Compare offers and check the full cost before you choose.
Prepare console recovery before changing server routes
NordVPN supports token login, so you don’t need a browser on the server. The harder part is keeping the machine reachable when the VPN changes its routes.
You need Ubuntu Server 22.04 or newer, an active subscription, administrator access, and a working local or hosting-provider console. Test that console before connecting. A second SSH window is useful for checks, but it shares the same network path and won’t rescue you if routing breaks.
1. Note what works before changing anything
From your console or terminal, record the OS and current routes:
cat /etc/os-release
ip route
Record the outbound public IP and confirm a normal SSH login works. If the server hosts public services, decide how clients will reach them with the tunnel active; its route changes can affect those connections too.
NordVPN’s Linux installation requirements name Ubuntu 22.04 onward. Check your exact release and architecture with the provider before installation.
2. Install and inspect the CLI
Follow the CLI installation section in that official guide. To inspect the installer before execution, download it first; curl and less must be available:
curl --fail --show-error --location \
https://downloads.nordcdn.com/apps/linux/install.sh \
--output nordvpn-install.sh
less nordvpn-install.sh
After a successful download and review:
sh nordvpn-install.sh
Read the package list before accepting. Version 5.3.0’s release notes say the GUI is installed alongside the daemon, even if you intend to use terminal controls. If your server policy excludes those dependencies, settle the package choice with support first. NordVPN release notes.
If you hit the documented socket-permission error, use the official installation guide’s group-membership remedy and establish a fresh session as instructed. Don’t run every subsequent command as root to work around an unexplained error.
3. Generate a token on another device
On your own computer, sign into Nord Account in a browser. Select NordVPN, find access tokens under advanced settings, complete verification, and choose an expiry. Copy the token somewhere private when it appears; it’s shown once. Official token steps.
The provider login syntax passes the token as an argument. The following Bash example prompts without echoing your paste or putting the literal token in your shell history:
read -r -s -p 'NordVPN access token: ' tunnelledger_nord_token
printf '\n'
nordvpn login --token "$tunnelledger_nord_token"
unset tunnelledger_nord_token
This keeps the token out of your typed command history, but the program still receives it as a process argument. Use a trusted machine, turn off terminal recording, and keep the token out of shared scripts and screenshots.
4. Inspect settings before connecting
Read the existing settings, especially automatic connection and the kill switch:
nordvpn settings
We’d leave automatic connection off until a manual connection and recovery both work. Check for existing settings rather than assuming a fresh configuration, and keep the console open.
A kill switch can block traffic even with the VPN disconnected. Allowlisting the SSH port alone may not preserve access: return routes, cloud firewalls, and management subnets also matter. Resolve those for this host before connecting.
5. Connect from the recovery console and verify
Run the connection command, then inspect status:
nordvpn connect
nordvpn status
The CLI reference covers these commands and additional settings.
Open a new SSH connection from your usual administration machine while keeping the console available. An established session may survive even when new logins fail. Check the outbound public IP, DNS resolution, and each public service you expect to remain reachable.
If access fails, use the recovery console to disconnect:
nordvpn disconnect
Then reassess routing and firewall behavior before another attempt. If an existing kill switch is keeping traffic blocked, review that setting from the console; disconnect alone may not restore ordinary networking. Don’t reboot blindly into an automatic reconnection loop.
6. Add persistent settings one at a time
Once manual connection and recovery work, configure automatic connection or a kill switch if you need them. Make one change from the console, repeat the new-login and service checks, and write down its undo procedure before adding another.
When you only want to stop the tunnel, use disconnect. NordVPN says ordinary nordvpn logout invalidates the token; its --persist-token option has different behavior. Revoke exposed or unwanted tokens in your account. Token lifecycle documentation.
A server acceptance checklist before leaving the console
Treat the setup as unfinished until you can open a fresh SSH session with the tunnel active, reach the services you intend to expose and restore ordinary connectivity from the recovery console. Test from the administration device you will actually use. Record the outcome of each check, not just that the VPN status says connected.
A working outbound browser or command-line request does not establish that incoming traffic reaches the server. If this host runs containers, test their paths separately. Keep automatic connection changes for a later step, after manual recovery is repeatable.
Is LAN discovery a general fix for remote SSH?
No. The local printer and NAS guide concerns nearby trusted devices, not a guarantee of remote management access. For this server, investigate its routes, firewall rules and management path together; a wider local exception may solve the wrong problem.