Vantah — Unofficial AdGuard VPN GUI for Linux

An unofficial adguardvpn-cli front-end with a window and a system tray icon.

Vantah is a desktop GUI client for Linux (a window plus a system-tray icon) that acts as a convenient front-end for the official adguardvpn-cli command-line tool. Vantah does not implement a VPN itself — it merely runs adguardvpn-cli as an external process, parses its output, and shows the state in a graphical interface.

Why?

AdGuard makes official VPN clients with a window for Windows and macOS. For Linux, AdGuard supplies only adguardvpn-cli, a command-line tool. Vantah puts a window and a tray icon on top of that tool, so you do not type commands to connect, to change the location, or to read the current state.

Naming and legal notice. Vantah is an independent, unofficial project. It is not affiliated with AdGuard, and is not developed, sponsored, or endorsed by them; it is not an AdGuard product.

Vantah does not include, bundle, or distribute adguardvpn-cli or any other AdGuard software. You install adguardvpn-cli yourself; its use is governed by AdGuard's own license and terms, and a valid AdGuard VPN account/subscription is required.

"AdGuard", "AdGuard VPN", and related marks are trademarks of their respective owners. They are used here purely nominatively — to indicate compatibility with adguardvpn-cli — and imply neither affiliation nor endorsement by the trademark owners. The name "Vantah" deliberately does not contain the word "AdGuard".

Screenshots

Buttons, toggles and other accents follow your desktop's system accent color (SystemAccentColor), so the UI matches the rest of your system — change the accent in your OS settings and Vantah follows. The galleries below use different accents as examples: green in dark theme, blue in light theme.

Dark theme (green accent)

Status	Locations

Site exclusions	Account

Settings (TUN)	Settings (SOCKS5)

Light theme (blue accent)

Status	Locations

Site exclusions	Account

Settings (TUN)	Settings (SOCKS5)

Requirements

• The adguardvpn-cli tool installed and available on your PATH.

• A valid AdGuard VPN account/subscription. You can sign in directly from the Vantah interface (device-code flow via your browser) or beforehand in a terminal:

  adguardvpn-cli login

Desktop environments

Vantah uses the X11 backend of Avalonia. In a Wayland session it runs through XWayland. Native Wayland support waits for an Avalonia release that sets the Wayland app_id; until that release Vantah stays on X11.

The window works on any desktop that runs X11 applications — GNOME, KDE Plasma, Xfce, Cinnamon, MATE, Budgie, LXQt.

The tray icon uses the StatusNotifierItem interface on the D-Bus session bus. KDE Plasma, Cinnamon and Budgie show such an icon themselves. Xfce and MATE need their status-notifier panel plugin. GNOME shows the icon only with the AppIndicator extension — without that extension the icon does not appear in the top bar.

A desktop without a tray host stays usable, but then the window is the only interface. The close button hides the window, so start vantah again to show it — the second command does not start a second application.

Configuration and trust model

Vantah reads an optional INI file at ~/.config/vantah/vantah.conf (you create it yourself; without it the defaults apply):

# Which binary to run as the CLI: a name looked up in PATH or an absolute path.
adguard_cmd = adguardvpn-cli

# Optional command used to force-terminate a CLI process; the PID is appended as
# the last argument. Without this key Vantah signals the process itself via kill(2).
# The template is split on spaces — quoting and paths with spaces are not supported.
kill_cmd = pkexec kill

The same two values can be supplied through the VANTAH_ADGUARD_CMD and VANTAH_KILL_CMD environment variables; if a key is set in both places, the config file wins.

Both values are executed as given — Vantah does not validate, restrict, or sandbox them, and the usual kill_cmd runs through pkexec, that is with elevated privileges. The config file is therefore a trust boundary: anyone able to write to it can make Vantah run an arbitrary command on your behalf. Keep ~/.config/vantah owned by your user and not writable by anyone else — Vantah creates that directory with 0700 permissions (and tightens an existing one) when it writes its own files there.

