Configuring a ProxyVM VPN Gateway

[apparatus]

@heinzl

1. In the original qubes-firewall-user-script you can read:
   "# This script is called at AppVM boot if this AppVM has the qubes-firewall

service enabled."

But in the guide I can read nothing about that. So, do I have to enable this service or not to prevent leaks?

It’s just a note for the users to understand in what cases is this file called.
You don’t need to take any additional actions.

@heinzl

After having some troubles and finally had no error messages anymore when openvpn is running, I tried in the VPN-qube to open a website via Firefox but it didn’t work and there was only a blanket site and was loading all the time. As I stopped openvpn the website loaded with a TOR IP. BUT as I assign the VPN-qube to another AppVM, it worked and I reached a website with the VPN IP. Why is that, should I not also reach a website withing the VPN-qube with the vpn connection?

Check your /etc/resolve.conf in VPN qube when you’re connected to the VPN. Most probably is that your VPN qube is not using the DNS server provided by your VPN so the DNS resolution is not working in the VPN qube.

@heinzl

I would like to know, if it is possible to have multiple config files in the folder and make openvpn randomly use one everytime it starts?

Yes, just pick a random file from the group of files in the /rw/config/rc.local instead of openvpn-client.ovpn specifically.
Here is an example:

Wireguard VPN setup

Good news, with fedora-38 the network manager supports Wireguard out of the box! The only thing required are extra firewall rules in the VPN qube, as explained in the community documentation about VPN. What you’ll need This guide assumes you are using a VPN service that has wireguard support, most of them do, but you can also add your own if you have a server. ProtonVPN has a free plan, it has limits but gives you a fully working VPN and they support WireGuard. This pro…

So you can do something like this:

VPN_CONF=$(ls /rw/config/vpn-configs-dir | sort -R | head -n 1)
VPN_OPTIONS='--cd /rw/config/vpn/ --config "vpn-configs-dir/$VPN_CONF" --daemon'