Compare offers and check the full cost before you choose.
If NordVPN reports Permission denied accessing /run/nordvpn/nordvpnd.sock, start with your Linux user's group membership. NordVPN's socket troubleshooting guide recommends adding the user to the nordvpn group and restarting the computer.
This guide helps you check that the change reached the right account. It applies to the installed NordVPN Linux app; a browser extension or manual OpenVPN connection follows a different path. You do not need a new subscription to repair a local permission problem.
1. Identify the Linux user and current groups
Open a terminal as your ordinary desktop user, not inside a root shell or sudo su session:
id -un
id -nG
The first line identifies the account; the second lists the current process's groups. If the username is root, leave that shell and open a terminal from your desktop account. The Linux id manual explains these options.
Write down the username before proceeding. On a shared computer, fixing another person's account does not establish that yours has access.
2. Add your user to the NordVPN group
From that ordinary user terminal, run the provider's command with the username variable quoted:
sudo usermod -aG nordvpn "$USER"
Keep the -a flag. With -G, it appends a supplementary group; omitting it can replace existing supplementary memberships. See the usermod manual.
If the command reports that the group does not exist, stop here. Review the original installation output and your package method; creating a group yourself does not establish that the app was installed correctly. Use the Ubuntu Desktop guide or Fedora guide to check the installation workflow.
Save your work and reboot using your desktop's restart option, as NordVPN instructs. If this is a remote server, arrange console access before rebooting; the headless Ubuntu guide covers that separate setup.
3. Verify after restarting
Log back into the same account, open a fresh terminal, and run:
id -nG
nordvpn status
Look for nordvpn in the group list. If the permission error disappears, the access step has succeeded. A disconnected status is a separate connection state: group membership does not sign you in or establish a VPN tunnel.
If your account belongs to the group but the same error remains, collect the exact message rather than repeating the account change. This narrows the question for support: membership was checked after a reboot, yet access still failed.
Permission denied versus socket not found
These messages call for different next steps:
- Permission denied: follow the account and group checks above.
- Socket not found: investigate the app's background service and installation. NordVPN's linked socket guide provides service-recovery steps for this message.
- Command not found: the shell cannot locate the CLI; go back to the installation method.
- Status works, but connection fails: record the new connection error. The socket access problem is no longer the only issue.
Do not make the socket world-writable or delete it as a shortcut. Those changes do not explain why the expected access failed and can be overwritten when the service starts again.
What to send support if it still fails
Include your distribution and release, installation method, the complete error, and whether nordvpn appeared in id -nG after reboot. Redact account details and tokens from screenshots. Describe each step you tried and its result; an exact sequence is more useful than “I reinstalled several times.”
Already choosing a VPN for another machine? Compare Linux support before buying. Repairing an existing installation and selecting a subscription are different decisions.
What a successful permissions fix does and does not prove
The useful outcome is that the same ordinary user can run the status command without the socket-access error. That shows the local access check passed. It does not establish account login, a working VPN connection or correct DNS routing. Continue with one of those checks only after the original error is gone.
If a new terminal works but an older window still fails, compare their group lists before reinstalling. Processes inherit their session's credentials; a new account membership is not evidence that an already running session uses it. Follow the documented reboot step when establishing a clean result.
What if I can check status but cannot reach a NAS?
Keep that as a separate diagnosis. Use the NordVPN local network guide instead of changing socket permissions again. The Ubuntu installation guide covers the normal connection workflow after access is restored.