Files and folders

Vantah keeps all its files in your home directory. The table shows the default paths; XDG_CONFIG_HOME and XDG_DATA_HOME move the two roots.

Path	Content
~/.config/vantah/vantah.conf	The optional INI file with the CLI command and the kill command — see Configuration and trust model.
~/.config/vantah/	The Vantah settings, one small file for each: language, favorites.json, autoconnect, last-location, ip-version, killswitch, logging, notifications, window-opacity, appupdate.json, and the site-exclusions/ copies of the domain lists.
~/.config/autostart/vantah.desktop	The autostart entry. Vantah writes this file when you switch autostart on, and deletes it when you switch autostart off.
~/.local/share/vantah/app.log	The Vantah log. It is off by default.
~/.local/share/vantah/connections-history	The connection history that the Status tab shows.
~/.local/share/vantah/connection-active	The connection session that runs now. It stays when you close Vantah, because the VPN also stays.
$XDG_RUNTIME_DIR/vantah/	The lock file and the socket that keep one instance. Without XDG_RUNTIME_DIR Vantah uses ~/.local/share/vantah.

The adguardvpn-cli tool keeps its own settings and logs in its own places. Vantah does not write there; it changes those settings with adguardvpn-cli commands.

Features

• Connection. Connect / disconnect, "fastest location", IP protocol choice (IPv4 / IPv6), and an optional kill switch that keeps you protected if the connection drops. Clear progress (Connecting… → Connected).
• Locations. List with ping, search, favorites, and sorting by ping, city, country, or country code.
• Status and traffic. Live speed and volume counters, connection history, and a live log tail right in the UI.
• Site exclusions. General / selective modes; add, remove, import, and export the domain list.
• adguardvpn-cli settings. TUN/SOCKS mode, SOCKS port/host/username/password, DNS upstream, protocol, tunnel routing mode, system DNS, post-quantum cryptography, outbound network interface, update channel, notifications, telemetry and crash reporting, and more.
• Account. Sign in directly from the UI (device-code flow via the browser), license details, sign out.
• Automation. Autostart on login and auto-connect (fastest or last-used location). The autostart entry can start Vantah minimized to the tray — a toggle in Settings adds the --minimized key to that entry.
• System tray. Menu with connect / disconnect, the fastest location, your favorite locations, and the number of excluded domains; the tooltip shows the location and the live speed. The window and the tray always show one state. Only one Vantah runs at a time: a second launch shows the window of the instance that already runs, and does not add a second icon.
• Notifications. Vantah shows a desktop notification when the VPN connection drops, and one more when the connection comes back. Your own connect and disconnect commands cause no notification. The toggle is in Settings and is on by default. It controls only these two messages of Vantah. The adguardvpn-cli tool sends notifications of its own, and they have a different toggle ("Show notifications") on the same Settings page. You switch the two off independently.
• Appearance. The buttons and toggles follow the system accent color of your desktop. A slider in Settings sets the opacity of the windows.
• Diagnostics. Vantah writes its own log to ~/.local/share/vantah/app.log: the CLI commands with their exit codes and durations, the replies to status, and each change of the connection state. This log is off by default — you switch it on in Settings. You can also export the adguardvpn-cli logs to a folder.
• Convenience. UI language switching, update checks for Vantah itself and for adguardvpn-cli, an About page with the Vantah and CLI versions, and viewing/terminating CLI processes.

Interface languages

Vantah speaks English, Russian, German, Spanish, French, Indonesian, Italian, Polish, Brazilian Portuguese, Turkish, Ukrainian and Simplified Chinese. On first launch it follows the system locale and falls back to English when that locale is not among the supported ones; the language is also picked in Settings and applies immediately.

Only the English and Russian strings are written by the authors. Every other language is a draft that has not been reviewed by a native speaker — if something reads wrong, an issue or a pull request against src/Vantah.App/Localization/Strings.<code>.resx is very welcome.

Download

Ready-made builds for Linux x86-64 and arm64 are published on the releases page. No .NET runtime is required — everything is bundled inside.

