Install S33D VPN on Linux

The Linux client installs from our signed APT repository, like any other system package. It updates along with the rest of the machine.

What you need

Debian, Ubuntu or a derivative distribution, on amd64.
A kernel with WireGuard — true since Linux 5.6, so everywhere today.
root privileges to bring a tunnel up. Not for anything else.

wireguard-tools is installed automatically: the package declares it as a dependency.

1. Add the repository

Once, as root:

install -d -m 755 /etc/apt/keyrings
curl -fsSL https://repo.s33d.fr/s33d.gpg -o /etc/apt/keyrings/s33d.gpg

cat > /etc/apt/sources.list.d/s33d.sources <<'END'
Types: deb
URIs: https://repo.s33d.fr
Suites: stable
Components: main
Architectures: amd64
Signed-By: /etc/apt/keyrings/s33d.gpg
END

Why a key, and which one. APT refuses a repository whose signature it cannot verify. The key above is ours: you install it yourself, knowingly, and APT will from then on only accept packages signed with it. That is what guarantees no intermediary can serve you anything other than what we published.

2. Install

apt update
apt install s33d-vpn

3. Use

First, link your S33D account. This step opens your browser and does not require root:

s33d-vpn connexion

Then pick an exit country:

s33d-vpn pays
sudo s33d-vpn connecter FR

And to see where you stand, or close the tunnel:

s33d-vpn etat
sudo s33d-vpn deconnecter

On a headless machine, s33d-vpn connexion prints the authentication address before trying to open a browser. Open it from another computer: the return leg lands on the server's loopback, which you can reach through an SSH port forward (ssh -L 47821:127.0.0.1:47821 …).

All commands

Command	Effect	Root
`s33d-vpn connexion`	Links your S33D account	no
`s33d-vpn pays`	Lists the available exit countries	no
`s33d-vpn connecter FR`	Brings the tunnel up towards a country	yes
`s33d-vpn etat`	Status, connection time, volume exchanged	no
`s33d-vpn deconnecter`	Closes the tunnel	yes
`s33d-vpn deconnexion`	Forgets the account, leaves the tunnel alone	no

What about your local network?

It stays reachable. On Linux, your printer, your NAS and your local machines keep answering while the tunnel carries your internet traffic. There is nothing for you to configure.

Updates

The client follows system updates: apt upgrade refreshes it like everything else. Nothing to download by hand, nothing to keep an eye on.

Notify me at launch