My terminal is scrolling the same red text it threw at me the night before, and I already know without reading past the first line that it's systemd-resolved fighting my manually configured WireGuard tunnel again. Three empty coffee mugs are lined up next to the keyboard like evidence at a crime scene. This is yet another rebuild of this Linux VPN setup by hand since my employer's breach put the whole idea of running my own privacy stack into my head, and every time it breaks I get the same question from the next room: why not just click a button like everyone else.
She's not wrong, and that's the annoying part. I write backend services for a living, not routing tables, yet somehow debugging my own VPN's iptables rules had turned into a recurring hobby I never signed up for.
The Terminal Badge of Honor
For years the command line was a badge of honor to me, not a tool. If something didn't come with a man page and a fistful of flags, it didn't feel like real engineering. That extended straight into networking — manual WireGuard tunnels, hand-rolled iptables rules to stop leaks if the connection dropped, the whole ritual. It felt like control. What it actually was, most of the time, was maintenance.
Before I even got serious about VPN subscriptions, I tried routing all my everyday browsing through Tor Browser instead, on the theory that if a little privacy was good, a lot must be better. It didn't last. Pages that should load instantly took long enough that I'd tab away and lose my place, and a couple of the internal tools I needed for actual work simply refused to render through the Tor circuit at all. I dropped it fast — not because the threat model stopped mattering, but because a tool nobody can stand to use doesn't protect anybody. It just gets uninstalled.
My Manual Setup Started Costing Me Time
By the time my home network had a partner who just wanted the Wi-Fi to work and a shelf of IoT devices that didn't care about my principles, the manual setup stopped being a fun weekend project and started being a chore with a deadline. Somewhere around January I started cycling back through the pile of VPN subscriptions I'd accumulated since the breach, this time looking specifically for something that treated Linux like a first-class platform instead of an afterthought bolted on after the Windows and Mac apps shipped.
Most of what I tried in that stretch was disappointing. Client after client claimed Linux support and turned out to be an Electron wrapper that crashed the moment Wayland tried to render it, or a settings panel bolted onto what was really still a CLI tool underneath. Developer tools that treat Linux as real infrastructure are still rarer than they should be, and after enough rounds of sudo apt-get purge that I lost count, I was ready to give up on the idea of a GUI entirely.
Then I found a client that actually behaved like it belonged on the system rather than bolted next to it. It managed the WireGuard kernel module directly, handled DNS resolution the way a resolver is supposed to behave, and didn't ask for a sudo prompt every time I wanted to switch servers. What surprised me was that it handled edge cases I'd never gotten around to scripting myself, like a clean reconnect after the laptop woke from sleep instead of just sitting there with a dead tunnel.
Does a GUI Actually Hold Up for a Developer's Traffic?
As a developer, I can't fully wave off the CLI-purist argument. Hand-rolled WireGuard setups let you isolate VPN traffic into its own network namespace, walled off from the rest of the system, which is a genuinely stronger guarantee if you're handling production traffic you can't afford to leak. A GUI client generally doesn't offer that, and I won't pretend it does. But building a personal threat model means being honest about which risks actually apply to you day to day, and for the overwhelming majority of what I do, namespace-level isolation was a theoretical safeguard I wasn't using, not a practical one.
If that kind of isolation is genuinely part of your job, it's worth reading more before you take my word for anything here — I wrote up Best No Logs VPN for Developers Concerned About Data Privacy Audits for exactly that audience, and it goes deeper into how different providers actually structure their backend than I want to repeat in a piece about clicking buttons instead of typing commands.
Testing the Client Against My Actual Workload
One evening I pushed the client harder than usual on purpose — a full local build running in the background, a large Postgres dump restoring to a test database, and staging traffic tunneled through at the same time. In the old manual setup, this was exactly the combination that used to choke my iptables rules and leave me with a dead connection and a half-finished git push. This time the toggle in the GUI just turned green and the routing conflict that would have eaten my evening resolved itself before I noticed it happening. I still had to forward a port manually to reach one of the staging services, and a dedicated IP would have made the allowlist on that server a lot less fiddly than juggling a shared exit address, but neither one was a dealbreaker.
A few days later I was testing the same client somewhere less controlled — grabbing coffee near Pike Place Market on a break, laptop tethered to a flaky public connection, curious what would happen if the Wi-Fi dropped mid-session. The kill switch actually held the line instead of quietly leaking traffic the way a bad implementation sometimes does, which is the one feature I refuse to compromise on regardless of how good everything else looks. I'd also switched the underlying protocol from the legacy OpenVPN default to WireGuard a while back, mostly because picking the right protocol for a given connection matters more than most marketing pages let on. I thought briefly about pushing the whole thing down to the router level instead of running it per device, but a browser extension or a router-wide tunnel solves a different problem than the one I actually have, so I left it alone.
It also handles split tunneling for my home network cleanly, which means I can reach my NAS without flipping the whole connection off and back on every time I need a file. That alone probably saves me more daily friction than any of the theoretical security wins I used to argue about.
Callum Prentice, a friend I met at a Seattle privacy meetup, still isn't impressed. He's a DevOps engineer with a blanket distrust of anything networking-related he can't read the source for, and he needled me for weeks about trusting a closed-source client with my traffic. He's not wrong to be suspicious — that's a legitimate gap, and if you can't live with it, the CLI and an open-source WireGuard build are still sitting right there.
What Seven Weeks of Not Fighting My VPN Taught Me
Seven weeks of running it as my only daily driver is enough to trust the pattern: no dropped tunnels, no rebuilt routing tables, no 2 a.m. debugging sessions. Somewhere in that stretch I ran a DNS leak test mostly out of old habit rather than actual doubt, and watched every resolver that came back belong to the VPN's own infrastructure instead of my ISP — the exact test that used to embarrass me half the time when I was running things by hand. That kind of DNS leak protection is table stakes now, but it wasn't always, and it's worth checking yourself rather than trusting a settings toggle blindly.
A reader I've traded notes with for a while, Radek Soucek, emailed me a spreadsheet a while back showing how differently his connections behaved across European servers than mine did across American ones, unprompted, the way he tends to do. It was a good reminder that ISPs classify and shape traffic differently depending on where you sit, something I wouldn't have thought to test on my own setup without his numbers sitting in front of me.
None of this makes the CLI purists wrong, exactly. It just means the version of security that actually holds up is the one you keep using instead of the one you brag about at a meetup. If there's a single lesson worth carrying out of this, it's that matching your tools to the threat model you actually have — not the one that sounds most impressive — is what keeps a privacy setup running long after the novelty of typing commands wears off.