Private Internet Access on Linux: WireGuard Setup Guide

Updated October 10, 2026. This guide covers installing the PIA desktop app on Linux, controlling it from the terminal, and setting up standalone WireGuard with a shared IP or a dedicated-IP token.

Referral disclosure: This article includes my PIA referral link. I may receive a referral reward if you sign up through it. Check the checkout page for current prices, eligibility, and terms.

My short PIA review

For my Linux setup, the appeal of Private Internet Access is choice: a desktop interface when I want something simple, plus command-line tools and manual connection scripts when I want more control. PIA supports WireGuard and OpenVPN, and its Linux app includes DNS settings, split tunneling, and kill-switch controls. PIA documents these app features here.

PIA also publishes its app source code and has announced independent reviews of its no-logs systems. Those are useful transparency measures; they are not a promise that a VPN makes every online activity anonymous. Read PIA’s audit announcement.

My main tradeoff is complexity. A dedicated IP is a paid extra, and standalone WireGuard requires more attention to DNS, IPv6, reconnection, and firewall rules than the app. A stable IP is useful for services that expect a consistent address, but it also makes different sessions easier to associate with that same address. This is a practical setup review, not a speed benchmark or a streaming-unblocking test.

If PIA fits your needs, you can view the current PIA offer using my referral link.

Choose your installation route

• Desktop setup: Install the PIA app on your existing Linux system.
• Terminal control with the app installed: Use piactl. This still depends on PIA’s background service.
• Standalone WireGuard: Use PIA’s official manual scripts to register a peer and generate a configuration.

1. Install the official PIA Linux app

Start with an active PIA subscription. If you still need one, my PIA referral link is here. Dedicated IP is an optional add-on, so check that separately at checkout.

1. Sign in to your PIA account in a browser and open Downloads. Choose the Linux installer for your system’s architecture.
2. Save the .run installer in Downloads. Open a terminal in that folder.
3. Run the installer with sh, replacing the example filename below with the exact downloaded filename. Do not add sudo; the installer requests administrator authentication when needed.
4. Open PIA and sign in with your PIA credentials.

cd ~/Downloads
sh ./pia-linux-VERSION.run

The official download is a standalone installer, so you do not need to look for a PIA package in Flatpak, Snap, or your distribution’s software store. PIA lists support for several Linux distributions and init systems; check compatibility for your specific release before installing.

Reference: PIA Linux installation guide.

Configure WireGuard in the app

Open Settings → Protocols and choose WireGuard. Select a server and connect. In Network, use PIA DNS unless you have a specific alternative configuration. In General and Automation, configure launch-on-login and connection behavior for your networks. Enable the VPN Kill Switch in Privacy; consider Advanced Kill Switch if you want internet access blocked whenever the VPN is off. These options need verification on your own system after restarting.

Reference: PIA desktop settings.

2. Get and activate your dedicated-IP token

In your PIA account, purchase the Dedicated IP add-on if you need it. Use Redeem Dedicated IP, choose a location, and save the token text file immediately. PIA says the redemption screen is one-time and the chosen location cannot be changed after redemption. Keep the token in a password manager or another private backup; do not include it in screenshots or blog comments.

In the desktop app, open Settings → Dedicated IP, enter the token, and activate it. Then select the dedicated-IP entry in the server list. PIA warns that it cannot recover a lost token for you.

Reference: PIA dedicated-IP purchase and activation guide.

If you lost the downloaded token but activated it on this computer

An activated Linux installation may retain a local copy. PIA’s desktop source defines saved dedicated-IP records containing a dipToken. The following recovery example is for an installation using /opt/piavpn/etc/account.json; the location or schema may differ by version. It copies only saved dedicated-IP tokens into a root-only file and does not print your account data. This is a local recovery technique, not a guaranteed recovery service.

