AdGuard VPN CLI

You can install the AdGuard VPN CLI using a shell script. Choose the channel that matches your needs:

• Release channel: For stable versions.
• Beta channel: For testing new features.
• Nightly channel: For the latest development builds.

Note: You can also run the CLI via a Docker container on MikroTik routers with RouterOS.

# Release channel
curl -fsSL https://raw.githubusercontent.com/AdguardTeam/AdGuardVPNCLI/HEAD/scripts/release/install.sh | sh -s -- -v

# Beta channel
curl -fsSL https://raw.githubusercontent.com/AdguardTeam/AdGuardVPNCLI/HEAD/scripts/beta/install.sh | sh -s -- -v

# Nightly channel
curl -fsSL https://raw.githubusercontent.com/AdguardTeam/AdGuardVPNCLI/HEAD/scripts/nightly/install.sh | sh -s -- -v

Authentication is required to use the VPN service.

Logging in: Run adguardvpn-cli login. When prompted, select b to open the authentication page in your default browser. Once you log in via the browser, the terminal will confirm success.

Logging out: Run adguardvpn-cli logout to terminate your session.

On macOS, the easiest way to install the CLI is via the AdGuardTeam Homebrew tap. This installs the latest prebuilt binary and shell completions.

Note: Homebrew only tracks the release channel. For beta or nightly builds, use the installation script instead.

# Install
brew install AdguardTeam/tap/adguardvpn-cli

# Update
brew upgrade adguardvpn-cli

# Uninstall
brew uninstall adguardvpn-cli

To ensure the integrity of your installation, you can verify the .sig file provided with the release using gpg.

1. Import the AdGuard public key.
2. Verify the signature file (usually located in the same directory as the binary).

Validation Criteria:

• RSA key must be 28645AC9776EC4C00BCE2AFC0FE641E7235E2EC6
• Issuer name must be AdGuard
• Email address must be devteam@adguard.com

# Import the public key
gpg --keyserver 'keys.openpgp.org' --recv-key '28645AC9776EC4C00BCE2AFC0FE641E7235E2EC6'

# Verify the signature
gpg --verify /opt/adguardvpn_cli/adguardvpn-cli.sig

Global flags available for the adguardvpn-cli binary.

-h, --help: Print the help message and exit.
--help-all: Expand all help.
-v, --version: Display program version information and exit.

Options for exporting service logs to a compressed archive.

-o, --output TEXT: Path to the output artifact. Can be a directory.
-f, --force: Overwrite the output artifact without asking.

Options for updating the VPN service to the latest version.

-v, --verbose: Show update script output.
-y, --yes: Automatically answer 'yes' to all questions.

Options for the list-locations command to view available VPN servers.

count INT: Number of locations to display, sorted by ping.
--bash-completion TEXT: List suggestions for bash-completion.

Use the site-exclusions subcommand to control which websites bypass the VPN tunnel.

Available subcommands:

• add: Add specified exclusions.
• remove: Remove exclusions.
• show: List all current exclusions.
• clear: Remove all exclusions.
• mode: Set or show the exclusion mode (general or selective).

adguardvpn-cli site-exclusions add example.com
adguardvpn-cli site-exclusions show

Use the connect and disconnect subcommands to manage the VPN tunnel.

Connect options:

• -l, --location TEXT: Specify a city, country, or ISO code. Defaults to the last used location.
• -f, --fastest: Connect to the fastest available location.
• -v, --verbose: Show logs from the VPN service.
• --no-fork: Do not run the service in the background.
• -y, --yes: Automatically answer 'yes' to prompts.
• -4, --ipv4only: Force IPv4 connection.
• -6, --ipv6only: Force IPv6 connection.

adguardvpn-cli connect -l US
adguardvpn-cli connect --fastest
adguardvpn-cli disconnect

The config subcommand allows you to manage various service settings. Common configuration tasks include:

• Operating Modes: set-mode (TUN/SOCKS).
• Network/DNS: set-dns, set-change-system-dns, set-protocol (auto, http2, quic).
• SOCKS Proxy: set-socks-port, set-socks-host, set-socks-username, set-socks-password, clear-socks-auth.
• Security: set-post-quantum (enable quantum-resistant algorithms).
• System/Logging: set-debug-logging, set-crash-reporting, set-update-channel.
• Inspection: show to view current configuration.

adguardvpn-cli config show
adguardvpn-cli config set-protocol quic
adguardvpn-cli config set-mode SOCKS