Nym VPN CLI

This is a short guide to setting up and using the nym-vpnc tool, which is used in conjunction with the nym-vpnd daemon.

Download and run instructions for the GUIs can be found here (opens in a new tab).

Download & Extract Binary

Check the release page (opens in a new tab) page for the latest release version and modify the instructions accordingly. These instructions use the latest as of the time of writing.

wget -q https://github.com/nymtech/nym-vpn-client/releases/download/nym-vpn-core-v1.29.0/nym-vpn-core-v1.29.0_<YOUR_OPERATING_SYSTEM>.tar.gz &&
tar -xzf nym-vpn-core-v1.29.0_<YOUR_OPERATING_SYSTEM>.tar.gz &&
cd nym-vpn-core-v1.29.0_<YOUR_OPERATING_SYSTEM>/ &&
chmod u+x *

Linux ARM64 (.deb)

ARM64 .deb packages are available for Linux distributions that support them (e.g. Ubuntu/Debian on Raspberry Pi or ARM servers). Install both the daemon and the client:

sudo dpkg -i nym-vpnd_<VERSION>_arm64.deb
sudo dpkg -i nym-vpnc_<VERSION>_arm64.deb

The .deb package installs a systemd service that starts nym-vpnd automatically. Verify the service is running:

service nym-vpnd status

You should see output similar to:

● nym-vpnd.service - nym-vpnd daemon
     Loaded: loaded (/usr/lib/systemd/system/nym-vpnd.service; enabled; preset: enabled)
     Active: active (running)

Verify the installed version with nym-vpnc info:

nym-vpnc info

nym-vpnd:
  version: 1.25.0
  build_timestamp (utc): 2026-03-02 16:25:31.229479864 +00:00:00
  triple: aarch64-unknown-linux-gnu
  platform: Ubuntu; Linux (Ubuntu 24.04); aarch64
  git_commit: fce7a84e612b8d2cb48b66695cdaf023d7f9a42b

Build from Source

Prerequisites

All operating systems require both Rust (opens in a new tab) and Go (opens in a new tab).

Arch specific packages:

yay -S gcc make protobuf base-devel clang

Ubuntu24 specific packages:

apt install gcc make protobuf-compiler pkconfig libdbus-1-dev build-essential clang

Clone & make

git clone https://github.com/nymtech/nym-vpn-client.git
cd nym-vpn-client/
make

Start the Daemon

If you installed via .deb packages, the daemon is already running as a systemd service. You can check its status with:

service nym-vpnd status

If you are running from pre-built binaries or a source build, start the daemon manually:

sudo ./PATH/TO/nym-vpnd

Account Setup

Create an Account

Head to https://nym.com/account/create (opens in a new tab) and obtain a passphrase (mnemonic).

Log In

Store your account passphrase on this device:

nym-vpnc account set "<YOUR_PASSPHRASE>"

Check Account Status

Verify that the device is logged in and view account details:

nym-vpnc account get

Example output:

Account identity: n1wlmrpa7ts7znz7nxvmxevaw65796cr6q6pht69
Canonical Account identity: n1wlmrpa7ts7znz7nxvmxevaw65796cr6q6pht69
Account mode: Some(Api)
Account state: Error(BandwidthExceeded { context: "SYNCING_STATE" })

Account Summary & Balance

nym-vpnc account summary
nym-vpnc account balance

Account Links

Get URLs for managing your NymVPN account:

nym-vpnc account links

Forget Account

Remove the stored passphrase, device keys, and local credentials from this device:

nym-vpnc account forget

Device Information

View the current device identity:

nym-vpnc device get

Pay as You Go: Decentralized Access to Nym

You can fund your VPN usage directly from your own wallet instead of going through the NymVPN account system. You deposit $NYM into the ticketbook smart contract and receive zk-nym ticketbooks that authenticate you on the network.

Set Your Mnemonic

Store the recovery phrase for your on-chain wallet address (n1...) that holds your $NYM tokens:

nym-vpnc account set "<MNEMONIC>" --location blockchain

You must fund this address yourself, for example by transferring $NYM from an exchange or another wallet. The --location blockchain flag tells nym-vpnc to use the on-chain wallet directly rather than the NymVPN account system.

