Manual VPN setup — Ubuntu / Debian Linux
Recommended: the VPN Pink app
Start with our VPN Pink app for your device. Manual setup is an alternative if the app cannot be used or you prefer your own VPN client.
Get the VPN Pink app →These instructions are an alternative to our recommended VPN Pink app. Choose your platform.
Before you start
You need an active VPN entitlement. Use only a server assigned to your account. Signing into the website does not itself activate VPN access.
Find your VPN username, VPN password and assigned server in My Dashboard. The VPN password may differ from your website password. A customer reference is not your VPN username.
IKEv2 / IPsec
| Server address | Example: Germany — Choose a server address: hostname or IP Hostname: de-fkb-sha-vps3.vpn-pink.comAlternative IPv4: 212.227.45.10Alternative IPv6: 2a01:239:304:6900::1 |
|---|---|
| Server Identity / Remote ID | vpn-pink.com |
| VPN username | My Dashboard → |
| VPN password | My Dashboard → |
Leave Client Identity / Local ID empty. If your client requires it, use your VPN username.
Leave the server certificate file unselected to use the trusted system CAs. Keep certificate validation enabled; do not install an arbitrary certificate.
Setup steps
- Close VPN Pink and other VPN clients. On Ubuntu/Debian install the NetworkManager strongSwan plugin using the commands below.
- Open Settings → Network → VPN → + → IPsec/IKEv2 (strongSwan). Enter the values below; select EAP (Username/Password).
- Enable Request an inner IP address and Enforce UDP encapsulation. Leave compression off and other settings at defaults. Save and connect from Ubuntu settings. Approve an administrator prompt if requested; do not run the graphical app with sudo.
Before connecting: Ubuntu packages
IKEv2/IPsec needs the NetworkManager plugin and extra strongSwan modules. Updating the AppImage does not install these system packages.
sudo apt update
sudo apt install network-manager-strongswan libcharon-extra-plugins libstrongswan-extra-pluginsCheck packages and the EAP module
The package query checks installation. The file check must find libstrongswan-eap-identity.so. This proves installation, not that the running service loads it or that a VPN tunnel works.
dpkg-query -W network-manager-strongswan strongswan-nm libcharon-extra-plugins libstrongswan-extra-plugins
dpkg -L libcharon-extra-plugins | grep 'libstrongswan-eap-identity.so'If the connection log says “EAP_IDENTITY not supported” or eap-identity cannot load, install the packages above. Save your work and restart Ubuntu to reload the VPN modules. Then retry the VPN Pink app first. If it still fails, collect a fresh log in a separate terminal. Other optional plugin warnings do not mean that every listed plugin is required.
WireGuard is supported directly by NetworkManager; no additional VPN plugin is needed.
Start the app or CLI as your normal user, without sudo. Approve an administrator prompt if Ubuntu requests permission to configure the VPN. Missing packages and a blank app window are separate issues; installation does not guarantee a connection.
Choose a server address: hostname or IP
Enter exactly one value in Server address: the hostname or, alternatively, the IPv4 or IPv6 address of the same assigned server. If DNS fails, replace the hostname with its fixed IP. IPv6 requires working IPv6 connectivity. If the client has a separate Remote ID field, keep vpn-pink.com there. A fixed IP bypasses DNS lookup of the server address, but does not replace certificate validation.
| VPN | Hostname | Alternative IPv4 | Alternative IPv6 |
|---|---|---|---|
| AT | at-sha-vps1.vpn-pink.com | 5.132.162.69 | 2a03:3180:4001:106::473d:989b |
| DE | de-fkb-sha-vps3.vpn-pink.com | 212.227.45.10 | 2a01:239:304:6900::1 |
| ES | es-mad-sha-vps1.vpn-pink.com | 82.223.83.18 | 2001:ba0:253:6000::1 |
| US | us-sha-vps1.vpn-pink.com | 198.71.58.244 | 2607:f1c0:f04f:f200::1 |
If connection fails
IKEv2 uses UDP 500 and 4500. Replies must be allowed; home-router port forwarding is normally unnecessary. No captured packets is not proof that a port is blocked.
An EAP_NAK followed by EAP_FAILURE means the EAP negotiation was rejected; it does not prove a wrong password. “Recovery remains armed” is an app status, not an administrator-permission request or proof of a working VPN. Ask support with the time, platform, server and log.
Open a new terminal immediately after a failed attempt and collect the log below. A terminal still running the app cannot execute new shell commands.
sudo journalctl -u NetworkManager --since "10 minutes ago" --no-pagerDo not share passwords, private keys, tokens, QR codes or complete WireGuard configurations. Review logs before sharing.
Contact support →VPN
Check that your system reports the tunnel connected, internet access works and your public IP has changed. Opening the app or importing a profile alone proves no connection.
IP →