Linux - Manual Connection Scripts

If you cannot use the Private Internet Access (PIA) app, you can use PIA’s manual connection scripts to connect with WireGuard or OpenVPN. These scripts can also help you use the port forwarding feature.

For systems that support the PIA app, we recommend using the PIA app instead of the manual connection scripts.

Jump To:

Requirements

For the scripts to work, you need the following packages:

  • curl
  • jq
  • wireguard-tools (for WireGuard connections)
  • openvpn (for OpenVPN connections)

The process for installing these packages varies by operating system and Linux distribution. You can check out online guides for your specific setup.

Download the Scripts 

  1. Open Terminal.
  2. Clone the manual connection scripts repository:
git clone https://github.com/pia-foss/manual-connections.git
  1. Change to the manual connection scripts directory:
cd manual-connections

You can also download the repository as a compressed folder from GitHub, then extract it before you continue.

Use the Scripts

Each .sh script performs a specific task or set of tasks. You can run some scripts independently if you provide the required variables.

The run_setup.sh script works differently. It prompts you for the required information, then runs the other scripts based on your responses. This is the easiest way to use the manual connection scripts.

  1. From the manual-connections directory, run:
sudo ./run_setup.sh
  1. Enter your system administrator password when prompted. This is your computer password, not your PIA account password.
  2. Enter your PIA username and password when prompted. The password field doesn’t show the characters you type. This is expected.

Terminal showing the PIA manual connection login screen.

  1. Follow the prompts to choose the connection type and settings you want to use. The option with a capital letter is the default option. If you press Enter without typing a response or enter something the script doesn't recognize, the script uses the default option.

Terminal showing the PIA manual connection configuration.

  1. The script will then attempt to establish an OpenVPN or WireGuard connection. If the connection fails, the terminal output provides information about the issue, such as incorrect login credentials.

Terminal showing the PIA manual configuration successfully connecting.

Note: Once successfully connected, the script closes, but your VPN connection stays active in the background. You don't need to keep the terminal window open unless you’re using port forwarding.

Manage Connections

To disconnect later, open any terminal window and run the command for your connection type:

  • WireGuard: 
wg-quick down pia

To reconnect: WireGuard also saves a config file at /etc/wireguard/pia.conf, so you can quickly reconnect later without re-running the full setup by running:

wg-quick up pia
  • OpenVPN: 

When your OpenVPN connection succeeds, the script prints a ready-to-use disconnect command near the end of its output, with the process ID already filled in. To disconnect, you need to use the kill command alongside the process ID for your connection. For example:

sudo kill 1234

Just replace 1234 with the actual number shown in your terminal output. 

To reconnect: Unlike WireGuard, OpenVPN connections don't save reusable config files, so you'll need to run run_setup.sh again each time you want to reconnect.

Use Port Forwarding

If you use the port forwarding feature, keep the script window open. Port forwarding may time out after 15 minutes or less if you close the script window.

The terminal output provides the forwarded port assigned to you and shows when it will time out. If you close the terminal window while using port forwarding, your VPN connection remains active until you run the command to disconnect it.

Note: Port forwarding is not available on US server locations. 

Use One-Line Calls

You can also run the scripts with one-line calls instead of using the prompt-based setup. For example, this command starts a WireGuard connection if you replace the placeholder username and password with valid PIA account credentials:

sudo PIA_USER=p1234567 PIA_PASS=xxxx1234 DIP_TOKEN=no PIA_PF=true PIA_DNS=true DISABLE_IPV6=yes PREFERRED_REGION=ca_vancouver VPN_PROTOCOL=wireguard ./run_setup.sh

Note: If you want to use a dedicated IP address, set DIP_TOKEN to your actual token value instead of no.

For more information about one-line calls and supported variables, review the README.md file included with the scripts.

Related articles