Do I have to know the command line to install a VPN/VLESS on Linux in Iran?

Not necessarily, but the command line is the most universal path. If you'd rather not touch it, use a client with a GUI/web UI: v2rayA (a daemon you operate from the browser, popular on Linux desktops in Iran and elsewhere), nekoray/nekobox (a Qt GUI client, just download the AppImage), or the Linux builds of Hiddify or the clash family (mihomo / clash-verge-rev) — you import the subscription and pick nodes in the interface. If you're a server/advanced user, running the sing-box or xray-core CLI and editing a single JSON config is actually the most stable and best suited to an always-on service. Both paths use the same VLESS+Reality subscription.

How do I make the 'whole machine' use the VPN on Linux, not just the browser?

Use TUN mode. sing-box has a built-in tun inbound (or use tun2socks) that creates a virtual interface capturing the whole machine's traffic, closest to the global mode on Windows/Mac. The cost is that it needs root or CAP_NET_ADMIN to create the interface and change the routing table. If you only opened a local SOCKS/HTTP proxy port, then only the programs you explicitly point at it (a browser set to the proxy, or programs launched via proxychains) go through the tunnel, while everything else stays direct — and not every program honors a SOCKS proxy (many CLI tools and UDP programs leak). Want the whole machine stable — use TUN; want only the browser tunneled — the SOCKS proxy is lighter. Don't forget split-routing so domestic traffic goes direct.

Does using VLESS on Linux mean it definitely won't be blocked?

No such guarantee. Iran's blocking is at the protocol layer: deep packet inspection (DPI) probes and throttles or cuts suspicious encrypted traffic, VLESS included. VLESS+Reality survives better because it disguises traffic as ordinary HTTPS to a real major site with almost no unique fingerprint — but the resilience comes from Reality's disguise configuration, not the protocol name; a poorly configured VLESS gets cut too, with no guarantee. And during a national shutdown or a period when only the domestic network (NIN) is left, any foreign tunnel goes down together, regardless of whether you're on Linux or another OS. Switching OS doesn't change the protocol fight.

Home › Guides › How to Install and Use a VPN/VLESS Client on Linux in Iran — an Honest Explanation (Linux Is the Least App-Store-Restricted Platform: No Store Lock, You Grab the Binary/AppImage/.deb Straight From Official GitHub and Run It; but the Big Difference From Windows/Mac Is That Linux Clients Are More Command-Line/Manual — Either Edit a JSON Config to Run sing-box/xray, or Use a GUI/Web-UI Like v2rayA/nekoray; Whole-Machine TUN Needs root or CAP_NET_ADMIN, Otherwise You Proxy Per-App Over SOCKS; and Iran's Crucial Step Is Split-Routing — Keep Domestic Sites, Shaparak Banking and Gov Sites Direct; the Real Battle Is Still Whether Your Protocol Survives Iran's DPI) and a More Reliable Approach (VLESS+Reality with a systemd Service)

How to Install and Use a VPN/VLESS Client on Linux in Iran — an Honest Explanation (Linux Is the Least App-Store-Restricted Platform: No Store Lock, You Grab the Binary/AppImage/.deb Straight From Official GitHub and Run It; but the Big Difference From Windows/Mac Is That Linux Clients Are More Command-Line/Manual — Either Edit a JSON Config to Run sing-box/xray, or Use a GUI/Web-UI Like v2rayA/nekoray; Whole-Machine TUN Needs root or CAP_NET_ADMIN, Otherwise You Proxy Per-App Over SOCKS; and Iran's Crucial Step Is Split-Routing — Keep Domestic Sites, Shaparak Banking and Gov Sites Direct; the Real Battle Is Still Whether Your Protocol Survives Iran's DPI) and a More Reliable Approach (VLESS+Reality with a systemd Service)

Updated 2026-07-05

Diagram: installing a VPN/VLESS on Linux in Iran — the good news is that Linux is the least app-store-restricted platform, no App Store lock, you grab the binary/AppImage/.deb straight from official GitHub and run it, sidestepping the removal; but the big difference from Windows/Mac is that Linux is more command-line/manual: the most universal path is running the sing-box or xray-core CLI and editing a JSON config yourself, for a GUI use nekoray (Qt), v2rayA (a web-UI daemon), or the Linux builds of Hiddify/mihomo; whole-machine TUN takeover needs root/CAP_NET_ADMIN, otherwise you proxy per-app over SOCKS (proxychains/env vars); to run it always-on write a systemd service; Iran's crucial step is split-routing — keep domestic sites/Shaparak banking/gov sites direct; the real battle is still the protocol — Iran's DPI throttles, so on Linux too you must use a well-configured VLESS+Reality, with no guarantee.

