PrivadoVPN on Arch Linux

  2025/06/16

Posted Tag: #Linux
Other Tags: #Windows, #Personal, #All

I have an account with PrivadoVPN and, although the do not have an application for Linux in general, they do have instructions as to how to setup a server connection on Linux. Typical of me I wanted more. So here it is an application of sorts that lets you pick which of their server connections you want at a point in time. But first how do you setup an IKEv2 IPSEC VPN connection on Arch Linux. This should work on any other distribution of Linux since IPSEC is a part of Linux. I just adapted for Arch Linux

Type sudo su in bash to gain root access. Below are is the setup method I use:

cd /

pacman -S strongswan

sed -i 's/load = yes/load = no/g' /etc/strongswan.d/charon/constraints.conf

printf '%s' 'your username' : EAP ' 'your password' >> /etc/ipsec.secrets && mv /etc/ipsec.d/cacerts /etc/ipsec.d/cacerts_old && ln -s /etc/ssl/certs /etc/ipsec.d/cacerts

exit

The next thing you need are the various server connections for PrivaroVPN. Go to Support, PrivadoVPN Setup Guides and under that See All. Then choose Manual Setup. Go down to Linux IKEv2 Manual Setup. They give the setup for Debian-based distributions, which I adapted for Arch Linux. What you really want on this page is the connection listing at https://app.privado.live/en/server-list. You will need your username and password to do this. I usually highlight all of the server connection information and then copy it all pasting it into a spreadsheet like Calc with LibreOffice. You also get the number of server nodes at each IP address. I usually pick the one with the most server nodes for my purposes. I pick about six or so in my country and use them. What you need is the entry ending with vpn.privado.io. Place it in a structure like the below:

conn dca
        keyexchange=ike
        dpdaction=clear
        dpddelay=300s
        eap_identity=username
        leftauth=eap-mschapv2
        left=%defaultroute
        leftsourceip=%config
        right=xxx-###.vpn.privado.io
        rightid=vpn.privado.io
        rightauth=pubkey
        rightsubnet=0.0.0.0/0
        rightid= %any
        type=tunnel
        auto=add

The conn is the connection name, which here is Washington DC , I use to later to identify the connection. The other things needed are username and the server node at this location you want to use. I end up doing is the below to update the file ipsec.conf.

sudo su

cd /

cat <<EOF >> /etc/ipsec.conf

conn dca
        keyexchange=ike
        dpdaction=clear
        dpddelay=300s
        eap_identity=username
        leftauth=eap-mschapv2
        left=%defaultroute
        leftsourceip=%config
        right=xxx-###.vpn.privado.io
        rightid=vpn.privado.io
        rightauth=pubkey
        rightsubnet=0.0.0.0/0
        rightid= %any
        type=tunnel
        auto=add

EOF

exit

sudo ipsec restart

This is just one connection but I use one long cat to set nine entries for my purposes. Below is my bash script I use to automate this making it my own little application for PrivadoVPN on Arch Linux.

#!/bin/bash

items=(Amsterdam Atlanta Chicago Dallas Los_Angeles Miami New_York San_Francisco Washington_DC)
options=()
for item in ${items[@]}; do
  options+=("${item}" "")
done

while true; do
  config=$(whiptail --title "Select an VPN Server:" --menu "" 15 40 6 "${options[@]}" 3>&1 1>&2 2>&3)
  if [ "$?" = "0" ]; then
    case $config in
      Amsterdam)
        server="ams"
      ;;
      Atlanta)
        server="atl"
      ;;
      Chicago)
        server="ord"
      ;;
      Dallas)
        server="dfw"
      ;;
      Los_Angeles)
        server="lax"
      ;;
      Miami)
        server="mia"
      ;;
      New_York)
        server="jfk"
      ;;
      San_Francisco)
        server="sfo"
      ;;
      Washington_DC)
        server="dca"
      ;;
    esac
    break
  else
    clear
    whiptail --backtitle --msgbox  "  A server entry is required. Please try Again...?" 8 55               
  fi
done

sudo ipsec restart
echo "Enabling $config!"
sleep 5
sudo ipsec up $server

docker-compose -f ~/bin/docker/docker-compose.yml up -d
read -n1 -p 'Press any key to disable docker containers and the vpn...'
docker-compose -f ~/bin/docker/docker-compose.yml down

sudo ipsec down $server

echo ""
read -n1 -p 'The VPN is down, press any key to continue...'
exit 1

To start an connection manually type sudo ipsec up dca and sudo ipsec down dca when you want to disconnect.

I have Amsterdam listed because it is in Europe, which sometimes is faster believe it or not . Yes I run a docker-compose file while the VPN is running. That is a whole other subject to write about.

As a bonus, when connected to the VPN go here to verify your DNS.

Wish to add a comment? Your email address will never be shared with anyone.

Email me a comment to post it.