Help setting up a sys-vpn

Im trying to setup a sys-vpn qube using a fedora-34-minimal template.
I created a proxyVM and named it sys-vpn

Then i tried to follow this guide by NordVPN.
I opened a terminal for the template using
qvm-run -u root fedora-34-minimal xterm
dnf install openvpn
worked fine. But,
sh <(curl -sSf
wont run in template VM because no internet access? Yet can install packages??
Am i suppose to give the template sys-net access temporarily?
I thought that was a no no…?

I’ve also read the guide.
It details two options, using NetworkManager OR iptables and CLI scripts,
is one better than the other?
would it be better than using Nord’s linux install?
I dont want any leaks.

Ive also read another posts saying to use Qubes-vpn-support however again i couldnt get this to install in the template.

curl wont work on a template which hasnt sys-firewall etc enabled. You could activate sys-firewall as net for the template for a quick download, but i wouldnt trust it.

I would setup a sys-vpn qube from this guide as CLI if you feel comfortable.

Keep in mind - thats currently my problem with temp. workaround on 4.1rc3- to add the server IPs in the *.ovpn config, not the domain-names. (qubes-firewall-user-script dont work as it should → couldnt resolve hostnames)

i decided to clone a template and let it have sys-net access just to test setup a sys-vpn.

I got nordvpn installed and connecting fine on sys-vpn, but whenever i try route another app-vm through sys-vpn, the app-vm cant get internet despite ticking “provides network” in sys-vpn. (sys-vpn has working vpn internet though)

EDIT: when OpenVPN/Nord isnt connected in sys-vpn, AppVMs can route through it, so this is nordvpn doing something to block traffic routing when its active.

See GitHub - QubesOS-contrib/qubes-tunnel: Integration of vpn tunnels for Qubes OS

@fepitre man im too tired to be doing this right now, was following the wrong guide on other tab.

dnf qubes-repo-contrib


dnf qubes-tunnel

unable to find a match: "qubes-tunnel


I tried this guide and having the same issue… I have never had success with these scripts. I need some video-guide for that probably…
I find this guide to be the best. Step by step, but mostly because i get it to work! :slight_smile:

I think Qubes should have a sys-vpn by default… That people can use and switch to! It’s a sweet OS, but stuff could definitely improve… Like default stuff people need. VPN, and other stuff…

thanks @bmqbmhhslj
i need to rest, will try it later :slight_smile:

Ok do that :slight_smile: Yeah try it sometime… I know how frustrating it can be to set up a VPN in Qubes if you’re not a coder or know linux and systems like others on here. hehe. Good luck

Please retry I’ve just migrated them for Fedora 34 into stable repository.

1 Like

Made progress, qubes-tunnel now installs.
sys-vpn: LINK IS UP

cant ping from sys-vpn
or through sys-vpn

Ok i have a VPN connection working now BUT only on some VM…?
I cant ping from sys-vpn, i also cant ping or connect from my disposable-fedora-VM routing through sys-vpn
This made me think there was an issue with my sys-vpn
However i can route successfully route through sys-vpn using my personal-VM.

UPDATE: i made a new disposible-VM template and it can use sys-vpn, so i guess something is screwed up in my default disposable vm.

sys-vpn working now though, thanks

1 Like

Yeah you switch the connection in template manager after that as you probably did.