How to set up and use the ExpressVPN CLI app for Linux

This tutorial will show you how to set up the ExpressVPN app for Linux via the command line interface (CLI).

ExpressVPN is compatible with these 64-bit Linux operating systems:

• Ubuntu: 24.04 and above
• Debian: 11 and above
• Fedora: 30 and above
• Arch: Latest rolling release
• Raspberry Pi: Pi OS (64-bit)
• Mint: Linux Mint 20 and above

Prefer manual setup? See the instructions for manual setup for OpenVPN (via the Terminal) and OpenVPN (via Ubuntu Network Manager).

Download the installer

1. Go to the ExpressVPN setup page. If prompted, enter your ExpressVPN credentials and click Sign In.
2. Enter the verification code that is sent to your email.
3. On the left, select Linux if it was not already selected.
4. Click Download.
5. Select Save File. Click OK.

Need help? Contact the ExpressVPN Support Team for immediate assistance.

Back to top

Install and activate the app

Install the app

Open a terminal and navigate to the location where the installer was downloaded. For example:

cd ~/Downloads

Make the file executable with this command:

chmod +x installer/name

The command can look like this, though it will depend on the actual name of your installer:

chmod +x expressvpn-linux-universal-14.0.1.12858_release.run

Activate the app

Open a new Terminal. Save your activation code in a file. For example:

echo 'your activation code' > activationCodeFile

Once you have saved your activation code, run the login command using that file name:

expressvpnctl login activationCodeFile

After successfully logging in, delete the activation code file you created to avoid unauthorized access.

Need help? Contact the ExpressVPN Support Team for immediate assistance.

Back to top

Connect to a VPN server location

Note: To use connection commands in the CLI, either the ExpressVPN GUI client must be running, or background mode must be enabled by running the command: expressvpnctl background enable

To connect to the VPN, run this command:

expressvpnctl connect

If you are connecting for the first time, ExpressVPN will use the Smart Location feature to select a server location, which is recommended to you based on factors such as speed and proximity.

If this is not your first time connecting, ExpressVPN will connect to the server location you most recently connected to.

Need help? Contact the ExpressVPN Support Team for immediate assistance.

Back to top

Disconnect from a VPN server location

To disconnect from the VPN, run this command:

expressvpnctl disconnect

Need help? Contact the ExpressVPN Support Team for immediate assistance.

Back to top

Connect to a different VPN server location

To find a list of locations to connect to, enter the following command in the terminal:

expressvpnctl get regions

Connect to a specific VPN server location

To connect to a specific server location, enter:

expressvpnctl connect "LOCATION"

For example, to connect to Germany – Frankfurt – 1, enter:

expressvpnctl connect "Germany - Frankfurt - 1"

Need help? Contact the ExpressVPN Support Team for immediate assistance.

Back to top

Switch to a different VPN protocol

Important: Disconnect from the VPN before switching to another protocol.

VPN protocols are the methods by which your device connects to a VPN server. For the best experience, ExpressVPN recommends using the Automatic protocol option. This is selected by default and automatically picks the protocol most appropriate for your network.

In some cases, switching to a different protocol can give you faster connection speeds.

To switch to Lightway – TCP, run the following command:

expressvpnctl set protocol lightwaytcp

To switch to Lightway – UDP, run the following command:

expressvpnctl set protocol lightwayudp

To switch to OpenVPN – TCP, run the following command:

expressvpnctl set protocol openvpntcp

To switch to OpenVPN – UDP, run the following command:

expressvpnctl set protocol openvpnudp

To use the Automatic option, run this command:

expressvpnctl set protocol auto

Need help? Contact the ExpressVPN Support Team for immediate assistance.

Back to top

View all commands

To view a list of the app’s functions and commands, run this in the terminal:

expressvpnctl -h

Need help? Contact the ExpressVPN Support Team for immediate assistance.

Back to top

Split tunneling

Split tunneling enables you to choose which apps use the VPN and which apps bypass it when you are connected to ExpressVPN. This allows you to access both local and blocked content on your Linux device.

To enable split tunneling, run the command:

expressvpnctl set splittunnel true

Once enabled, you can decide which apps bypass the VPN and which apps use the VPN.

