How to Easily Change VPN Server w/ sys-vpn?

User Support
1

Continuing the discussion from Qubes-vpn-support and firewall infrastructure:

2

You could do the copy with a command in dom0 e.g.:
qvm-run sys-vpn ā€˜cp whatever.conf /rw/config/vpn/ā€™

Then wrap that in a script that also shuts down and restarts sys-vpn or reconnects the vpn properly. You could then assign the script a shortcut.

You could go the whole hog and setup an rpc call that prompts for a vpn location but I never got round to that

1 Like
3

Recently I have switched to installing the ProtonVPN Linux app in a VPN qube. I use this app to switch servers. It has a kill switch too. I just have a script that launches the app when the qube starts. I think mullvad has a Linux app as well which could be the easiest way to switch servers.

I also found this guide really helpful, but it is for openvpn not wireguard.

When I ran wireguard I just had it locked to one server. But had multiple qubes, each pointing to different servers then I would just switch VPN qubes.
Iā€™m sure there is a way to do it with wireguard, but I gave up in the end.

1 Like
4

For now Iā€™ve settled down with a couple of wireguard proxyvms and an openvpn proxyvm.

The latter has been created following the guide mentioned by h110w: Iā€™ve added some servers to it so that I can easily switch between them with network manager. Itā€™s not as practical as the official app, but Iā€™ve read arguments against using it in the forum. The guide mentions that the firewall stops working well if you create more than 20ish rules, thus effectively limiting me to 20ish servers, does anybody know if thatā€™s still the case?

Wireguard proxyvms have been setup with Qubes-vpn-support. Iā€™d like to learn how to make a script like that proposed by Uqube and Iā€™ll dig into it when I have more time, but I fear that would not be super-practical anyways, since after every server switch Iā€™d still have to wait for appqubes+firewall+proxyvm to shutdown and restart, so Iā€™ll end up rarely switching server anyways. For now Iā€™ll use them with a fixed server like h110w said.

Thank you both for your help!

5

Hi @Newb,

maybe you like my solution: I got a qube for each serverā€¦

sys-njalla
sys-ivpn-dallas
sys-ivpn-chicago
sys-ivpn-germany
sys-ivpn-sweden
sys-ivpn-japan
etc

and a simple script:

#!/bin/bash
# switch from $1 to $2

qvm-start --skip-if-running sys-$2
qvm-prefs sys-vpn netvm sys-$2
qvm-shutdown --quiet sys-$1

ā€¦ thatā€™s it. I use it like this:

[user@dom0]$ switch-vpn ivpn-sweden njalla

These qubes are based on a template obviously and hence tiny (98 MB) so
they donā€™t need a lot of space and you always run only one at a time so
you also donā€™t use more memory.

Whatā€™s not to like?

BTW, that also solves the ā€œtoo many servers in the firewall listā€ issue.

3 Likes
6

I really like wireguard over ovpn so there is another solution I am currently working on at the moment where I will use rofi/dmenu to switch between wireguard config files and then it runs a script that removes the ip addresses of the previous config file rom the firewall rules in the VPN qube and adds the new ip addresses of the new config file. I will keep you posted with my progress :slight_smile:

1 Like