Set Up a VPN on Kali Linux (WireGuard & OpenVPN)

What a VPN actually does (and what it doesn't)

Let me get the honest part out of the way first, because it's the part every "best VPN for hackers" article skips.

A VPN does three concrete things. It encrypts your traffic between your laptop and the VPN server, so whoever runs the network you're on — the hotel, the airport, the café, the conference — can't read it or tamper with it. (If you're on those networks often, the hardware version of this idea is a travel router that keeps the tunnel up for every device you carry.) It hides your real IP from the servers you connect to, showing them the VPN's IP instead. And it bypasses local network restrictions, which matters more than you'd think when a captive portal is blocking half your tools.

Here's what it does not do: it does not make you anonymous. When you connect to a VPN, you stop trusting your ISP to not log and sell your traffic — and you start trusting your VPN provider instead. That's the whole trade. You haven't erased the trust, you've relocated it. If the provider keeps logs, or gets subpoenaed, or is quietly compromised, the party that can tie traffic back to you has simply changed hats.

If real anonymity is your goal, the tool for that is Tor (or Tails), not a commercial VPN — and even that is a bigger conversation. For everything below, assume the goal is encrypted transport and IP masking on untrusted networks, which is exactly what a VPN is good at.

WireGuard vs OpenVPN in 2026: which to use

Two protocols matter on Kali. Here's how I choose between them.

WireGuard is my default. It's a few thousand lines of code (versus OpenVPN's hundreds of thousands), it lives in the mainline Linux kernel, it connects almost instantly, it roams between networks without dropping, and the config is a tiny text file you can read top to bottom. Faster, simpler, easier to audit. In 2026 most privacy-focused providers have gone WireGuard-first — Mullvad, for example, dropped OpenVPN entirely in January 2026 and is WireGuard-only now.

OpenVPN is the old workhorse. It's slower and chattier, but it's battle-tested, runs entirely in userspace, and — the reason it still matters — it speaks TCP on port 443, which lets it blend in with normal HTTPS traffic and slip past restrictive firewalls that block WireGuard's UDP. On a locked-down corporate or hotel network, OpenVPN-over-TCP-443 sometimes connects when nothing else will.

Official app vs. importing a config file

There are two ways to connect, and the right one depends on your provider.

The official app (a CLI or GUI the provider ships) is the easy path when it exists. It handles server selection, reconnection, kill switch, and DNS for you. Proton VPN and NordVPN both ship Linux clients, and Proton's Linux CLI uses WireGuard under the hood. The downside: it's one more piece of closed-ish software running as root on your pentest box, and it can lag Kali's rolling release after a big update.

Importing a config file — a WireGuard .conf or an OpenVPN .ovpn you download from your account — is the path I prefer on Kali. No extra daemon, no vendor app, just the standard wg-quick / openvpn tooling that's already in the distro. It's transparent (you can read exactly what it does), it survives Kali updates, and it's trivial to script. Mullvad is config-file-only for this style of setup and it's my go-to for that reason. The rest of this guide focuses on the manual path, because if you can do it by hand you understand what the app is doing anyway.

Setting up WireGuard on Kali (wg-quick)

First, make sure the tools are installed. On a current Kali they usually are, but confirm.

Now log into your provider's account, generate a WireGuard config for a server you want, and download the .conf file. It'll look something like mullvad-se-mma-001.conf or us-nyc.conf. Move it into /etc/wireguard/ and lock down its permissions — this file contains your private key, so treat it like a password.

The interface name is the filename without the .conf. To bring the tunnel up and down:

If wg show lists a recent handshake and bytes moving, you're connected. Confirm your public IP actually changed:

Setting up OpenVPN on Kali (.ovpn)

For the networks where WireGuard's UDP is blocked, OpenVPN over TCP/443 is your fallback. Install it and grab an .ovpn file from your provider (pick a TCP config if they offer one).

That runs in the foreground and prints the connection log — you'll see Initialization Sequence Completed when the tunnel is up. Leave that terminal open; Ctrl-C tears the tunnel down. If your provider uses username/password auth, add --auth-user-pass and it'll prompt you (or point it at a credentials file).

