Surfshark on Manjaro: manual WireGuard and NetworkManager setup

For Manjaro, we’d choose Surfshark’s manual WireGuard setup. The provider explicitly names Manjaro in its WireGuard guide; its native app requirements list Ubuntu, Debian, and Mint.

Pick one way to control the tunnel:

• wg-quick for terminal commands.
• NetworkManager for a profile you can manage through desktop network settings.

Neither route gives you the Surfshark app’s interface or automatically adds its kill switch. Community app packages are another option, but check who maintains them and provides support.

Work locally so a network interruption won’t lock you out.

Update Manjaro and install WireGuard tools

You need an active subscription, administrator access, and a current Manjaro system. Install the tools with a full package update:

sudo pacman -Syu wireguard-tools

This also updates system packages. Review the transaction and follow the update instructions; Manjaro recommends updating and installing together to avoid partial upgrades. Manjaro Pacman overview.

Check tool availability:

wg --version

Get your WireGuard configuration

In your Surfshark account, open VPN → Manual setup → Desktop or mobile → WireGuard. Follow the account steps to supply or generate a key pair, select a server, and download its configuration. Keep it private: a configuration can contain your private key. The provider walkthrough shows the current account screens.

Save your account’s downloaded configuration as surfshark.conf in your Downloads folder. The commands below use that filename. Don’t substitute keys or endpoints copied from a tutorial.

Option A: control the tunnel with wg-quick

Use this section for terminal control, and skip Option B. Running the same profile through both tools can create conflicting connections.

Create a protected destination and copy the file there. If /etc/wireguard/surfshark.conf already exists, stop and choose a different name rather than overwrite an existing setup.

sudo install -d -m 700 /etc/wireguard
sudo install -m 600 "$HOME/Downloads/surfshark.conf" /etc/wireguard/surfshark.conf

Then bring up the interface:

sudo wg-quick up surfshark

Generate some traffic, then inspect its handshake and transfer information:

sudo wg show surfshark

If you get a resolvconf error: the profile’s DNS field relies on that tool. Set up resolver integration for your system or switch to NetworkManager below. Deleting the DNS field may silence the error while leaving name resolution misconfigured. wg-quick manual.

To end this connection:

sudo wg-quick down surfshark

This setup leaves automatic startup unconfigured.

Option B: import into NetworkManager

We’d use this route for a desktop already managed by NetworkManager. Bring down any wg-quick connection from Option A before importing.

On a system using NetworkManager, import the downloaded file:

nmcli connection import type wireguard file "$HOME/Downloads/surfshark.conf"

The import may request authorization and activate the profile. Note the profile name it prints—it may differ from the filename—then check which connections are active:

nmcli connection show
nmcli connection show --active

Find the imported profile in your desktop network settings to connect or disconnect it. If it isn’t exposed in your desktop’s menus, use nmcli connection up or nmcli connection down with the exact imported profile name. Review its automatic-connection setting if you only want to connect manually. NetworkManager’s WireGuard explanation, nmcli reference.

Check the traffic, not just the profile

Compare your public IP before and after connecting. Test DNS behavior and, if your network supports it, IPv6 as well as IPv4. Surfshark’s Manjaro setup guide links its IP and DNS checks.

If the public IP stays the same or DNS looks wrong, inspect the profile’s routes and DNS settings before relying on it. Check containers, virtual machines, and apps with their own proxies separately; their traffic may take a different path.

Prefer OpenVPN or a provider app?

If you prefer OpenVPN, Surfshark also publishes a Manjaro-specific OpenVPN walkthrough. It uses service credentials from manual setup rather than your ordinary account password.

If you primarily want the provider’s own app and its settings, compare the officially listed distributions and desktop environments before deciding that a community GUI package is the right fit.

Keep Manjaro packaging separate from VPN account setup

A package-manager error belongs to the system-update step; a missing private key or incomplete endpoint belongs to the downloaded profile. Resolve those separately. Keep Manjaro fully updated using its supported package workflow before attempting to explain a network failure as a VPN problem.

Once the tools are available, choose one connection manager and record the imported profile or interface name. If you switch between NetworkManager and wg-quick, disconnect the previous method first. Recheck routes and DNS after the switch rather than assuming the same filename produces identical behavior.

Is this the native Surfshark Linux app?

No. These steps manage a manual account configuration with standard Linux tools. Native app support and community packages are separate questions. Our Linux compatibility guide distinguishes those routes, and the NordVPN versus Surfshark comparison helps compare the buying decision.