Want your VPN to start automatically when your Wi-Fi connects on Arch Linux with KDE Plasma? You can do this with nmcli or directly in KDE’s NetworkManager settings. This setup ensures your VPN is always active, keeping your connection secure from the moment you go online.

---

Step 1: Show all saved connections

Run this to see your Wi-Fi and VPN profiles:

nmcli connection show

Note the names of your Wi-Fi (e.g., The Promised LAN) and VPN connection.

---

Step 2: Enable Wi-Fi auto-connect

Make sure your Wi-Fi always connects first:

nmcli connection modify "The Promised LAN" connection.autoconnect yes
nmcli connection modify "The Promised LAN" connection.autoconnect-priority 10

---

Step 3: Configure VPN auto-connect

Option A: WireGuard/OpenVPN as VPN profile

If your VPN was imported as a proper VPN type:

nmcli connection modify "The Promised LAN" connection.secondaries "mega-us"

Replace "mega-us" with your VPN’s name.

If you get an error like:

'mega-us' is not a VPN connection profile

…it means your VPN wasn’t recognized as a VPN type by NetworkManager.

---

Option B: Any VPN type (recommended via KDE GUI)

1. Open System Settings in KDE.

2. Go to Connections → select your Wi-Fi.

3. Click Edit → General Configuration.

4. Check Automatically connect to VPN when using this connection.

5. Select your VPN profile from the dropdown.

This works with WireGuard, OpenVPN, L2TP, and all supported VPNs.

Step 4: Test your setup

Reconnect Wi-Fi to confirm the VPN starts:

nmcli connection down "The Promised LAN"
nmcli connection up "The Promised LAN"

Your VPN should activate immediately after Wi-Fi connects.

---

Troubleshooting VPN Auto-Connect in KDE

If your VPN doesn’t auto-connect after Wi-Fi, try these fixes:

• VPN not starting at all
  Open KDE System Settings → Connections → Wi-Fi → General Configuration. Make sure “Automatically connect to VPN when using this connection” is checked.

• Wrong VPN profile selected
  Double-check you picked the correct VPN name in the dropdown. Profiles often have similar names.

• WireGuard imported as “Ethernet”
  If your WireGuard profile was imported incorrectly, remove and re-import it as a VPN type:

  nmcli connection import type wireguard file ~/path/to/wg0.conf
  

• Check logs for errors
  Run:

  journalctl -u NetworkManager -f
  

  Reconnect Wi-Fi and watch for VPN-related errors.

• Prevent DNS leaks
  Some VPNs don’t enforce DNS by default. In KDE’s VPN settings, enable Use custom DNS servers (e.g., 1.1.1.1 or your VPN provider’s DNS).