All VPN qubes just stopped working (Mullvad; Micah Lee protocol)

User Support
1

I have a couple of sys-VPN qubes set up with Micah Lee’s protocol. They connect to Mullvad.

All of a sudden, VPN access has stopped working for all of them.

  • Qubes that use the sys-VPNs for networking can no longer reach website - says ‘the proxy server is refusing connections’.
  • ping 8.8.8.8 does work
  • Qubes without VPN are working fine.
  • Mullvad works okay on my phone, and other Linux machine.

I’ve checked the proxy settings in the browsing qubes, and there is no change - using SOCKS host 10.8.0.1 on port 1080, proxy DNS when on SOCKS 5.

Is anyone else having problems like this?

Can anyone suggest what I can check?

2

I highly recommend you to follow the guide Mullvad has. Check them at Mullvad on Qubes OS 4 - Guides | Mullvad VPN and at WireGuard on Qubes OS - Guides | Mullvad VPN

3

Reboot the VPN qube. See if the problem persists.

4

I was also using the Micah Lee method with Mullvad - since Qubes 4.0 with no problems whatsoever until about a month ago. Then my vpn mysteriously stopped working also in Qubes. Like you, it did still work on my linux mint and win 10 dual boot and also on my graphene-os cell installations. It was beyond my abilities to find the cause and since I already had a Protonmail account, I upgraded that to the Unlimited option. I was then able to get ProtonVPN up and running, with a little help from the forum here. I still don’t know the cause of my Mullvad woes, but as my subscription was about to expire shortly and I was happy to make the switch to Proton. All is working fine now.

5

All good here. I also switch from Micah Lee’s setup to the official Mullvad setup but I did it based on a minimal Debian.

6

trying them, thankyou. Unfortunately, neither seems to work yet. The wireguard protocol just doesn’t connect (Mullvad support isn’t able to help yet) and on the OpenVPN protocol I can’t get a vif for some unknown reason…

7

That’s interesting. I wonder what’s going on - is it systemic?

8

Can it be that you are from Russia?
The Mullvad IPs were blocked there recently.

9

Not Russia.

This is Qubes-specific. Mullvad works fine on my phone and linux machine .

10

I can’t get either of these to work either. Its like there is some magic anti-Mullvad curse on this machine, suddenly.

11

Mine is working fine with Mulvad guide using proxy vm on Wireguard . I also installed the new Mulvad Browser (based on Tor Browser) which has a button that lets you change VPN servers from a drop down. I really like this set-up

12

Do you have for some reason blocked the server in the firewall. Did you try to set it up such that it only connects over Mullvad?

13

Micah’s instructions use hard-coded IP addresses. This has a tendency to break down over time as VPN providers shift their IPs.

(Also, the Mullvad instructions are not great either, as they ask the user to do things like “Add the following to the file /rw/config/qubes-firewall-user-script be sure to change 10.137.0.47 to the IP that matches your vif*”.)

Qubes-vpn-support has been working fine with Mullvad. You could give that a try. Its also a lot more automated and simpler to setup.

14

Mullvad has been migrating to higher bandwidth servers, so many of their IPs and public keys are changing. Presently there are 77 servers with messages…

https://mullvad.net/en/servers

15

I am not having any luck with any protocol. The Mullvad wireguard protocol gets me furthest - wireguard is connecting from my sys-vpn, but no App-vm can connect to the internet through it.

I really don’t understand. I don’t know if my problem has started with a failing with Micah Lee’s protocol (as descibed above), or something more fundamental that’s happened with my system.

I am preparing to reinstall my system to get around this.

16

Reinstalling the system is a nuclear option for what is likely to be a
straightforward issue.

As you say that the sys-vpn is connecting (and presumably working fine
down the VPN), but no connected app-vm is working, the issue is almost
certainly in the nftables rules you are using to guide traffic to the
tunnel.
If you want to follow this, then take a look at your firewall on
sys-vpn. nft list table nat and nft list table filter will be of
help.

If you want a packaged solution, you could take a look at
https://qubes.3isec.org/tasks.html
There’s a package for mullvad-vpn which will create the VPN qube, and
configure it correctly.

I never presume to speak for the Qubes team. When I comment in the Forum or in the mailing lists I speak for myself.
1 Like
17

Thank you, @unman. I would have investigated that package if I’d known. However, I have already pulled the trigger on the nuclear option and reinstalled.

With a new OS, I have Mullvad’s wireguard protocol working. I still cannot get their OpenVPN protocol to work (the App-vm can ping 8.8.8.8 and www.google.com, but no Firefox connection).