Is This VPN Setup Correct? (work→sys-vpn→sys-firewall→sys-net)

[fsflover]

Do We Need Firewall-qube After Sys-VPN? (Qubes-vpn-support)

Continuing the discussion from Secure VPN VMs in Qubes OS: The official Firewall documentation recommends to have separate VPN and firewall VMs. sys-net <--> sys-firewall-1 <--> network service qube <--> sys-firewall-2 <--> [client qubes] I have successfully set up a Mullvad vpn Qube using Qubes-vpn-support (that I have read many recommendations on searching the forum) and Wireguard (does Mullvad even still support openvpn? I can’t find configurations files for it). The GitHub page, however, …

My VPN setup re-explained

This is a side-topic that started in this thread with @newbie. This is all more or less based on an excellent blog post by Micah Lee. I’ll try to explain again with more detail: sys-net is a HW VM that “has” the PCI devices needed to connect to networks (i.e. Ethernet, WiFi). In my case this VM is also disposable. sys-clearnet is a proxy qube that has sys-net as a netvm (get’s its connection from sys-net) and functions as a firewall. What that means is: it will enforce the firewall se…