Bottom line first: Linux isn't store-locked, but the clients are more command-line

Getting out on Linux in Iran has a natural advantage: it's the least app-store-restricted platform — there's no App Store-style lock, and you run the binary, AppImage or .deb/.rpm straight from official GitHub, so 'US sanctions pushed VPN apps out of Iran's stores' simply isn't a problem on Linux. The cost: Linux clients are more command-line/manual — there's no polished one-click GUI like on Windows/Mac. The two most universal paths: (1) run the sing-box or xray-core CLI and edit a JSON config yourself; (2) use a GUI/web wrapper (the Linux builds of nekoray, v2rayA, Hiddify, or the mihomo family). Below: choosing a client, the TUN vs per-app-proxy trade-off, systemd, and Iran-specific split-routing.

Which clients exist on Linux: sing-box / xray CLI, or v2rayA / nekoray

The main ways to land VLESS+Reality on Linux: (1) sing-box (CLI) — one binary, one JSON config, the most complete and the best to run as an always-on service; the top pick for servers/advanced users; (2) xray-core (CLI) — also CLI+JSON, the reference implementation of VLESS+Reality; (3) v2rayA — a daemon with a web UI, popular among Linux desktop users in Iran and elsewhere; you import the subscription and pick nodes in the browser, with xray/sing-box underneath; (4) nekoray/nekobox — a Qt GUI client, cross-platform with a Linux build; (5) Hiddify and the clash family (mihomo / clash-verge-rev AppImage) also have Linux builds. Want it easy — use v2rayA/nekoray; want the most stable always-on setup — use the sing-box CLI directly. They use the same subscription as your phone/Windows client.

The key trade-off: whole-machine TUN (needs root) or per-app SOCKS proxy

There are two levels of sending traffic through the tunnel on Linux — be clear on the difference: (1) whole-machine TUN takeover — sing-box has a built-in tun inbound (or use tun2socks) that creates a virtual interface capturing the whole machine's traffic, closest to the 'global mode' of Windows/Mac; but it needs root or CAP_NET_ADMIN to create the interface and change routes. (2) per-app SOCKS proxy — the client just opens a local SOCKS/HTTP port and you point a browser, or use proxychains / env vars (http_proxy/https_proxy), at a specific program; the catch is that not every program honors the proxy (especially CLI tools and UDP programs), so leaked traffic still goes direct. Want 'the whole machine stable' — use TUN; want only the browser/specific programs tunneled — the SOCKS proxy is lighter.

Want it always-on / at boot: write a systemd service

If you want it to start at boot, auto-reconnect on drop, and stay resident on a headless server (e.g. on a little home box or a VPS acting as a gateway for the whole LAN), the most stable approach is to run sing-box/xray as a systemd service: a .service unit pointing at the binary and config, systemctl enable --now to make it resident, and journalctl for logs. Many distros' official packages already ship a service file. Note that in TUN mode the service needs the right privileges (run as root, or grant the binary CAP_NET_ADMIN), and be sure to configure your split-routing rules — which in Iran is the single most important step.

Iran's crucial step: always split-route (domestic/banking/gov direct)

This matters more in Iran than almost anywhere: set Iranian domestic sites (داخلی / the National Information Network, NIN), Shaparak banking gateways and government sites to go direct, and send only blocked/throttled foreign sites through the tunnel. Three reasons: the domestic network is faster and cheaper and often isn't counted against your international data quota; many Iranian bank and government sites outright reject foreign IPs, so tunneling them locks you out of online banking and gov services; and split-routing also saves CPU on your machine/router. sing-box/xray routing rules, or v2rayA's routing settings, can split by domain/region — and on Linux, configuring these rules from the CLI is actually the most flexible.

Configuration steps: install a client → import the subscription → pick TUN or SOCKS → set split-routing → verify

Install a client: advanced/server — sing-box or xray-core (grab the binary from official GitHub, or use your distro's package manager); want a UI — v2rayA (install the daemon + open the browser) or nekoray (download the AppImage).
Import your VLESS+Reality subscription: with the CLI, put the node into the JSON config; with v2rayA/nekoray, paste the subscription link and pick nodes (the same subscription as your phone/Windows).
Pick the takeover mode: for whole-machine, enable TUN (sing-box tun inbound or tun2socks, needs root/CAP_NET_ADMIN); for just the browser/specific programs, use the local SOCKS port + proxychains/browser proxy settings.
Set Iran split-routing: keep Iranian domestic sites, داخلی/NIN, Shaparak banking and government sites direct, and send only blocked/throttled foreign sites through the tunnel.
Want it resident — write a systemd service: a .service unit + systemctl enable --now, journalctl for logs.
Verify: open a blocked foreign site to confirm it works; confirm local online banking and gov sites still go direct; use curl --interface or journalctl on the CLI to troubleshoot.

