Difficulty setting up Standalone ProtonVPN Service

I am having problems setting up a ProtonVPN Net Qube to use as the Net vm for my Personal, Untrusted and Work vm’s. My Mullvad fedora (installed as per Micah Lee instructions) has recently become glitchy, requiring shutting down in-use vm’s, then restarting the MullvadVPN qube, before restarting the other vms. So I’d like to try Proton, as I already have an account.
What I have done so far:
from the following thread below,

How I can install vpn template (protonvpn)?

trying to install ProtonVPN via the gui method would not work.
So I’m now trying Proton’s official protonvpn-cli method with fedora-36.
Standalone fedora-36 vm created and updated. Enabled auto start on reboot and added Network Manager in the Services tab. Everything seems successful, after following the Proton instructions to the end of the installation. But then trying to log in to my Proton account for the ProtonVPN came to a crashing halt, when I used their suggested login method. From Terminal in my new protonvpn-cli vm, entering

protonvpn-cli login [Proton VPN username] , while substituting my Proton username, I get an error message, that protonvpn-cli is an unrecognized command. Cannot get past this point, using the Proton instructions.
However after rebooting and having my new protonvpn vm automatically start up, I do now have an unconfigured Network Manager applet in the top menu bar, with an option to set up a vpn connection. Hoping not to completely botch up the process completely by messing up the settings in the applet, has anybody set this up successfully before and can they please point me in the right direction? many thanks

Try manually using the Proton client to connect the VPN, it should show the NM applet as connected with the lock/vpn icon.

I’m using ProtonVPN with the Debian 11 template, and I have a .desktop file for automatically connecting the VPN after the qube starts.

Thanks renehoj for your reply. Unfortunately I’m having trouble with that. Here are the instructions from Proton for the cli:

How to use the early-access version of Linux CLI

  1. Log in using your regular Proton/Proton VPN account details using the following command (please note that these are not the OpenVPN/IKEv2 login credentials used by the older community Linux client).

protonvpn-cli login [Proton VPN username]

You will be prompted to enter your password. If you don’t have a Proton VPN account you can sign up for one here.

The CLI will remember your login details between sessions.

  1. Open a list of Proton VPN servers with:

protonvpn-cli connect (or protonvpn-cli c)

  1. Select a server location and click OK . Select a server at that server location and click OK .

  2. Select udp or tcp (we recommend udp unless you have a reason to choose tcp).

A connection to the VPN server will now be established. To check your connection status, enter:

protonvpn-cli status (or protonvpn-cli s)

To disconnect, enter:

protonvpn-cli disconnect (or protonvpn-cli d)

Alternatively, you can disconnect using NetworkManager.

After setting (for example) my stock Untrusted vm to use the new Proton-cli vm as its NetworkConnection vm, I cannot connect through the vpn vm. I do believe, that I need to configure the vpn connection through the new NetworkManager applet at the top of the screen. But I’m not sure, what I need to enter in there. I have opened side by side the vpn vm configuration pages for my Mullvad and new Proton vpn vm’s and for my usually workiing Mullvad vpn Services vm, the configuration page from the applet has entries for Gateway, user name, password and CA certificate. I do have a Proton username and password that I can use, but nothing else. A search does find openvpn files in the proton-cli vm including the file openvpn-plugin-auth-pam.so in the usr/lib64/openvpn/plugins folder. But I don’t know if this is required with the configuration. I might be way off base there.

You don’t configure the connection using the NM applet, it’s just there to show you if you are connected. When connecting it will do the swirl animation and when connected it will get the lock icon showing you the vpn connection is active.

You need to install the ProtonVPN client, when you log in to the ProtonVPN client and select the server/country you want to use it with configure NetworkManager to use that server.

If you only want to use the NM applet you need to log into the ProtonVPN website and download the OpenVPN config file for the server you want to use, you can open that file in the applet.

The username and password you need to use for the VPN is listed in the same place you download the config file.

Aha… Thank you renehoj. I will follow that advice. Hopefully I’ll have everything up and running tomorrow and will report back on success. cheers

Still not crystal clear, I’m afraid. Decided that, as suggested, I would choose not to log into Proton via the applet and use the working vm instead with a client. I tried installing the protonvpn-cli client in one of my working vm’s - Debian Personal. I got as far as successfully entering my protonmail account password and a server, but it wouldn’t connect. So I rebooted to see if it would reset but lost the persistence of the installation and there was no proton in the Personal vm. Now I’m thinking, that I need to install protonvpn-cli in my debian-11 template, to have it persistent and available to all vm’s using that template. Am I now on the proper track? If so, could I be corrected in any errors in thinking for my plan below, if I only want to use the client in the vm to enable proton?

  • I can delete my previously made standalone vpn debian vm, into which I was trying to install protonvpn-cli.
  • Instead of trying to install protonvpn-cli in my working vm’s, I should be installing it directly into my debian-11 Template.
  • If the above are true, I will need to remove my mullvad-vpn Network vm from being the Network vm for my debian-11 Template. I should therefore use my default sys-firewall as the Network vm for my debian-11 Template.

I’ve been making a number of changes to my system on this and so far everything but the vpn still works. I’d like to keep it that way and not blunder into something, that I will have trouble fixing. cheers

This is how I made it work.

Make a debian 11 qube that provides network with autostart and has the network-manager service.

In the template, install the protonvpn client

You should now be able to test the vpn works by using the gui client.

If everything is working, you can make a logon script that uses the cli client to automatically connect the vpn at boot time.

Assign the vpn as netvm for the qubes you want to use the vpn.

Finally got it thanks. Installed the Protonvpn in a new Fedora 36 vm and used the gui to get the vpn running. But I’m not a scripter (and too old at this stage to become adept at it). So for an auto-start script I borrowed Micah Lee’s Mullvad vpn startup script and used vim to change the autovpn.sh file’s mullvad_ca value to “Proton VPN CA#24” where 24 is a sample server number and the quotes were used due to the spaces in the default Proton config file. After doing the rest of his mods, everything now works great. ProtonVPN starts up on boot and if I then shut the vpn vm down and open another vm, which uses the Proton vm for networking, the Proton opens up automatically. Very happy. Thanks again

You can use protonvpn-cli c --cc CA, cc is country code and automatically selects the best server available for that country.

I use the cc option and very rarely get a server that is overloaded.

Thanks renehoj. I will definitely give that a try. cheers