Obtain Ticketbooks

Deposit $NYM into the ticketbook smart contract and receive zk-nym credentials:

nym-vpnc account obtain-ticketbooks --amount 1 --source smartcontract

You can omit --source to use the default:

nym-vpnc account obtain-ticketbooks --amount 1

The --amount flag specifies how many ticketbooks to obtain per ticket type. Each request issues one ticketbook for each of the three types:

• Mixnet Entry — used for 5-hop mixnet mode
• WireGuard Entry — used for 2-hop WireGuard mode (entry side)
• WireGuard Exit — used for 2-hop WireGuard mode (exit side)

So --amount 1 produces 3 ticketbooks total (one of each type), and --amount 2 produces 6.

This command:

• Deposits $NYM into the ticketbook smart contract (plus a small fee buffer per deposit)
• Requests credential issuance from the decentralised Nym API validators
• Stores the resulting zk-nym ticketbooks locally on the device

Connect

Connect using the locally stored ticketbooks:

nym-vpnc connect-v2

The CLI uses the ticketbooks to authenticate with entry nodes (gateways) and connect to the Nym network. You will see the connection happening in the nym-vpnd logs.

Tunnel Configuration

Print current tunnel configuration:

nym-vpnc tunnel get

Enable two-hop mode (WireGuard): traffic jumps directly from entry gateway to exit gateway:

nym-vpnc tunnel set --two-hop on

Enable Mixnet (5-hop): disable two-hop to route traffic through the full mixnet for maximum privacy:

nym-vpnc tunnel set --two-hop off

Enable or disable IPv6:

nym-vpnc tunnel set --ipv6 on

Enable censorship circumvention transports (currently QUIC):

nym-vpnc tunnel set --circumvention-transports on

Gateway Configuration

Set entry and exit gateways bound to specific countries using ISO 3166-1 alpha-2 (opens in a new tab) country codes:

nym-vpnc gateway set --entry-country US --exit-country JP

Print current gateway configuration:

nym-vpnc gateway get

Example output:

Entry point: Country { two_letter_iso_country_code: "US" }
Exit point: Country { two_letter_iso_country_code: "JP" }
Residential exit: off

Only use residential exit nodes:

nym-vpnc gateway set --residential-exit on

List Available Gateways

List available WireGuard gateways (use a wide terminal window for the table output):

nym-vpnc gateway list wg

You can also list mixnet entry and exit gateways:

nym-vpnc gateway list mixnet-entry
nym-vpnc gateway list mixnet-exit

Connect & Disconnect

Connect using the settings stored in nym-vpnd:

nym-vpnc connect

Disconnect:

nym-vpnc disconnect

Reconnect:

nym-vpnc reconnect

Print the current tunnel status:

nym-vpnc status

Continuously stream tunnel status in real time:

nym-vpnc status --listen

Ad-Block

NymVPN includes a built-in ad-blocker (Brave ad-engine). Ad-blocking is only active while the tunnel is connected.

Enable ad-block:

nym-vpnc ad-block set enabled

Disable ad-block:

nym-vpnc ad-block set disabled

DNS

View current DNS configuration:

nym-vpnc dns get
nym-vpnc dns get-default

Set custom DNS servers:

nym-vpnc dns set 1.1.1.1 9.9.9.9
nym-vpnc dns enable

Disable custom DNS and revert to defaults:

nym-vpnc dns disable

Clear custom DNS servers:

nym-vpnc dns clear

Local Network Access

Control whether local network (LAN) traffic is allowed while the tunnel is active:

nym-vpnc lan get
nym-vpnc lan set allow
nym-vpnc lan set block

SOCKS5 Proxy

NymVPN can expose a local SOCKS5 proxy:

nym-vpnc socks5 enable
nym-vpnc socks5 disable
nym-vpnc socks5 status

Network

View or change the Nym network (requires a daemon restart):

nym-vpnc network get
nym-vpnc network set mainnet

Diagnostic

Run connectivity diagnostics:

nym-vpnc diagnostic run

Getting Help

Any nym-vpnc command has built-in help. Add --help to the end of any command to view available options:

nym-vpnc --help
nym-vpnc connect --help
nym-vpnc tunnel set --help

Default Config Directories

Configurations are stored in /etc/nym. State stored between runs (keys, mnemonic, etc) are stored in /var/lib/nym-vpnd.