AppImage — download, make it executable, run:

chmod +x Vantah-*-x86_64.AppImage
./Vantah-*-x86_64.AppImage

tar.gz — unpack and run the vantah binary:

tar -xzf vantah-*-linux-x64.tar.gz
./vantah-*-linux-x64/vantah

.deb (Debian, Ubuntu, and derivatives) — install with your package manager; the application-menu entry with an icon appears right after installation:

sudo apt install ./vantah_*.deb

.rpm (Fedora, RHEL, openSUSE, and derivatives) — same, via dnf:

sudo dnf install ./vantah-*.rpm

Both packages install the binary to /usr/lib/vantah (with a /usr/bin/vantah symlink) and register the menu entry and icons automatically. They do not pull in adguardvpn-cli (it is not in distro repositories) — install it yourself, see Requirements.

Install from a repository (with automatic updates)

The same packages are built in the openSUSE Build Service, so Vantah is updated by your usual dnf upgrade / zypper up / apt upgrade instead of downloading a file every time. Available for x86-64 and arm64.

Fedora 43 / 44:

sudo dnf config-manager addrepo --from-repofile=https://download.opensuse.org/repositories/home:bolikcraft/Fedora_$(rpm -E %fedora)/home:bolikcraft.repo
sudo dnf install vantah

openSUSE Tumbleweed (for Leap 16.0 replace openSUSE_Tumbleweed with openSUSE_Leap_16.0):

sudo zypper addrepo https://download.opensuse.org/repositories/home:bolikcraft/openSUSE_Tumbleweed/home:bolikcraft.repo
sudo zypper --gpg-auto-import-keys refresh
sudo zypper install vantah

Debian 13 (for Ubuntu use xUbuntu_24.04 or xUbuntu_26.04 instead of Debian_13):

echo 'deb http://download.opensuse.org/repositories/home:/bolikcraft/Debian_13/ /' \
  | sudo tee /etc/apt/sources.list.d/home:bolikcraft.list
curl -fsSL https://download.opensuse.org/repositories/home:bolikcraft/Debian_13/Release.key \
  | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/home_bolikcraft.gpg > /dev/null
sudo apt update
sudo apt install vantah

Arch Linux — the package lives in the AUR as vantah-bin:

yay -S vantah-bin

Every asset ships with a .sha256 file next to it; verify the download with:

sha256sum -c Vantah-*-x86_64.AppImage.sha256

To get an application-menu entry with an icon, build from source and run packaging/install.sh.

Usage

Start Vantah from the application menu — the .deb, the .rpm and packaging/install.sh add the menu entry — or from a terminal:

vantah

Vantah opens the window and puts an icon in the tray. The close button hides the window and the application continues to run in the tray; to stop it, use the Exit item of the tray menu.

Option	Action
--minimized	Start without the window and show only the tray icon. If the desktop has no tray, Vantah shows the window.
--version	Print the version and exit.
-h, --help	Print the list of the options and exit.

Vantah ignores an option that it does not know: autostart entries and desktop files can contain keys of the session manager.

Only one Vantah runs at a time. When you start vantah again, the new process asks the first one to show its window, and then stops.

Building and running for development

Requires the .NET 10 SDK.

dotnet build
dotnet run --project src/Vantah.App

A plain dotnet build / dotnet run produces a framework-dependent build (fast, not tied to a specific OS runtime).

Building a single self-contained file

A self-contained, single-file binary for Linux is built with one command:

dotnet publish src/Vantah.App -c Release -r linux-x64

The result is a single executable (the .NET runtime and native libraries are embedded), located here:

src/Vantah.App/bin/Release/net10.0/linux-x64/publish/Vantah.App

The binary is around 100 MB (self-contained, no trimming: Avalonia and reflection-based XAML cannot be trimmed safely). The single-file / self-contained flags are enabled automatically when an -r <RID> is provided; without a RID the build stays a regular framework-dependent one, so day-to-day development is not slowed down.

