AdGuard VPN CLI for Linux: 7 Essential Setup Checks

AdGuard VPN CLI is the official command-line client for using AdGuard VPN on Linux. Install the release build, sign in through your browser, choose a location, and verify which traffic actually uses the tunnel. The important choice is between TUN mode for eligible system traffic and SOCKS5 mode for applications you configure individually.

This guide covers AdGuard VPN for Linux, including installation, DNS, exclusions, troubleshooting, and removal. It does not install AdGuard Ad Blocker or turn a DNS filter into a VPN. You will finish with a connection you can check and a clear way back if networking misbehaves.

Option	Traffic scope	First check
VPN in TUN mode	Traffic selected by system routes	Routes, DNS and exclusions
VPN in SOCKS5 mode	Apps configured for the proxy	App proxy and DNS settings
AdGuard Ad Blocker	Content filtering	Separate app and setup

Key Takeaways

• Start with the official release installer and a recoverable machine state.
• A connected status is useful evidence, but it does not prove every application is covered.
• General and Selective exclusions do opposite jobs; check the mode before adding a domain.
• The two AdGuard Linux clients need a compatible routing arrangement when used together.
• Test reconnection and failure behaviour before depending on the setup for sensitive work.

Affiliate disclosure: I may earn a commission if you buy through the AdGuard VPN link below, at no extra cost to you. Try the available free allowance before paying; a subscription does not fix a routing mistake.

Save 80% on a 2-year AdGuard VPN subscription.
Exclusive HackersGhost discount code HACKERSGHOST80 (applies automatically — AdGuard may occasionally run separate public promotions with similar pricing).

1. Prepare Linux before installing the VPN

Prepare AdGuard VPN CLI on a computer you control, with an ordinary working internet connection. If you are connected to a remote server over SSH, changing routes can disconnect your administration session. Use a local console or an established recovery channel for your first setup. Do not experiment on a production machine merely because the installer is short.

AdGuard’s Linux product page names Debian, Ubuntu, Elementary OS, Linux Mint, and RPM-based devices. Treat that as a starting point, then check your exact release and architecture against current vendor information. A familiar distribution name does not establish compatibility with every container, kernel, firewall, or customised desktop.

For Kali Linux or Parrot OS, evaluate AdGuard VPN CLI in a recoverable test environment first. Their Debian ancestry is useful context, but it is not an individual vendor support guarantee. Keep VPN experiments separate from a security-testing VM whose routing you already rely on.

cat /etc/os-release
uname -m
ip route

These read-only commands show your distribution, processor architecture, and IPv4 routes. Save the relevant information privately. On systems using systemd-resolved, resolvectl status can also describe resolver configuration; its absence does not mean DNS is broken.

Before installing AdGuard VPN CLI, pause other optional device VPNs for a clean baseline and note whether your router already provides a tunnel. Take a VM snapshot or a suitable workstation backup. Write down how you will restore the earlier configuration, rather than waiting until the browser stops loading.

2. Install AdGuard VPN CLI from the official source

Use the release channel for your first installation. Beta and nightly builds serve a different purpose and make a poor starting point for diagnosing an unfamiliar network. AdGuard publishes its issue tracker and release-verification instructions on GitHub; navigate to AdguardTeam/AdGuardVPNCLI to find them. The client itself is not open source.

AdGuard VPN CLI has a vendor-published download-and-run installer. The version below separates those actions so you can inspect the script before execution. It uses the same official release script URL, without silently piping a network response straight into a shell.

curl -fsSL https://raw.githubusercontent.com/AdguardTeam/AdGuardVPNCLI/master/scripts/release/install.sh -o adguardvpn-install.sh
less adguardvpn-install.sh
sh adguardvpn-install.sh -v

Run these lines individually. The first downloads a script into your current directory, the second opens it for inspection, and the third executes it. Press q to leave less. If downloading fails, stop; do not execute an unrelated file with the same name. Install missing tools through your distribution’s normal package manager.

Reading a script does not prove its safety, but it gives you a chance to confirm its origin and understand the changes. The installer may request administrator privileges. AdGuard documents an optional link in /usr/local/bin; accepting it lets you run the client by name.

After installation, check that AdGuard VPN CLI is available and inspect its own help. This is a useful checkpoint before authentication or routing changes. If the command cannot be found, inspect the installer’s output and chosen installation path instead of repeatedly installing another copy.

adguardvpn-cli --version
adguardvpn-cli --help

AdGuard also documents GPG verification of release signatures in its official repository. For a higher-assurance installation, follow that process and verify the signing-key fingerprint against the official instructions. A signature check and an installer review answer different questions; neither replaces checking where the software came from.

