Install the Mysterium VPN command-line client, sign in through your browser, and connect to a Residential or High-speed IP address with mystvpn.
Ubuntu and Debian are the officially supported Linux distributions for this release. The CLI is distributed through GitHub Releases.
Before you begin
You need:
A Linux kernel with WireGuard support.
Bash and curl to run the automatic installer.
Permission to use sudo when required.
Internet access and a browser to approve authentication.
A Mysterium VPN account with an active subscription that includes the IP type you want to use.
Use the same Linux user and privilege context throughout. Managing WireGuard interfaces requires elevated privileges, and mystvpn does not elevate privileges automatically. This guide uses sudo for authentication and every command that reads or changes authentication or connection state. Do not alternate between mystvpn auth and sudo mystvpn connect: they may use different users’ stored data. If you already run as root, omit sudo.
Version and help commands can run without sudo.
Install Mysterium VPN (Ubuntu)
Recommended: use the automatic installer
Open a terminal and run:
curl -fsSL https://github.com/mysteriumnetwork/mysteriumvpncli/releases/latest/download/install.sh | bash
Enter your Linux password if the installer requests sudo access. This command downloads and runs the official installation script.
The installer:
Detects your operating system and architecture and selects the appropriate release.
On Ubuntu and Debian, installs a Debian package (.deb) through apt.
Installs missing supported system dependencies and requests elevated permissions when needed.
Verifies release downloads using SHA-256 checksums.
Stops if downloading, verification, or installation fails.
With a Debian package, the executable is normally installed at /usr/bin/mystvpn. If a suitable Debian package is unavailable, the installer may fall back to a standalone binary at /usr/local/bin/mystvpn.
The installer does not upgrade your Linux kernel. Your system must already support WireGuard, or you must arrange a suitable kernel update separately.
Automatic installation on Ubuntu ARM64: the installer installs mystvpn and wireguard-tools through apt.
After the installer completes, verify the installation:
mystvpn version
mystvpn help
mystvpn version prints the installed version. Both mystvpn and mystvpn help display the available commands.
Installation completed at /usr/bin/mystvpn; the version command confirms mystvpn 0.1.2.
Alternative: install a Debian package manually
Open the GitHub Releases page.
Check your Debian package architecture:
dpkg --print-architecture
Download the matching .deb package for the release you want to install.
In the directory containing the downloaded package, install it using apt:
sudo apt install ./mystvpn_1.2.3_amd64.deb
The filename and version above are examples. Replace them with the actual downloaded filename. Keep the ./ prefix when installing a file in your current directory.
Run mystvpn version to check the installed version.
System architecture | Debian package architecture |
x86-64 | amd64 |
ARM64 | arm64 |
ARMv7 or later, 32-bit | armhf |
Dependencies and permissions
The CLI relies on these system components:
Requirement | Purpose |
WireGuard-compatible Linux kernel | Supports the VPN tunnel. |
wireguard-tools (wg, wg-quick) | Creates and manages WireGuard tunnels. |
iproute2 and sysctl (from procps) | Configure networking. |
resolvconf or openresolv | Configure DNS. |
nftables or iptables | Manage routing rules. |
curl and CA certificates | Support HTTPS downloads. |
Bash, tar, gzip, and coreutils | Support standalone archive installation. |
The Debian package declares its runtime dependencies so apt can install them. The automatic installer also handles missing supported dependencies. Neither approach removes the requirement for WireGuard kernel support or sufficient network permissions.
Sign in through your browser
Run:
sudo mystvpn auth
The CLI creates a temporary authentication activation and prints a browser approval URL.
Open that URL manually. The CLI does not open your browser automatically.
Sign in to your Mysterium VPN account and approve authentication.
Return to the terminal. The CLI waits for approval, stores access and refresh tokens locally, and confirms successful authentication.
The authentication link expires after five minutes. If it expires or the activation is rejected, run sudo mystvpn auth again and complete approval using the new link.
mystvpn auth does not accept username or password arguments. Enter your account credentials only in the browser authentication flow.
If your authentication expires
When an API request returns 401 Unauthorized, the CLI automatically attempts one refresh-token exchange and retries the API request once. If renewal fails, run sudo mystvpn auth again, approve the new browser activation, and retry your command.
3. Choose an IP type and country
The CLI uses these values for IP types:
IP type in Mysterium VPN | CLI value |
Residential | residential |
High-speed | hosting |
List the countries available for your chosen IP type:
sudo mystvpn countries --ip-type residential
Residential country list captured during testing. Available countries and counts may change.
