Headless means no desktop, not no recovery plan
NordVPN documents token-based login for Linux machines without a GUI. That solves the browser-login problem on a server. It does not by itself solve remote routing or firewall access. NordVPN token login guide.
Scope: Ubuntu Server 22.04 or newer, an active subscription, administrative access, and a working local or hosting-provider console. This is documentation-based guidance reviewed September 8, 2026, not a tested VPS configuration. We have not connected an Ubuntu server to NordVPN.
If SSH is your only way into the machine, arrange and test console access before the connection step. Routing changes can break return traffic even when an SSH port is permitted. A second SSH window is useful for testing but is not independent recovery access.
1. Record the starting state
From your console or terminal, record the OS and current routes:
cat /etc/os-release
ip route
Keep those details private if they identify your network. Also record the public IP you observe before connecting and confirm your normal SSH login works. On a machine providing public services, plan how clients will still reach them; an outbound VPN can change more than your interactive session.
NordVPN’s Linux installation requirements name Ubuntu 22.04 onward. Check your exact release and architecture with the provider before installation.
2. Install and inspect the CLI
Follow the CLI installation section in that official guide. To inspect the installer before execution, download it first; curl and less must be available:
curl --fail --show-error --location \
https://downloads.nordcdn.com/apps/linux/install.sh \
--output nordvpn-install.sh
less nordvpn-install.sh
After a successful download and review:
sh nordvpn-install.sh
Review its package prompts. “I use the CLI” does not guarantee a minimal CLI-only package transaction: version 5.3.0’s release notes say the GUI is now installed alongside the daemon. If your server policy disallows those dependencies, resolve the package choice with support before proceeding. NordVPN release notes.
If you hit the documented socket-permission error, use the official installation guide’s group-membership remedy and establish a fresh session as instructed. Do not run every subsequent command as root to work around an unexplained error.
3. Generate a token on another device
In a browser on your own computer, sign into Nord Account, select NordVPN, and find the access-token option under advanced settings. Complete the verification and generate a token with the expiry you intend. Copy it privately; the value is shown once. Official token steps.
The provider login syntax passes the token as an argument. The following Bash example prompts without echoing your paste or putting the literal token in your shell history:
read -r -s -p 'NordVPN access token: ' tunnelledger_nord_token
printf '\n'
nordvpn login --token "$tunnelledger_nord_token"
unset tunnelledger_nord_token
This is not complete secret isolation: the CLI still receives the expanded token as a process argument. Use a trusted machine and avoid terminal recording. Do not place the token in a shared script, ticket, or screenshot.
4. Inspect settings before connecting
Read the existing settings, especially automatic connection and the kill switch:
nordvpn settings
Keep your recovery console open. For this initial manual test, avoid enabling additional persistent networking behavior. If this is an existing installation with custom settings, understand those settings before changing anything.
A kill switch can intentionally block traffic while the VPN is disconnected. An allowlisted port alone is not a general solution for every cloud firewall, routing table, management subnet, or hosted service. This guide deliberately does not supply a universal “allow SSH” command.
5. Connect from the recovery console and verify
Run the connection command, then inspect status:
nordvpn connect
nordvpn status
These are documented CLI commands. See the NordVPN command reference.
While the console remains available, open a new SSH connection from the machine you normally administer from. Check the server’s outbound public IP, DNS resolution, and any services you expect to keep reachable. A previously open session remaining alive is weaker evidence than a fresh successful connection.
If access fails, use the recovery console to disconnect:
nordvpn disconnect
Then reassess routing and firewall behavior before another attempt. If an existing kill switch is keeping traffic blocked, review that setting from the console; disconnect alone may not restore ordinary networking. Do not reboot blindly into an automatic reconnection loop.
6. Decide what should persist
Only after the manual connection and recovery sequence works should you consider automatic connection or kill-switch settings. Test one change at a time from the console, then repeat the fresh SSH and service checks. Document how to undo each change on that particular host.
When you only want to stop the tunnel, use disconnect. NordVPN says ordinary nordvpn logout invalidates the token; its --persist-token option has different behavior. Revoke exposed or unwanted tokens in your account. Token lifecycle documentation.
For a desktop instead, see the Fedora GUI walkthrough. For provider and distribution choices, use the OS compatibility comparison.