Choose the connection method first
For Manjaro, a useful documented route is a manual WireGuard connection. Surfshark names Manjaro in its Linux WireGuard guide, while its native Linux app requirements list Ubuntu, Debian, and Mint. A community package being available does not establish the same native-app support commitment.
Here you will use either wg-quick in a terminal or a NetworkManager profile that can be controlled from desktop network settings. The latter is a GUI for a manual connection, not Surfshark’s own app.
Verification: documentation reviewed September 8, 2026. We have not authenticated to Surfshark or tested these steps with a live provider configuration. Use this on a local desktop where you can recover connectivity, not through your only remote session.
1. Prepare Manjaro
You need an active subscription, administrator access, and a current Manjaro system. Install the tools with a full package update:
sudo pacman -Syu wireguard-tools
This command can update other system packages too. Read the transaction before accepting and follow any system-update instructions. Manjaro recommends this update-and-install pattern to avoid partial upgrades. Manjaro Pacman overview.
Check tool availability:
wg --version
This confirms the tool is installed; it does not establish a VPN connection.
2. Obtain a private configuration
In your Surfshark account, open VPN → Manual setup → Desktop or mobile → WireGuard. Follow the account steps to supply or generate a key pair, select a server, and download its configuration. Keep it private: a configuration can contain your private key. The provider walkthrough shows the current account screens.
For the examples below, rename that downloaded file to surfshark.conf in your Downloads folder. This is a filename convention, not a configuration we supply. Use the values generated for your account rather than copying keys, IPs, or endpoints from someone else’s example.
3A. Connect from the terminal
Choose this route if you want to manage the tunnel with wg-quick. Do not also activate the same configuration through NetworkManager.
Create a protected destination and copy the file there. If /etc/wireguard/surfshark.conf already exists, stop and choose a different name rather than overwrite an existing setup.
sudo install -d -m 700 /etc/wireguard
sudo install -m 600 "$HOME/Downloads/surfshark.conf" /etc/wireguard/surfshark.conf
Then bring up the interface:
sudo wg-quick up surfshark
Generate some traffic, then inspect its handshake and transfer information:
sudo wg show surfshark
If startup fails with resolvconf missing, address DNS integration before proceeding. The DNS field in a wg-quick profile uses resolvconf; deleting that field merely to suppress the error can leave DNS behaving differently than intended. Choose a resolver integration appropriate for your system, or use the NetworkManager route below. wg-quick manual.
To end this connection:
sudo wg-quick down surfshark
A plain manual profile does not automatically inherit the Surfshark app’s kill switch. This walkthrough does not add one or configure automatic startup.
3B. Use NetworkManager instead
Choose this route instead of 3A if you want a persistent profile available to desktop network controls. If you already brought the interface up with wg-quick, bring it down first.
On a system using NetworkManager, import the downloaded file:
nmcli connection import type wireguard file "$HOME/Downloads/surfshark.conf"
The import may request authorization and can activate the profile depending on its settings. Run it locally, then immediately inspect active connections. Note the profile name printed by the import; do not assume it always matches the filename.
nmcli connection show
nmcli connection show --active
Find the imported profile in your desktop network settings to connect or disconnect it. If it is not exposed in your desktop’s menus, use nmcli connection up or nmcli connection down with the exact imported profile name. Review its automatic-connection setting if you only want to connect manually. NetworkManager’s WireGuard explanation, nmcli reference.
4. Verify the traffic path
A listed profile, an active interface, and a working tunnel are different observations. Compare your public IP before and after connection, test DNS behavior, and check IPv6 as well as IPv4 if your network offers both. Surfshark’s Manjaro setup guide links its IP and DNS checks.
If the public IP stays unchanged or DNS does not behave as expected, stop and review the imported routes and DNS settings. Do not treat “connected” as sufficient evidence. Containers, virtual machines, and applications with their own proxies need separate checks; this desktop walkthrough does not validate those paths.
When another route makes more sense
If you prefer OpenVPN, Surfshark also publishes a Manjaro-specific OpenVPN walkthrough. It uses service credentials from manual setup rather than your ordinary account password.
If you primarily want the provider’s own app and its settings, compare the officially listed distributions and desktop environments before deciding that a community GUI package is the right fit.