Linux

The platform where the stack is yours

In-kernel WireGuard makes Linux the fastest tunnel platform at equal hardware[1], and nftables makes the kill switch auditable in a way no other OS allows - 39% of this page's providers ship open-source clients, but on Linux even the closed ones sit on a stack you can inspect[6].

The DNS stack is the leak, as always

The resolver zoo is Linux's recurring VPN failure: resolv.conf managed by three different subsystems, a client that updates one of them, and a leak you notice in the leak test rather than in the client's UI[6]. The operators who handle systemd-resolved explicitly (and say so in their docs) are the ones whose Linux support is real - the same documentation signal that separates the field everywhere else[5].

The nftables kill switch, briefly

The pattern worth knowing even if you use a client: a base rule set that drops all output except the tunnel interface, loopback and DHCP, plus a rule allowing traffic from the VPN process. Enforced by netfilter, readable by you, testable at boot - and it survives app crashes, because the rules live below every userland process. The local-attack classes (TunnelCrack[3], TunnelVision[4]) die at this layer by construction - the operator responses[5] describe the same design in their clients. It is the rare platform where the recommended kill switch and the DIY equivalent are the same artifact[1][7].

The wg-quick pattern worth knowing

Even with a provider client installed, the plain-text config path matters on Linux: wg-quick consumes the provider's .conf files directly, PostUp/PostDown hooks own the firewall and resolver changes, and the whole setup lives in /etc/wireguard where you can read it. The purist stack - wg-quick plus your own nftables rules - is the most auditable VPN arrangement in consumer computing, and it works with every provider that ships config files (all sixteen here do)[1][6]. The clients exist for convenience, not capability.

When Linux is the wrong answer anyway

For unblocking catalogs, a solo Linux box is the same unreputable-IP problem as the selfhost hub - streaming platforms classify datacenter ranges, and Linux clients get no special treatment[4]. For censorship resistance, obfuscation still rules (the China hub). And for sheer convenience the desktop apps win: everything here requires editing configs and reading logs, which is exactly the trade. Linux's edge is control: fastest tunnel, auditable enforcement, and the open-source stack completed end to end[1][7] - the platform where "trust the client" and "verify the client" are finally the same sentence.