sudo python3 - <<'PY'
import json, os
from pathlib import Path

account = Path('/opt/piavpn/etc/account.json')
data = json.loads(account.read_text())
tokens = [entry.get('dipToken') for entry in data.get('dedicatedIps', [])]
tokens = list(dict.fromkeys(t for t in tokens if isinstance(t, str) and t))
if not tokens:
    raise SystemExit('No saved dedicated-IP token found. Stop here.')
target = Path('/var/lib/pia-dedicated-ip-token.txt')
fd = os.open(target, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
with os.fdopen(fd, 'w') as output:
    output.write('\n'.join(tokens) + '\n')
print('Saved recovered token(s) to a root-only file:', target)
PY

Read that file privately when entering the token, for example with sudo less /var/lib/pia-dedicated-ip-token.txt. Do not uninstall PIA or delete its account data before recovery. If there is no saved copy, your PIA username and password cannot simply recreate the original dedicated-IP token.

Reference: PIA’s dedicated-IP data model.

3. Control the PIA app from the terminal

With the PIA app installed, these commands show the selected region and connection state. Set WireGuard in the app first. Use an exact region ID from the regions list; dedicated-IP entries appear after activation.

piactl get regions
piactl get region
piactl connect
piactl get connectionstate
piactl get vpnip

To activate a saved token file through the CLI:

piactl dedicatedip add /path/to/your-token.txt
piactl get regions
piactl set region YOUR_DEDICATED_REGION_ID
piactl connect

Replace the paths and region placeholder before running them. If piactl is not found, use /opt/piavpn/bin/piactl. This is app-backed automation, not a standalone WireGuard installation.

Reference: PIA command-line reference.

4. Install the standalone WireGuard tools

Use the commands for your distribution, not every block. The manual scripts also need Git, curl, and jq. A working resolvconf implementation is needed if you want the scripts to set PIA DNS through wg-quick.

Ubuntu, Debian, and Linux Mint

sudo apt update
sudo apt install git curl jq wireguard-tools

Fedora

sudo dnf install git curl jq wireguard-tools

Arch Linux

sudo pacman -Syu git curl jq wireguard-tools

openSUSE

sudo zypper install git curl jq wireguard-tools

Check whether resolvconf is already provided before installing anything extra. Ubuntu releases using systemd-resolved may already supply a compatibility command. Where needed, Debian/Ubuntu repositories offer resolvconf, and Fedora/Arch offer openresolv. On openSUSE, check your release’s resolver integration. Review the package transaction: if it would replace or conflict with your existing DNS manager, stop and use that manager’s documented integration instead. Do not accept a working tunnel with unintended DNS fallback.

command -v wg
command -v wg-quick
command -v resolvconf

Reference: WireGuard’s distribution installation reference.

Reference: Ubuntu systemd-resolved compatibility command.

Reference: Fedora openresolv package.

5. Standalone WireGuard without a dedicated-IP token

Without a dedicated-IP token means using a shared PIA server. You still need an active PIA account. PIA’s scripts obtain an account authentication token and register a WireGuard key; that authentication token is different from the dedicated-IP token.

git clone https://github.com/pia-foss/manual-connections.git
cd manual-connections
less run_setup.sh
sudo ./run_setup.sh

Review the downloaded scripts before running them as root. In the prompts, enter your PIA username and password, answer No to dedicated IP, choose a region, select WireGuard, and leave port forwarding off unless you need it. For this IPv4 tunnel, choose the script’s IPv6-disable option and enable PIA DNS once resolver support is ready. Do this locally: changing a default route can interrupt a remote session.

Reference: PIA manual connection guide.

6. Standalone WireGuard with a dedicated-IP token

Use the same repository and setup script. This time answer Yes to dedicated IP and supply your saved token. Continue with WireGuard, PIA DNS, and the IPv6 choice appropriate to this IPv4 setup. The dedicated-IP branch obtains the endpoint associated with the token instead of choosing an ordinary shared region.

The current script displays the dedicated-IP token during setup. Keep the terminal private, turn off terminal recording, and redact any logs before sharing them. Avoid putting passwords or tokens directly into commands saved in shell history.