Or, for High-speed IPs:
sudo mystvpn countries --ip-type hosting
High-speed country list using –ip-type hosting. Available countries and counts may change.
Available countries depend on the selected IP type. The CLI displays country codes alphabetically, with up to ten codes per line. Choose a code returned by the relevant command and an IP type included in your subscription.
Connections require both --country and --ip-type. Use a two-letter country code, such as DE for Germany. Country codes are normalized to uppercase. The only valid IP-type values are residential and hosting.
4. Make your first connection
For a Residential IP in Germany, run:
sudo mystvpn connect --country DE --ip-type residential
For a High-speed IP in Germany, run:
sudo mystvpn connect --country DE --ip-type hosting
Choose a different country if DE is unavailable for your selected IP type.
A successful connection prints location information in this format:
exit_ip: 1.2.3.4
country: DE
city: berlin
The IP address and city above are illustrative; your assigned location details will vary.
Change your country or IP type
Run connect again with the new values. For example, if NL is available for Residential IPs:
sudo mystvpn connect --country NL --ip-type residential
You do not need to disconnect first. The new connect command replaces the active connection. The CLI requests a new VPN configuration before taking down the existing tunnel, then reuses its managed WireGuard keypair and configuration location for the replacement.
Successful Residential connection to the Netherlands. The exit IP address is redacted.
If replacement fails, check the reported error and actual connectivity before assuming the previous connection is still working. See “Location change fails” below.
5. Manage your connection
Check connection status
sudo mystvpn status
With an active local session, the output looks like this:
connected: yes
IP address: 1.2.3.4
country: DE
city: berlin
Connected local status for the Netherlands session. The exit IP address is redacted.
Without an active local session:
connected: no
Status reports locally stored information only. It does not contact the API or independently verify that traffic is passing through the VPN tunnel. If it says you are connected but websites do not load, follow the connectivity troubleshooting steps below.
Check the public IP used by your traffic
To check the public IPv4 address used by requests from your Linux machine, run:
curl -4 --max-time 15 https://api.ipify.org
echo
This sends a request to an external IP-check service. Compare the result with your connection’s exit_ip. Run the check inside the Linux system running the VPN; your Mac browser does not test a VPN running inside an Ubuntu virtual machine.
Checking the public IPv4 address from the Linux terminal. The returned address is redacted.
Refresh your connection
sudo mystvpn refresh
Refresh requires an active local VPN session. It reconnects using your saved country, IP type, WireGuard keypair, and managed configuration path, then prints the connection metadata.
Refresh does not guarantee a different exit IP address. The assigned IP depends on availability. To choose another country or IP type, use connect with the desired flags instead.
Successful refresh of the Netherlands session. The exit IP address is redacted.
Disconnect
sudo mystvpn disconnect
The CLI closes the remote VPN connection, stops the local WireGuard tunnel, removes its managed WireGuard configuration, and clears the active local session state.
Disconnecting does not log you out. You can connect again without repeating browser authentication while your authentication remains valid.
Log out
sudo mystvpn logout
If a connection is active, logout disconnects it locally and remotely first. It then removes stored authentication tokens and clears pending authentication information. You must complete browser authentication again before future authenticated operations.
Command reference
Action | Command | What it does |
Show help | mystvpn or mystvpn help | Displays available commands. |
Check version | mystvpn version | Prints the installed version. |
Authenticate | sudo mystvpn auth | Starts browser authentication and stores tokens locally. |
List Residential countries | sudo mystvpn countries --ip-type residential | Lists available Residential country codes. |
List High-speed countries | sudo mystvpn countries --ip-type hosting | Lists available High-speed country codes. |
Connect with Residential IP | sudo mystvpn connect --country DE --ip-type residential | Connects to a Residential IP in the selected country. |
Connect with High-speed IP | sudo mystvpn connect --country DE --ip-type hosting | Connects to a High-speed IP in the selected country. |
Check status | sudo mystvpn status | Shows local connection state and location metadata. |
Refresh | sudo mystvpn refresh | Reconnects using the saved country, IP type, and WireGuard keypair. |
Disconnect | sudo mystvpn disconnect | Closes the remote connection, stops the local tunnel, and removes active session state. |
Log out | sudo mystvpn logout | Disconnects an active session and removes authentication tokens and pending activation data. |
Update the CLI
The recommended update method is to rerun the official installer:
curl -fsSL https://github.com/mysteriumnetwork/mysteriumvpncli/releases/latest/download/install.sh | bash
The installer selects the installation method again on every run. For Debian package installations, it upgrades the package. For standalone installations, it replaces the installed binary.