Honest limits and checklist

Linux clients are more command-line — sing-box/xray means editing JSON; for a GUI use v2rayA/nekoray.
Whole-machine TUN needs root or CAP_NET_ADMIN; without TUN you proxy per-app over SOCKS, and not every program honors it.
Iran's most important step is split-routing: keep domestic sites/Shaparak banking/gov sites direct, only foreign sites through the tunnel, or you lock yourself out of local services.
Pick the right protocol: on Linux too you must use a well-configured VLESS+Reality — Iran's DPI probes/throttles suspicious encrypted traffic.
No guarantees: a poorly configured VLESS gets cut too; during a national shutdown / NIN-only period any foreign tunnel goes down together.
Don't grab binaries from unofficial sources — use the official GitHub releases or your distro's official repos to avoid a planted backdoor; verify checksums.

In summary: Linux's advantage is that it's unaffected by store removals — you run the client straight from the official source, and can even make it a systemd service resident on a server; the cost is that it's more command-line/manual, whole-machine TUN needs root, and per-app proxying isn't honored by every program. Want it easy — use the v2rayA/nekoray GUI; want the most stable always-on setup — sing-box CLI + systemd. And in Iran, don't forget the single most important step: split-routing — keep domestic/banking/gov direct, only foreign traffic through the tunnel. Whether you actually connect still comes down to the protocol fight: use a well-configured VLESS+Reality, and for the desktop approach see the Windows guide.

FAQ

Do I have to know the command line to install a VPN/VLESS on Linux in Iran?: Not necessarily, but the command line is the most universal path. If you'd rather not touch it, use a client with a GUI/web UI: v2rayA (a daemon you operate from the browser, popular on Linux desktops in Iran and elsewhere), nekoray/nekobox (a Qt GUI client, just download the AppImage), or the Linux builds of Hiddify or the clash family (mihomo / clash-verge-rev) — you import the subscription and pick nodes in the interface. If you're a server/advanced user, running the sing-box or xray-core CLI and editing a single JSON config is actually the most stable and best suited to an always-on service. Both paths use the same VLESS+Reality subscription.
In Iran, why is split-routing so important?: Because Iran's domestic network and foreign access must be kept separate. Set Iranian domestic sites (داخلی / the National Information Network, NIN), Shaparak banking gateways and government sites to go direct, and send only blocked or throttled foreign sites through the tunnel. Three reasons: the domestic network is faster and cheaper and often isn't counted against your international data quota; many Iranian bank and government sites outright reject foreign IPs, so if you tunnel them too you get locked out of online banking and gov services; and split-routing saves CPU on your machine/router. sing-box/xray routing rules or v2rayA's routing settings can split by domain/region, and on Linux configuring these rules from the CLI is actually the most flexible.
How do I make the 'whole machine' use the VPN on Linux, not just the browser?: Use TUN mode. sing-box has a built-in tun inbound (or use tun2socks) that creates a virtual interface capturing the whole machine's traffic, closest to the global mode on Windows/Mac. The cost is that it needs root or CAP_NET_ADMIN to create the interface and change the routing table. If you only opened a local SOCKS/HTTP proxy port, then only the programs you explicitly point at it (a browser set to the proxy, or programs launched via proxychains) go through the tunnel, while everything else stays direct — and not every program honors a SOCKS proxy (many CLI tools and UDP programs leak). Want the whole machine stable — use TUN; want only the browser tunneled — the SOCKS proxy is lighter. Don't forget split-routing so domestic traffic goes direct.
Does using VLESS on Linux mean it definitely won't be blocked?: No such guarantee. Iran's blocking is at the protocol layer: deep packet inspection (DPI) probes and throttles or cuts suspicious encrypted traffic, VLESS included. VLESS+Reality survives better because it disguises traffic as ordinary HTTPS to a real major site with almost no unique fingerprint — but the resilience comes from Reality's disguise configuration, not the protocol name; a poorly configured VLESS gets cut too, with no guarantee. And during a national shutdown or a period when only the domestic network (NIN) is left, any foreign tunnel goes down together, regardless of whether you're on Linux or another OS. Switching OS doesn't change the protocol fight.

The service you're trying to reach is blocked. Restore access — free.

Back online in about 2 minutes — no credit card. A working VLESS + Reality route on iOS, Android, Windows and macOS.

Free 1 GB/day
·
No credit card
·
VLESS + Reality in 60 seconds

You and your friend each get +30 bonus days plus bonus traffic once they start using Univista.

Restore access — free

Telegram WhatsApp

Already subscribed? Help for import & troubleshooting.

Ready for reliable international access?

View plans

This article is for technical education only. Comply with local laws when using network tools. Univista is not liable for how you use the service.