To get the path of an app, run the command:

which app-name

In the case of Firefox, the command can be “which firefox.” This can result in:

/usr/bin/firefox

To add apps you wish to bypass the VPN, run the command:

expressvpnctl set split-app bypass: ROUTE/TO/APPLICATION/EXECUTABLE

For example, if you wanted the VPN to bypass Firefox, you would run the command:

expressvpnctl set split-app bypass:/usr/bin/firefox

To add apps you wish to use the VPN, run the command:

expressvpnctl set split-app vpn: ROUTE/TO/APPLICATION/EXECUTABLE

For example, if you wanted the VPN to use Firefox, you would run the command:

expressvpnctl set split-app vpn:/usr/lib/firefox/firefox

To delete split tunneling rules for an app, run the command:

expressvpnctl set split-app remove:ROUTE/TO/APPLICATION/EXECUTABLE

Need help? Contact the ExpressVPN Support Team for immediate assistance.

Back to top

Block ads, trackers, and harmful sites

Customize your online experience and take back control over what companies know about you. You can block ads, trackers, malicious sites, and adult content from within the ExpressVPN app.

A lot of the apps and websites you visit keep a record of and share your activity with third-party companies, including trackers, scammers, and malware sites. This information is used to serve you more targeted ads and content, usually without your knowledge or permission.

These advanced protection features prevent all apps and websites you visit on your device from communicating with the third-party companies in our open-source blocklists.

Advanced protection features are disabled by default. To enable all advanced protection features at the same time:

1. Open the Terminal window.
2. Make sure to connect to the VPN and use the Automatic or Lightway protocol.
3. To enable all advanced protection features, enter the command:
   expressvpnctl set blockAll true

   To disable all advanced protection features, enter the command:
   expressvpnctl set blockAll false

4. Press Enter to confirm.
5. Reconnect to the VPN to apply the changes.

You can also enable and disable each advanced protection feature individually:

Block trackers

1. Open the Terminal window.
2. Make sure to connect to the VPN and use the Automatic or Lightway protocol.
3. To block trackers, enter the command:
   expressvpnctl set blockTrackers true

   To disable, enter the command:
   expressvpnctl set blockTrackers false

4. Press Enter to confirm.
5. Reconnect to the VPN to apply the changes.

Block malicious sites

1. To block malicious sites, enter the command:
   expressvpnctl set blockMalicious true

   To disable, enter the command:
   expressvpnctl set blockMalicious false

2. Press Enter to confirm.
3. Reconnect to the VPN to apply the changes.

Block ads

1. To enable the ad blocker, enter the command:
   expressvpnctl set blockAds true

   To disable, enter the command:
   expressvpnctl set blockAds false

2. Press Enter to confirm.
3. Reconnect to the VPN to apply the changes.

Block adult sites

1. To block adult sites, enter the command:
   expressvpnctl set blockAdult true

   To disable, enter the command:
   expressvpnctl set blockAdult false

2. Press Enter to confirm.
3. Reconnect to the VPN to apply the changes.

Read more about ExpressVPN’s advanced protection features.

Need help? Contact the ExpressVPN Support Team for immediate assistance.

Back to top

Network lock

ExpressVPN has a Network Lock that acts as a kill switch. If your connection gets interrupted accidentally, Network Lock will immediately stop all internet traffic from entering or leaving your device. This prevents your online traffic from being exposed during the interruption.

Network Lock in enabled by default. To disable Network Lock, run the command:

expressvpnctl set networklock false

To re-enable Network Lock, run the command:

expressvpnctl set networklock true

Need help? Contact the ExpressVPN Support Team for immediate assistance.

Back to top

Uninstall the app

To uninstall the app, locate the app installation file. Run this command:

sudo find / -type f -name "*expressvpn*uninstall*" 2>/dev/null

If no results are returned, the application may not be installed in a standard location. Repeat the search with a broader pattern:

sudo find / -type f -iname "*expressvpn*" 2>/dev/null

If you find the uninstaller, then run the command:

/path-to-uninstaller

The command can be:

/opt/expressvpn/bin/expressvpn-uninstall.sh

If you are asked to confirm, type in ‘Y’

Need help? Contact the ExpressVPN Support Team for immediate assistance.

Back to top