If you installed a Debian package manually, you can instead download the latest matching .deb from GitHub Releases and install it with sudo apt install ./ACTUAL_DOWNLOADED_FILENAME.deb. Replace the placeholder with your downloaded filename.
After updating, run:
mystvpn version
If the version is still old, see “An older standalone binary takes precedence” below.
Uninstall the CLI
Before removing the executable, run the following in the same privilege context you have been using to disconnect and remove authentication data:
sudo mystvpn logout
If logout reports an error, resolve it before removing the CLI so you can finish cleaning up the active connection.
Debian package installation: use apt to remove the installed package. To confirm the package name for the default executable path:
dpkg -S /usr/bin/mystvpn
Remove the package with sudo apt remove mystvpn.
Standalone installation: remove the binary from its installation location. If you confirmed that it is the standalone executable installed at the default path:
sudo rm /usr/local/bin/mystvpn
hash -r
Do not assume deleting the executable or removing a package also removes all user configuration files. Do not share leftover configuration or session files; they may contain sensitive information.
Troubleshooting
Installation and system requirements
Problem | How to identify it | What to do |
mystvpn: command not found | Your terminal cannot find mystvpn. | Run command -v mystvpn. Check /usr/bin/mystvpn for a package installation or /usr/local/bin/mystvpn for a default standalone installation. Check that the relevant directory is on your PATH, or rerun the official installer if installation did not complete. |
Installer fails | The installer reports a download, checksum, package, or dependency error. | Check internet access, system compatibility, and the exact error. Retry the official installer after resolving the cause. Do not bypass checksum verification. Contact Support if verification keeps failing. |
Debian package installation fails | apt reports package or dependency errors. | Run dpkg --print-architecture, confirm the downloaded package matches, and check that your repositories and dependencies are available. Resolve the reported error and retry sudo apt install ./ACTUAL_DOWNLOADED_FILENAME.deb. |
Missing WireGuard support | The system cannot create a WireGuard tunnel, or reports an unsupported protocol or missing module. | Check your kernel’s WireGuard support and install the required tools. On systems using a loadable module, sudo modprobe wireguard can help diagnose availability; some kernels have built-in support instead. Ask your system administrator or hosting provider about kernel support if needed. The installer does not upgrade the kernel. |
wg-quick is missing | A command reports it cannot find wg-quick; command -v wg-quick finds nothing. | Install the tools with sudo apt install wireguard-tools, or rerun the installer to resolve supported missing dependencies. |
Permission denied | Tunnel creation or removal fails because of permissions. | Use sudo consistently. Confirm that your user has the necessary sudo access and that the environment allows network interface management. Restricted containers may need administrator changes. |
An older standalone binary takes precedence | The version remains old after installing a newer Debian package. | Follow the standalone conflict steps below. |
Authentication and subscription
Problem | How to identify it | What to do |
Authentication required | The CLI reports missing authentication. | Run sudo mystvpn auth, complete browser approval, and retry using the same privilege context. |
Authentication link expired | Approval was not completed within five minutes, or the activation is reported as expired. | Run sudo mystvpn auth again and approve the new link before it expires. |
Authentication rejected | The browser activation is rejected. | Start a new authentication flow and complete approval. |
Authentication fails | The CLI reports an authentication or HTTP error. | Check internet connectivity and access to the approval page, then retry. Contact Support if it persists. |
Stored authentication expires | Automatic token renewal fails. | Run sudo mystvpn auth again, approve authentication, and retry your command. |
No active subscription | The API reports no active VPN subscription. | Check your subscription and make sure you signed in to the correct Mysterium VPN account. If necessary, log out and authenticate with the correct account. |
IP type unavailable for your plan | The API says the chosen IP type is not permitted. | Choose an IP type included in your subscription: residential or hosting. |
Commands run under different Linux users | Authentication or connection state appears to be missing between commands. | Use the same Linux user and privilege context for every authenticated operation. Authenticate again in that context if needed. |
Country and IP availability
Problem | How to identify it | What to do |
Country unavailable | The selected country is not available for the selected IP type. | Run sudo mystvpn countries --ip-type residential or sudo mystvpn countries --ip-type hosting, as appropriate, and choose a listed country. |
Invalid country | The CLI rejects your country value. | Use a two-letter country code such as DE. |
Invalid IP type | The CLI rejects your IP-type value. | Use exactly residential or hosting. |
No suitable IP available | The API cannot assign an IP in your chosen country and IP type. | Retry later, select another listed country, or select another IP type included in your plan. |
