VPN CLIs don't have

Alongside WireGuard, SandVPN ships Xray with VLESS and Reality — a censorship-resistant transport whose handshake passes deep packet inspection that blocks classic VPN protocols. It is the same engine our Windows and Android users rely on in Russia and other restrictive networks, now one command away on Linux.

A real kill switch, the Linux way

--killswitch installs nftables rules that drop every packet outside the tunnel — IPv6 included, so nothing leaks around an IPv4 tunnel. The rules live in a dedicated table that the daemon removes cleanly on disconnect and sweeps at startup, so even a crash can never leave your machine locked out.

Updates you never think about

The repository is signed with our GPG key and apt verifies every package before installing it. When we ship a fix, you get it with the rest of your system updates — no downloads page to remember.

Prefer a graphical app?

The desktop app — same account, same tunnels, same kill switch — installs from the same repository with sudo apt install sandvpn-desktop, or as a portable AppImage for any distribution.

Get started

Everything is on the SandVPN for Linux page: the one-line installer, the manual instructions, and the command reference. Free servers are available without a card, and your existing SandVPN account works as-is — one subscription covers Linux, Windows, Android and the browser extensions.