3. Sign in and make one controlled connection

AdGuard VPN CLI uses a web-based sign-in flow. Avoid old tutorials that tell you to pass an account password directly as a command-line argument. Start the login command, follow the terminal menu, and complete authentication on the genuine AdGuard account page.

adguardvpn-cli login
adguardvpn-cli license
adguardvpn-cli list-locations

Use the AdGuard VPN CLI login menu’s browser option when offered. Wait for the terminal to confirm authentication before continuing. The license command displays account and subscription information, so do not include its unredacted output in a public screenshot. The locations command shows what is currently available to your account.

For the first AdGuard VPN CLI connection, choose the ordinary quick-connect path. If you need a particular country or city, use a location returned by the client rather than a server identifier copied from an old article.

adguardvpn-cli connect
adguardvpn-cli status

To choose a location explicitly, the documented syntax is adguardvpn-cli connect -l <location>. Replace the placeholder with a listed city, country, or ISO code; quote a name containing spaces. Do not type the angle brackets literally.

Check the status, then open an ordinary HTTPS page. If the connection works, record the location and current configuration before changing anything else. If it fails, keep the error message and move to the troubleshooting section. Multiple simultaneous configuration changes make a small problem much harder to explain.

AdGuard VPN CLI should be assessed against your actual needs: ordinary browsing, a particular application, or a controlled workstation workflow. A different exit country does not remove account identifiers, browser fingerprints, cookies, or the need for secure software.

4. Choose TUN or SOCKS5 deliberately

AdGuard VPN CLI offers two traffic-handling approaches. TUN uses a virtual network interface and routing rules. SOCKS5 provides a local proxy that applications must use explicitly. For a beginner expecting ordinary system traffic to use the VPN, the distinction matters more than the terminal’s colour scheme.

In TUN mode, administrator rights are required. Start with the vendor’s automatic routing option rather than a custom route script. Exclusions and local routes still affect coverage, so “system-wide” should never be read as a promise that every possible packet has been observed and verified.

adguardvpn-cli config show
adguardvpn-cli config set-mode TUN
adguardvpn-cli config set-tun-routing-mode AUTO

Review the AdGuard VPN CLI configuration before and after changing it. Reconnect when required by the client, then repeat the same browsing and connection checks. Avoid NONE or SCRIPT routing modes unless you understand and maintain the resulting routes yourself.

In SOCKS5 mode, AdGuard VPN CLI normally listens locally at 127.0.0.1:1080. Only applications configured for that proxy use it. An unrelated browser, package manager, or background application can continue using the ordinary connection.

SOCKS5 also requires attention to hostname resolution: the application must send DNS resolution through the proxy when that is your intention. A proxy checkbox alone does not establish that behaviour. Keep the listener on localhost for a personal setup; exposing a proxy to other devices creates additional access-control responsibilities.

AdGuard’s set-change-system-dns setting matters for TUN configurations. Turning it off can allow system DNS to bypass the tunnel. In SOCKS5 mode, the client’s system-DNS settings do not take over application DNS behaviour. Start with a simple baseline and inspect the actual result before adding a custom resolver.

5. Verify IP, DNS, exclusions, and recovery

A useful AdGuard VPN CLI check compares the same application before and after connection. Note the public IPv4 address, any public IPv6 connectivity, DNS resolver results, and the client status. Use a reputable test service you trust, and keep the conditions consistent between measurements.

A changed public address supports a narrow conclusion: that test request used a different exit path. It does not prove all applications are covered. Likewise, an unfamiliar DNS resolver name is a clue to investigate, not automatic proof of a leak or compromise.

Use the DNS and WebRTC leak-checking guide for a more careful interpretation of browser results.

DNS Leak Test: 7 Smart DNS and WebRTC Checks

Inspect AdGuard VPN CLI exclusions before relying on your test. In General mode, listed domains bypass the VPN; in Selective mode, only listed domains use it. Each mode has its own list, so changing modes can change your protection boundary without changing the domain you are testing.

adguardvpn-cli site-exclusions mode
adguardvpn-cli site-exclusions show

For a temporary domain exception, first confirm the current mode. The documented add/remove pattern below uses a reserved example domain. It illustrates syntax; it is not a recommendation to exempt a banking, email, or administration service.

adguardvpn-cli site-exclusions add example.com
adguardvpn-cli site-exclusions show
adguardvpn-cli site-exclusions remove example.com

Do not use AdGuard VPN CLI in Selective mode when your intention is broad coverage with a few exceptions. Check important apps after any exclusion change. A website may contact several domains, and a successful page load alone does not explain every connection it made.

Finally, test AdGuard VPN CLI after a brief Wi-Fi interruption, reconnect, sleep, and reboot where practical. Keep sensitive activity closed during these checks. Record whether the client reconnects and whether ordinary traffic remains possible while it is disconnected.