Refresh returns the same IP | Refresh succeeds, but the exit IP stays the same. | This can happen: refresh does not guarantee a new IP. Retry later or connect to another available country. |
Refresh fails due to IP availability | The API cannot assign a suitable IP during refresh. | Retry later or use connect with another available country or eligible IP type. |
Connections, local state, and WireGuard
Problem | How to identify it | What to do |
No active session | refresh or disconnect cannot find an active session. | If you want to connect, run sudo mystvpn connect --country DE --ip-type residential, substituting available values. If you intended only to disconnect, confirm you used the original user and privilege context and inspect the actual tunnel state; do not create a new session just to clear the message. |
Location change fails | A new connect command fails while replacing an active connection. | Review the error, run sudo mystvpn status, and check actual connectivity. Retry after resolving the cause. If necessary, use sudo mystvpn disconnect followed by connect with both required flags. |
Invalid local session | The CLI cannot read or validate saved session information. | Use the original user and privilege context and try re-establishing a connection with connect. If the error persists, contact Support instead of manually editing sensitive state files. |
Invalid WireGuard configuration | The CLI cannot read or validate its managed configuration. | Retry the connection. Do not manually modify or share configuration files containing private keys. Contact Support if the error persists. |
VPN tunnel fails to start | The CLI reports a wg-quick up failure. | Check installed dependencies, WireGuard kernel support, permissions, and conflicts with other VPNs or networking tools. Resolve the specific WireGuard error and retry. |
VPN tunnel fails to stop | The CLI reports a wg-quick down failure. | Check interface state with ip link show and WireGuard state with sudo wg show. Confirm permissions, resolve the reported network issue, and retry sudo mystvpn disconnect. Avoid removing unrelated interfaces. |
Status shows disconnected | sudo mystvpn status returns connected: no. | Verify the user and privilege context, then connect again using both required flags. |
Status shows connected, but internet does not work | Local session information exists, but traffic fails. | Remember that status is not a live tunnel check. Inspect sudo wg show for handshake and transfer information, and check DNS resolution with getent hosts example.com. If appropriate, disconnect and check normal internet access, then reconnect. Address DNS, dependency, or network errors before retrying. |
An older standalone binary takes precedence
An existing /usr/local/bin/mystvpn can take precedence over the packaged /usr/bin/mystvpn. The installer warns about this conflict but leaves the old executable in place.
First, check the command being used and confirm that the Debian package owns the packaged executable:
command -v mystvpn
dpkg -S /usr/bin/mystvpn
/usr/bin/mystvpn version
Only if the Debian package is installed and you have confirmed that /usr/local/bin/mystvpn is the old standalone executable, remove that old executable and refresh Bash’s command cache:
sudo rm /usr/local/bin/mystvpn
hash -r
mystvpn version
If you previously used another standalone installation location, inspect that location first. Do not delete a binary solely because an update appears unsuccessful.
Security and local data
Browser authentication lets you sign in without entering account credentials directly into the CLI. Open the printed approval URL yourself and keep the activation link private.
The CLI stores access and refresh tokens in the current user’s configuration directory. Pending authentication activation information is also stored locally. Authentication and connection files use owner-only permissions.
The CLI also stores a WireGuard keypair, active session information, and a generated WireGuard configuration. Generated configurations contain sensitive private-key material.
Tokens and WireGuard private keys are not displayed in normal command output or debug HTTP logs. Even so, review anything you send to Support and never share authentication tokens, private keys, generated configurations, or sensitive local session files.
Refresh and connection replacement reuse managed WireGuard key material and configuration paths. Refresh and disconnect accept only CLI-managed WireGuard configuration paths. Do not substitute your own configuration path or manually edit managed files to troubleshoot.
Always use the same Linux user and privilege context for authentication and VPN operations. With the sudo commands in this guide, operations normally run as root and use that user’s stored data.
Contact Support
If the issue continues, contact Mysterium VPN Support through the Help Center and include:
Your Linux distribution and version.
The output of mystvpn version.
The command that failed and its exact terminal error.
Your selected country and IP type.
Whether wg-quick is installed (command -v wg-quick).
Whether normal internet access works when disconnected.
Whether you used the automatic installer or installed manually.
Remove sensitive information before sending logs or screenshots. Do not attach authentication links, tokens, private keys, generated WireGuard configurations, or local session files.