How to install proton vpn on qubes os 4.30 and use it

Community Guides
1

I am choosing ProtonVPN here because it’s free and a good option if you are a student or you don’t want to pay for subscriptions

1) Make a clone of the original Fedora template for security reasons. Go to the wallpaper, right click and go to the terminal of dom0. After you are on the terminal, get a copy of the Fedora template through this command:

qvm-clone fedora-42-xfce proton-fedora

First comes your own Fedora template name, then the name that you want to give it. You can also do this through Qube Manager go there through the Q option (if you are using the default appearance), then to the settings option, there you would see Qube Manager, click on it and then right click on the profile that you want to clone and give it a new name. Voila.

2) Now go to the terminal and type:

qvm-prefs proton-fedora netvm

After that run:

qvm-prefs proton-fedora netvm sys-firewall

(Replace proton-fedora with whatever you have named your clone VM.) Then to confirm, use:

qvm-prefs proton-fedora netvm

It should print sys-firewall, which means you have access to internet on this template. Now the reason we are making another template is because TemplateVMs do not have access to internet, and it’s for a good reason it keeps your device safe. So we are using a clone and granting it access to internet for a couple of minutes so we can install ProtonVPN. You can test if the internet is working through this command:

curl -I https://protonvpn.com

If it shows HTTP/2 200 then it means you have got access to the internet.

3) Use these commands to install ProtonVPN:

curl -OL “https://repo.protonvpn.com/fedora-$(cat /etc/fedora-release | cut -d’ ’ -f 3)-stable/protonvpn-stable-release/protonvpn-stable-release-1.0.3-1.noarch.rpm”
sudo dnf install ./protonvpn-stable-release-1.0.3-1.noarch.rpm -y
sudo dnf install proton-vpn-gnome-desktop -y

4) After it’s done installing, go to dom0 and remove the access to internet through this command:

qvm-prefs proton-fedora netvm ‘’

5) Now you have to make another qube. Go to Qube Manager and press on New Qube. Name it whatever you want I named it sys-protonvpn. Network connection should remain on sys-firewall by default. Select the template as proton-fedora (or whatever you named the one on which we installed ProtonVPN) this is an important step. Below you will see Advanced options, click on it and check the box which says “Provide network access to other qubes”. Also go to the Services tab and add network-manager and qubes-firewall.

6) Now go to the proton-fedora template on which we originally installed ProtonVPN and use this command:

ls /usr/share/applications/ | grep -i proton

You should see something like protonvpn-app.desktop or proton.vpn.app.gtk.desktop in the output. Note down the exact filename.

7) Now go to the sys-protonvpn qube we created and run these commands:

rm -rf ~/.config/autostart/protonvpn* mkdir -p ~/.config/autostart ln -sf /usr/share/applications/proton.vpn.app.gtk.desktop ~/.config/autostart/

You can skip the first command if you have not touched autostart config before.

8) Now go to sys-protonvpn. Put your mouse there and you would see the Settings option, go there and then you will see the Application menu, click on it and search for Proton you will see the app. Double click it so it shows in your app menu, then press OK. After that shut down sys-protonvpn and then start it again. If the app does not appear, go to the terminal and type:

protonvpn-app

ProtonVPN will open. It will ask you for a password choose one that you remember (this is the keyring password to save your credentials). Log in, go to the settings of ProtonVPN, on Auto-connect write fastest and turn on Start app minimized. After that try connecting. If it’s successful, reboot it again and then go to the settings of the qube on which you want to use the VPN, go to NetVM in the Basic tab and select sys-protonvpn there. That’s it. You have got VPN working.

Kill switch:

You can also enable a kill switch through dom0 with this command. This blocks all traffic if the VPN crashes so your real IP never leaks:

qvm-run -u root sys-protonvpn “echo -e ‘#!/bin/bash\nnft add rule qubes custom-forward oifname eth0 counter drop\nnft add rule ip6 qubes custom-forward oifname eth0 counter drop’ >> /rw/config/qubes-firewall-user-script && chmod +x /rw/config/qubes-firewall-user-script”

Now is this the best way or the fastest way to do it? No, I think there is better or faster way to do it. I just wanted to shared with you my notes on how I did it on the latest version of Qubes OS because I was not able to find up-to date guides on the internet about it.

1 Like
2

Thanks for the guide and your notes. There’s also another ProtonVPN guide written by @solene here: ProtonVPN App 4.2 setup guide

If you believe your guide includes novel ways of solving problems or is superior in some sort of way, it can also be added to Meta-topic: List of all VPN guides

3

Yes, I’d love to have it added! I’m not sure how to do that myself? could you add it, or let me know if there’s something I need to do on my end? I think it would be helpful for those using qubes 4.30 as a beginner.

4
  1. Do you have proton tray icon when minimized?
  2. You don’t need to give internet access to template to use curl - it’s in @solene guide
  3. Formatting terminal commands in your guide sucks - look for markdown guide how to insert code block… ok, use this ``` at the first line, then every command in one line and then in last line again use ```.
    It will looks like that:
rm -rf ~/.config/autostart/protonvpn*
mkdir -p ~/.config/autostart
ln -sf /usr/share/applications/proton.vpn.app.gtk.desktop ~/.config/autostart/
  1. There’s nothing new in your guide compared to @solene guide except that in February .desktop file name has changed in proton package and in 4.3 there is no longer need to add NetworkManager service in order for sys qube to be listed as service qube.
  2. In your guide you install RPM downloaded from Proton site, which means you need to download it manually every time new version is available and install it manually after that. In @solene guide you add Proton repository and every time there is new version, qubes updater will automatically update it.

Should use search forum function, you would have better guide.

5

You are right, I am just a beginner. I wanted to share what exactly worked FOR ME after hours of trying, So I can save others time.