Nym VPN CLI

This is a short guide to setting up and using the nym-vpnc tool, which is used in conjunction with the nym-vpnd daemon.

Download and run instructions for the GUIs can be found here (opens in a new tab).

Download & Extract Binary

Check the release page (opens in a new tab) page for the latest release version and modify the instructions accordingly. These instructions use the latest as of the time of writing.

wget -q https://github.com/nymtech/nym-vpn-client/releases/download/nym-vpn-core-v1.27.0-beta/nym-vpn-core-v1.27.0-beta_<YOUR_OPERATING_SYSTEM>.tar.gz &&
tar -xzf nym-vpn-core-v1.27.0-beta_<YOUR_OPERATING_SYSTEM>.tar.gz &&
cd nym-vpn-core-v1.27.0-beta_<YOUR_OPERATING_SYSTEM>/ &&
chmod u+x *

Linux ARM64 (.deb)

ARM64 .deb packages are available for Linux distributions that support them (e.g. Ubuntu/Debian on Raspberry Pi or ARM servers). Install both the daemon and the client:

sudo dpkg -i nym-vpnd_<VERSION>_arm64.deb
sudo dpkg -i nym-vpnc_<VERSION>_arm64.deb

The .deb package installs a systemd service that starts nym-vpnd automatically. Verify the service is running:

service nym-vpnd status

You should see output similar to:

● nym-vpnd.service - nym-vpnd daemon
     Loaded: loaded (/usr/lib/systemd/system/nym-vpnd.service; enabled; preset: enabled)
     Active: active (running)

Verify the installed version with nym-vpnc info:

nym-vpnc info

nym-vpnd:
  version: 1.25.0
  build_timestamp (utc): 2026-03-02 16:25:31.229479864 +00:00:00
  triple: aarch64-unknown-linux-gnu
  platform: Ubuntu; Linux (Ubuntu 24.04); aarch64
  git_commit: fce7a84e612b8d2cb48b66695cdaf023d7f9a42b

Build from Source

Prerequisites

All operating systems require both Rust (opens in a new tab) and Go (opens in a new tab).

Arch specific packages:

yay -S gcc make protobuf base-devel clang

Ubuntu24 specific packages:

apt install gcc make protobuf-compiler pkconfig libdbus-1-dev build-essential clang

Clone & make

git clone https://github.com/nymtech/nym-vpn-client.git
cd nym-vpn-client/
make

Start the Daemon

If you installed via .deb packages, the daemon is already running as a systemd service. You can check its status with:

service nym-vpnd status

If you are running from pre-built binaries or a source build, start the daemon manually:

sudo ./PATH/TO/nym-vpnd

Account Setup

Create an Account

Head to https://nym.com/account/create (opens in a new tab) and obtain a passphrase (mnemonic).

Log In

Store your account passphrase on this device:

nym-vpnc account set "<YOUR_PASSPHRASE>"

Check Account Status

Verify that the device is logged in and view account details:

nym-vpnc account get

Example output:

Account identity: n1wlmrpa7ts7znz7nxvmxevaw65796cr6q6pht69
Canonical Account identity: n1wlmrpa7ts7znz7nxvmxevaw65796cr6q6pht69
Account mode: Some(Api)
Account state: Error(BandwidthExceeded { context: "SYNCING_STATE" })

Account Summary & Balance

nym-vpnc account summary
nym-vpnc account balance

Account Links

Get URLs for managing your NymVPN account:

nym-vpnc account links

Forget Account

Remove the stored passphrase, device keys, and local credentials from this device:

nym-vpnc account forget

Device Information

View the current device identity:

nym-vpnc device get

Tunnel Configuration

Print current tunnel configuration:

nym-vpnc tunnel get

Enable two-hop mode (WireGuard) — traffic jumps directly from entry gateway to exit gateway:

nym-vpnc tunnel set --two-hop on

Enable Mixnet (5-hop) — disable two-hop to route traffic through the full mixnet for maximum privacy:

nym-vpnc tunnel set --two-hop off

Enable or disable IPv6:

nym-vpnc tunnel set --ipv6 on

Enable censorship circumvention transports (currently QUIC):

nym-vpnc tunnel set --circumvention-transports on

Gateway Configuration

Set entry and exit gateways bound to specific countries using ISO 3166-1 alpha-2 (opens in a new tab) country codes:

nym-vpnc gateway set --entry-country US --exit-country JP

Print current gateway configuration:

nym-vpnc gateway get

Example output:

Entry point: Country { two_letter_iso_country_code: "US" }
Exit point: Country { two_letter_iso_country_code: "JP" }
Residential exit: off

Only use residential exit nodes:

nym-vpnc gateway set --residential-exit on

List Available Gateways

List available WireGuard gateways (use a wide terminal window for the table output):

nym-vpnc gateway list wg

You can also list mixnet entry and exit gateways:

nym-vpnc gateway list mixnet-entry
nym-vpnc gateway list mixnet-exit

Connect & Disconnect

Connect using the settings stored in nym-vpnd:

nym-vpnc connect

Disconnect:

nym-vpnc disconnect

Reconnect:

nym-vpnc reconnect

Print the current tunnel status:

nym-vpnc status

Continuously stream tunnel status in real time:

nym-vpnc status --listen

Ad-Block

NymVPN includes a built-in ad-blocker (Brave ad-engine). Ad-blocking is only active while the tunnel is connected.

Enable ad-block:

nym-vpnc ad-block set enabled

Disable ad-block:

nym-vpnc ad-block set disabled

DNS

View current DNS configuration:

nym-vpnc dns get
nym-vpnc dns get-default

Set custom DNS servers:

nym-vpnc dns set 1.1.1.1 9.9.9.9
nym-vpnc dns enable

Disable custom DNS and revert to defaults:

nym-vpnc dns disable

Clear custom DNS servers:

nym-vpnc dns clear

Local Network Access

Control whether local network (LAN) traffic is allowed while the tunnel is active:

nym-vpnc lan get
nym-vpnc lan set allow
nym-vpnc lan set block

SOCKS5 Proxy

NymVPN can expose a local SOCKS5 proxy:

nym-vpnc socks5 enable
nym-vpnc socks5 disable
nym-vpnc socks5 status

Network

View or change the Nym network (requires a daemon restart):

nym-vpnc network get
nym-vpnc network set mainnet

Diagnostic

Run connectivity diagnostics:

nym-vpnc diagnostic run

Getting Help

Any nym-vpnc command has built-in help. Add --help to the end of any command to view available options:

nym-vpnc --help
nym-vpnc connect --help
nym-vpnc tunnel set --help

Default Config Directories

Configurations are stored in /etc/nym. State stored between runs (keys, mnemonic, etc) are stored in /var/lib/nym-vpnd.