If you'd rather have it managed by NetworkManager — clickable, auto-reconnecting, integrated with the DNS stack — import the .ovpn with nmcli instead:

The same nmcli connection import trick works for WireGuard .conf files too (type wireguard), if you'd rather manage everything through NetworkManager than wg-quick. Either is fine — pick one and stay consistent so you always know how to tear the tunnel down fast.

Checking for DNS leaks

This is the step people skip, and it's the one that quietly burns them. You can have a perfectly working tunnel — your IP changed, traffic is encrypted — and still be sending every DNS lookup to your ISP's resolver in cleartext. That's a DNS leak, and it means your ISP (or the hotel network) still sees every domain you visit, tunnel or no tunnel.

First, a quick sanity check that your queries are going to the VPN's resolver and not your local one:

Then do the real test in a browser: connect the tunnel, visit a DNS-leak test site (dnsleaktest.com or Mullvad's mullvad.net/check), and run the extended test. Every resolver it reports should belong to your VPN provider or its region — none should be your ISP or your home city. Mullvad's check page also flags WebRTC leaks, which is the other classic way a browser quietly gives up your real IP.

A simple kill switch

A kill switch blocks all traffic if the VPN drops, so a flaky hotel connection can't silently dump your real IP onto the network mid-session. There are two easy ways to get one on Kali.

The easy way: if you use a provider app (Proton, Nord) or NetworkManager, just turn on the built-in kill switch / "block traffic outside the tunnel" toggle. Done. This is the right answer for most people.

The WireGuard way: wg-quick can enforce this for you with one line. Add a PostUp/PreDown firewall marker to your .conf, or more simply, many provider configs already ship with kill-switch rules baked in — check the file. If you want to add it yourself, the canonical approach is a firewall rule that only allows traffic out the wg0 interface. A minimal version:

With that in place, if the tunnel goes down, non-tunnel traffic gets rejected instead of falling back to your real connection.

Why you actually want this on hotel and café WiFi

Here's the honest, unglamorous case for running a VPN as a pentester — and it has nothing to do with anonymity.

When you're working from a hotel, a conference, a client's guest network, or a coffee shop, you're on a network run by strangers. That network can inspect and tamper with your traffic, throttle or block your tools, and log where you're connecting. A VPN gives you a clean, consistent, encrypted pipe that behaves the same no matter which sketchy AP you're behind. Your tooling talks to the same egress IP whether you're in a Marriott or a Starbucks, captive portals stop mangling your traffic, and the local network operator sees encrypted noise instead of your recon.

That's logistics, not magic. It makes fieldwork predictable and private-from-the-local-network — which is exactly what you want when you're carrying a laptop full of security tools through a dozen untrusted networks a week. Pair it with a good wireless adapter and a hardened Kali box and you've got a sane mobile setup.

The providers I actually use

No affiliate deals here, no fake commissions — these are just the three I reach for, and why. Match the tool to the job.

Mullvad — my default for privacy. Anonymous signup (you can literally pay in cash to a generated account number, no email required), flat pricing, independently audited, and as of January 2026 it's WireGuard-only, which fits the manual wg-quick workflow above perfectly. If the whole point is minimizing how much your provider knows about you, this is the one.

Proton VPN — the one I recommend to people who want a real free tier to start with. Swiss jurisdiction, open-source apps, and an official Linux CLI that runs WireGuard under the hood. The free plan is usable for basic encrypted transport; the paid plan unlocks more servers and features.

NordVPN — the mainstream pick with a polished Linux app, huge server count, and a built-in kill switch that Just Works. It's less "privacy-maximalist" than Mullvad, but if you want a fast, well-supported client and lots of exit locations, it's a solid choice.

That's the whole thing. Install the tooling, import a config, bring the tunnel up, verify your IP and DNS actually changed, and know exactly what you did and didn't buy. A VPN is a good, boring tool that makes hostile networks behave — use it for that, and don't let anyone sell you the fantasy that it makes you disappear. When you do want to shrink your actual footprint online, that's a different job — start with pulling yourself off people-search sites and scrubbing your personal info.