Installing into the application menu

To make Vantah appear in the menu (GNOME, KDE, any other DE) with an icon and launch on click:

packaging/install.sh

The script publishes the self-contained binary, places it in ~/.local/lib/vantah with a ~/.local/bin/vantah symlink, installs icons into ~/.local/share/icons/hicolor and vantah.desktop into ~/.local/share/applications, then refreshes the menu and icon caches. Root is not required. For a system-wide install use PREFIX=/usr/local packaging/install.sh (as root); to uninstall, run packaging/install.sh --uninstall.

Tech stack

• C# / .NET 10 (net10.0).
• Avalonia 12 with the built-in Fluent theme.
• CommunityToolkit.Mvvm (MVVM).
• xUnit — tests for the core (Vantah.Core) and for the UI (Vantah.App, headless Avalonia).

The project is Linux-only.

Roadmap

• IP-address and region leak detection — verifying that traffic actually goes through the VPN.

Similar projects

Other unofficial front-ends for adguardvpn-cli:

• grafov/adgui — Go and Fyne; it also checks the IP address and the region.
• SpazzRabbit/adguardvpn-gui — Python and PySide6.
• ineedmypills/adguardvpn-gui — Rust and Slint.
• 0xGingi/AdGuardVPNGUI — Python and Tkinter; the last commit is from March 2025.

FAQ

Does Vantah work without an AdGuard VPN account or subscription? No. Vantah only drives adguardvpn-cli, so you need the CLI installed and a valid AdGuard VPN account/subscription. You can sign in from the Vantah UI via the device-code flow — see Requirements.

Which Linux distributions are supported? The AppImage and the tar.gz archive run on any x86-64 or arm64 distribution (the .NET runtime is bundled); the .deb targets Debian, Ubuntu and derivatives, and the .rpm targets Fedora, RHEL, openSUSE and derivatives. Both x86-64 and arm64 builds are published — see Download.

Does Vantah need root? Day-to-day use does not, and packaging/install.sh installs into your home directory without root. Root is involved only where your system requires it: installing the .deb/.rpm packages, and the optional kill_cmd = pkexec kill used to force-terminate a CLI process — see Configuration and trust model.

Do I need to install the .NET runtime? No. The published AppImage, tar.gz, .deb and .rpm builds are self-contained — the runtime is embedded. The .NET 10 SDK is needed only to build from source, see Building and running for development.

How does Vantah know that the VPN connection dropped? Vantah asks adguardvpn-cli status every few seconds. A drop is not only the reply "Connection lost" or "Waiting to reconnect": if the CLI does not answer two polls in a row, Vantah also counts the connection as lost. This silence is usual — after a drop with the kill switch on, the CLI starts to recover the tunnel and its status command hangs. The notification is not immediate, because the new state must first stay stable: in this case the message comes approximately half a minute after the drop. In exchange, a connection that goes down and comes back quickly gives no messages at all.

Does Vantah send anything over the network on its own? Only an update check against this repository's GitHub releases page, which can be switched off in Settings. Vantah has no telemetry of its own; everything else (traffic, account, telemetry options) belongs to adguardvpn-cli, whose settings Vantah merely exposes.

License

Copyright (C) 2026 bolikcraft

Vantah is free software distributed under the GNU General Public License, version 3 or (at your option) any later version — full text in the LICENSE file. In short: you may freely use, modify, and distribute the software, but any distributed derivative work must also be released under the GPL with its source code available. The software is provided "AS IS", without any warranty.

The GPL covers only Vantah's own code. The adguardvpn-cli tool and other AdGuard software are not covered by it, are not bundled with Vantah, and are distributed under AdGuard's own terms. Vantah invokes adguardvpn-cli as a separate process and does not link against it.

Disclaimer

The software is provided "AS IS", without warranty of any kind, express or implied, including but not limited to the warranties of fitness for a particular purpose and non-infringement. You use Vantah at your own risk; the authors and copyright holders are not liable for any claim, damages, or other loss arising from the use of the software.

Vantah is a networking tool that manages a VPN connection through the external adguardvpn-cli utility. You are solely responsible for complying with the applicable laws of your jurisdiction, as well as with AdGuard's license and terms of use.