To generate a configuration without starting the tunnel immediately, use:

sudo env PIA_CONNECT=false PIA_CONF_PATH=/etc/wireguard/pia.conf ./run_setup.sh
sudo chmod 600 /etc/wireguard/pia.conf

The generated file contains a private WireGuard key. Treat it like a password. The dedicated-IP option is implemented in PIA’s manual scripts, but PIA’s separate dedicated-IP support article limits manual router support. This walkthrough is for Linux; do not assume every router is supported.

Reference: PIA setup-script implementation.

7. Start WireGuard and check the connection

If you generated the configuration without connecting, start it with:

sudo wg-quick up pia
sudo wg show pia
curl --fail --max-time 20 https://api.ipify.org
printf "\n"

If the setup script already brought up pia, skip the first command. Check for a recent handshake and increasing transfer counters. The public-IP check should show a PIA address; for dedicated IP, compare it with your assigned address. Do not publish your private key or full configuration when asking for help.

Reference: WireGuard quick start.

Also inspect the active DNS configuration with resolvectl status on systemd-resolved systems or your distribution’s resolver tools. Check browser-visible IPv4, IPv6, and DNS behavior. A public-IP check alone does not establish that DNS and IPv6 are protected.

Alternative: import the configuration into NetworkManager

If your desktop uses a recent NetworkManager, generate the configuration with PIA_CONNECT=false first, then import it instead of starting wg-quick:

sudo nmcli connection import type wireguard file /etc/wireguard/pia.conf
nmcli connection show

Use the exact imported connection name shown in the output. Review its DNS, routing, and IPv6 settings in your desktop network editor before activating it. Some editors offer an import-from-file button; support varies by desktop and version. NetworkManager manages the connection profile, but does not renew PIA’s peer registration or automatically provide a persistent kill switch. Choose this route or wg-quick, not both for the same tunnel.

Reference: NetworkManager connection import reference.

8. Startup, reconnection, and the kill-switch distinction

On a systemd-based installation, you can enable startup using the generated configuration:

sudo systemctl enable wg-quick@pia
systemctl is-enabled wg-quick@pia
systemctl status wg-quick@pia

If the interface is already active from the script, enable the unit for the next boot rather than trying to start a second instance now. A configuration is not guaranteed to remain usable forever: server changes and peer-registration validity can require running PIA’s setup again. A reliable unattended setup needs a renewal/re-registration strategy as well as connection monitoring.

Startup is not a kill switch. The stock generated configuration routes IPv4 through the tunnel while it is active, but does not itself provide a persistent firewall policy before startup or after shutdown. The setup script’s IPv6 change is runtime-only; do not assume it survives reboot. For a beginner-friendly always-on setup, the PIA app’s connection automation and Advanced Kill Switch are the easier route. A standalone setup needs separate, tested DNS, IPv6, and firewall rules tailored to your machine.

Reference: PIA’s generated WireGuard configuration.

WireGuard’s manual includes an example firewall kill switch, but its teardown hook removes that rule when the interface goes down. It is not equivalent to a persistent boot-time firewall. Keep a local recovery path before testing any firewall or deliberately dropping a VPN connection.

Reference: wg-quick DNS, routing, and firewall documentation.

Quick troubleshooting

• DNS error: Check the resolver dependency and the active DNS manager. Do not fix it by silently removing DNS protection.
• No handshake: Confirm account status, endpoint reachability, and that the generated peer registration is current.
• Wrong dedicated IP: Check the token and selected dedicated-IP region. A normal server selection uses a shared IP.
• Works until reboot: Check startup service status, resolver integration, and whether IPv6/firewall settings persist.
• Two VPNs fighting over routes: Choose one connection manager. Plan the switch between the PIA app and standalone WireGuard rather than running both blindly.

Who I would recommend this to

PIA is worth considering if you want a Linux desktop app with room to grow into terminal automation. Start with the official app if you want the simplest maintenance path. Use standalone WireGuard when you are comfortable maintaining the surrounding network configuration. Choose dedicated IP for a consistent exit address, and shared IP when you do not need one.

Ready to try it? Check PIA’s current plans through my referral link. Compare the subscription and dedicated-IP add-on prices before buying.