1. Live Chat, VPN Setup, Troubleshooting | NordVPN Customer Support
  2. Troubleshooting and VPN issues
  3. Issues with VPN connection
  4. I can't connect from China

I can’t connect from China on Linux

Introduction

The NordVPN Linux application is fully blocked in China; therefore, you will need to connect via a manual IKEv2/IPsec connection method, which is described in this article.

Before you start

  • Ensure you can log in to your Nord Account.
  • Make sure you can access your email account.

Here’s what to do

NOTE: If you use a different package manager, replace apt-get with the one you use.

  1. Make sure your operating system is up-to-date with this command:
      
    sudo apt-get update && sudo apt-get upgrade
     
  2. Download the packages by running these commands in the terminal:

    sudo apt-get install strongswan libcharon-extra-plugins 

    NOTE: For Arch-based distributions and others, you might not have libcharon packages, as they are in the strongswan package. Therefore, run this command instead:

    pacman -S strongswan
     
  3. Open the “ipsec.secrets” file. NOTE: Copy-pasting the command may lead to issues. It would be best to type it out by hand.

    sudo nano /etc/ipsec.secrets
     
  4. Change the username and “your password” as follows:
     
    1. Log in to your Nord Account.
    2. Click “NordVPN” on the left side of the browser.
    3. Click on “Set up NordVPN manually.”
    4. Click "Service credentials."
    5. Click "Verify email." 
    6. You will receive a verification code in your registered email. Type the code in.
    7. Use the “Copy” button to copy the service credential username and paste it into the “Username” string.
    8. Use the “Copy” button to copy the service credential password and paste it into the “Password” string. The password must be enclosed in double quotes.
      NOTE: Make sure to have a space between username,:, and EAP.
       
  5. Save and open the “/etc/ipsec.conf” file with root privileges:

    sudo nano /etc/ipsec.conf
     
  6. Write this into the configuration file:

    conn NordVPN
keyexchange=ikev2
dpdaction=clear
dpddelay=300s
eap_identity=”Username”
leftauth=eap-mschapv2
left=%defaultroute
leftsourceip=%config
right=SERVER_IP
rightauth=pubkey
rightsubnet=0.0.0.0/0
rightid=%SERVER_HOSTNAME
rightca=/etc/ipsec.d/cacerts/NordVPN.pem
type=tunnel
auto=add
     
  7. Change Username to your NordVPN service credentials username from step 4. Fill in the “SERVER_IP” and “SERVER_HOSTNAME” fields with the servers below:
    NOTE: The “SERVER_IP” field requires an IP such as 23.92.26.69, whereas the “SERVER_HOSTNAME” field requires a hostname such as us5783.nordvpn.com. Make sure the IP matches the correct hostname.
     
    1. 23.92.26.69 - us5783.nordvpn.com
    2. 66.175.219.21 - us5783.nordvpn.com
    3. 45.33.52.69 - us5783.nordvpn.com
    4. 45.33.43.85 - us5784.nordvpn.com
    5. 45.33.43.91 - us5784.nordvpn.com
    6. 172.104.110.252 - jp558.nordvpn.com
    7. 139.162.99.117 - jp560.nordvpn.com
    8. 50.116.9.72 - us5783.nordvpn.com 
    9. 45.56.89.149 - us5783.nordvpn.com
      NOTE: To change a server, you will need to change the “right” and “rightid” fields with different server information and save the file. Then you would need to restart the IPsec service with the following commands:

      sudo ipsec restart 
      sudo ipsec up NordVPN
       
  8. Open the “constraints.conf” file by writing this command:

    sudo nano /etc/strongswan.d/charon/constraints.conf
     
  9. Inside the file, change “load = yes” to “load = no”.
  10. Download the NordVPN RSA certificate by running this command:

    sudo wget https://downloads.nordcdn.com/certificates/root.pem -O /etc/ipsec.d/cacerts/NordVPN.pem
     
  11. Restart “ipsec” in order to reload all configuration files:

    sudo ipsec restart

    NOTE: If you have made any typos in the “/etc/ipsec.conf” file, you will be notified when the service starts.
  12. Connect to the “NordVPN” configuration by writing:

    sudo ipsec up NordVPN

    NOTE    : If you connected, “ipsec” should output: “Connection NordVPN has been established successfully.” If you don’t get it and you see many “auth_fail” errors, follow these steps:
    1. Remove all “ipsec.secrets” files by running:

      sudo rm /etc/ipsec.sec*
       
    2. Create a new “ipsec.secrets” file using this command:

      sudo nano /etc/ipsec.secrets
       
    3. Enter the credentials described in step 4 of the main guide and save the file.
    4. Restart the “ipsec” service and try connecting again:

      sudo ipsec restart 
      sudo ipsec up NordVPN

Additional tips

  • Restart your device.
  • Try a different network.
  • Turn off any additional VPN services.
Was this article helpful?

Still having issues?

  • Live chat

    Contact our support to solve an issue live.

  • Email form

    Fill out an email form so we can help you with an issue.

    Email us

    Our Support team will get back to you within 24 hours. We’ll reply to the email address you provide.

    By clicking “Submit”, you agree to our Terms of Service and acknowledge our Privacy Policy.

Chat functionality relies on cookies. By starting the chat, you agree to their use. Learn more in our Cookie Policy.

Related articles