Do not assume a kill switch exists or is enabled because another AdGuard platform has one. This guide does not establish a verified Linux fail-closed guarantee. If preventing all direct traffic is a requirement, obtain version-specific confirmation and test failure behaviour in a controlled environment before depending on it.

6. Combine the VPN and ad blocker without a routing loop

AdGuard VPN CLI and AdGuard Ad Blocker for Linux are separate applications. VPN routing changes the network path; content filtering addresses ads and trackers. Installing the VPN does not automatically install the ad blocker, and choosing a filtering resolver is another separate decision.

AdGuard documents a specific conflict: VPN tunnel mode combined with the Linux ad blocker’s automatic proxy mode can create a routing loop. This is not something to fix by adding random firewall exceptions until a website loads.

The documented alternatives are an ad blocker in manual proxy mode with the VPN tunnel, or the VPN in SOCKS5 mode with the ad blocker configured to use that outbound proxy. The second arrangement also requires the appropriate skip_outbound_proxy treatment for the VPN process to avoid looping its own traffic.

For a first AdGuard VPN CLI setup, get the VPN working alone and save that baseline. Add the ad blocker only after choosing one documented integration route. Test the application you actually use, including DNS and connection recovery; do not assume an integration covers software that bypasses its proxy.

The separate AdGuard for Linux installation guide covers the filtering application. AdGuard’s wider product family is also described on the AdGuard website.

AdGuard for Linux: 7 Safe Ad Blocker Setup Tips

HackersGhost Note: My lab includes Kali and Parrot in VMware, but I have not completed a documented AdGuard VPN CLI test there. Treat these steps as a documentation-based setup workflow, then verify your own distribution and traffic path before relying on them.

7. Troubleshoot, update, and keep a way back

When AdGuard VPN CLI fails, identify the stage first: installation, login, tunnel creation, name resolution, or an individual website. Check ordinary connectivity with the optional VPN disconnected, then change one relevant setting and repeat the same test.

• Command missing: inspect the installation path and command link. Do not fetch a lookalike package from a search advert.
• Login incomplete: finish the browser flow and check the terminal confirmation. Keep authentication URLs private.
• Tunnel fails: capture the error, check privileges, and investigate TUN availability on your system. Containers need particular care.
• Connected but pages fail: inspect routes, resolver settings, exclusions, and any second VPN or filtering proxy.
• One service rejects the connection: compare locations and check whether the service accepts VPN traffic. Do not broaden exclusions blindly.

For AdGuard VPN CLI maintenance, check for updates through the client. Use the release channel unless you deliberately need a test build. Schedule updates when you can tolerate a dropped connection, and repeat your baseline checks afterwards.

adguardvpn-cli check-update
adguardvpn-cli update

To collect AdGuard VPN CLI support evidence, note your distribution, architecture, client version, mode, and reproducible steps. AdGuard VPN CLI includes log export; inspect its help and review the archive before sharing. Account details, addresses, and network information belong in a private support exchange, not a public paste.

If you need to undo the experiment, disconnect first. Log out when you also want to remove the active account session, then follow the official removal procedure. For the release script you downloaded and inspected earlier, the vendor’s uninstall option is -u.

adguardvpn-cli disconnect
adguardvpn-cli logout
sh adguardvpn-install.sh -v -u

Use that final line only if the file is still the genuine script you downloaded; otherwise obtain and inspect a fresh official copy. After removal, check ordinary browsing, DNS, and any application proxy settings you changed manually. Restore your earlier settings or snapshot if necessary.

Free allowance or subscription: test the setup first

AdGuard currently advertises a free monthly allowance of 3 GB, with restrictions compared with Unlimited. It can help you check whether your Linux workflow behaves sensibly before you subscribe. Verify the current account limits rather than assuming every location or feature is available.

Judge AdGuard VPN CLI on reliable operation for your own applications. A paid plan may suit heavier use, but do not buy it to solve an unexplained DNS problem. Check renewal terms, device limits, and the actual checkout total, including whether the HackersGhost discount has been applied.

Conclusion: verify one clear traffic path

AdGuard VPN CLI is a practical Linux option when you are comfortable managing a connection from the terminal. Start with the release build, authenticate, choose the right mode, and check what happens to real application traffic. Add exceptions or another filtering layer only after that baseline works.

Your first action is simple: record your current network settings and prepare a recovery point. Then install AdGuard VPN CLI and verify one application before expanding the setup. Keep the configuration you can explain; a pile of unchecked privacy switches is still a pile of unchecked switches.

Save 80% on a 2-year AdGuard VPN subscription.
Exclusive HackersGhost discount code HACKERSGHOST80 (applies automatically — AdGuard may occasionally run separate public promotions with similar pricing).

AdGuard VPN CLI FAQ