NordVPN setup for Tor over VPN

johnjs43 · August 2, 2021, 8:26am

Hi!

I am new to Qubes OS. I followed the instructions at Installing NordVPN on Fedora & QubesOS Linux | NordVPN Support to install NordVPN.

I used the sys-net terminal to download and install it. Can anyone please tell me if it is the correct VM to install the VPN for running the regular Tor/Onion-over-VPN when I access Tor using a Disposable Whonix VM.

Thanks!

MrA · August 2, 2021, 7:32pm

Hi John. Welcome.

I used this and it’s not let me down so far: GitHub - tasket/Qubes-vpn-support: VPN configuration in Qubes OS

I just found my note from when I configured it, so if you get stuck, let me know. You can change Nord server whenever necessary.

deeplow · August 5, 2021, 7:59pm

This may help:

Cubester · November 10, 2021, 4:18pm

Hi everyone, I am new to Qubes, the community and also to Linux, so am in a pretty steep learning curve at the moment.
I have just purchased a one year subscription with NordVPN and wish to have it running through a proxy vm inside Qubes, but after reading some documents about VPN’s and Tor I instead want to be using it only with the vm’s that will NOT be running through Tor.
I have created the proxy vpn qube as detailed in the Qubes documentation:

github.com

Qubes-Community/Contents/blob/master/docs/configuration/vpn.md


How To make a VPN Gateway in Qubes
==================================

<div class="alert alert-info" role="alert">
  <i class="fa fa-info-circle"></i>
  <b>Note:</b> If you seek to enhance your privacy, you may also wish to consider <a href="/doc/whonix/">Whonix</a>.
  You should also be aware of <a href="https://www.whonix.org/wiki/Tunnels/Introduction">the potential risks of VPNs</a>.
</div>

Although setting up a VPN connection is not by itself Qubes specific, Qubes includes a number of tools that can make the client-side setup of your VPN more versatile and secure. This document is a Qubes-specific outline for choosing the type of VM to use, and shows how to prepare a ProxyVM for either NetworkManager or a set of fail-safe VPN scripts.

Please refer to your guest OS and VPN service documentation when considering the specific steps and parameters for your connection(s); The relevant documentation for the Qubes default guest OS (Fedora) is [Establishing a VPN Connection.](https://docs.fedoraproject.org/en-US/Fedora/23/html/Networking_Guide/sec-Establishing_a_VPN_Connection.html)

### NetVM

The simplest case is to set up a VPN connection using the NetworkManager service inside your NetVM. Because the NetworkManager service is already started, you are ready to set up your VPN connection. However this has some disadvantages:

- You have to place (and probably save) your VPN credentials inside the NetVM, which is directly connected to the outside world
- All your AppVMs which are connected to the NetVM will be connected to the VPN (by default)

This file has been truncated. show original

However when I go the the NordVPN login for my account it is very clear that Nord only wishes you to use their app and gives absolutely no information towards using their service in any other way.
So at this point I am stuck, the proxy vpn is ready to go, but I have no idea how to get Nord running with it.
Any help is greatly appreciated.

Sven · November 10, 2021, 5:35pm

You might find this useful: Download OpenVPN configuration files | NordVPN

Cubester · November 10, 2021, 7:29pm

Hello @Sven, thanks for the reply.
This link was as far as I made it on my own, it basically is a list of hundreds and hundreds of files like this:
al18.nordvpn.com
al19.nordvpn.com
al20.nordvpn.com
… with no descriptions or information of what each file contains of any kind.
I know Nord wants people to use their app but I think this is going a bit far…

Sven · November 10, 2021, 10:42pm

@Cubester, I get you are frustrated with NordVPN, but I can also understand them from a support perspective. They have Apps for each platform allowing:

Install
User & Password
Choose Server … done!

Anybody who wants to setup OpenVPN themselves or configure a router to use the VPN inevitably needs the skills and understanding or starts to be a support nightmare for them. Remember: they are a business

However, you my friend are member of a great community and using Qubes OS! So no worries, we’ll have you online in no time. First of all, there is an excellent step-by-step guide on how to configure OpenVPN proxy VMs in Qubes OS. This particular one was written to work with Mullvad, but everything should work the same for NordVPN. I have in fact used this method with four different VPN providers without any hick ups.

Those files you see there contain all the stuff OpenVPN needs to connect to a specific server. I’d recommend you to read the article I’ve linked in this post and if you still have questions or it’s not working … let us know.

Cubester · November 13, 2021, 3:09pm

Thanks @Sven, you are a legend.
The article was excellent, once I heard back from Nord I was able to get it up and running.
Incidentally, each one of those files listed in their website contains only one remote address, so I modified the one I decided to use by copying in addresses from other files, so now when the vpn loads it randomly selects from a list of many different remote addresses.
It is good to be part of a helpful community, I like to try and give back when I can, but unfortunately due to my lack of experience it is very one sided at the moment, I think the best thing I can do at this stage is make a donation to the project.
I have been able to get Qortal up and running in a new qube, took a bit of tweaking but got there in the end, the only frustrating issue is that every time I load the system I need to reinstall java, is it possible to make java persistent for only this cube?

Sven · November 14, 2021, 2:52am

@Cubester:

I like to try and give back when I can, but unfortunately due to my lack of experience it is very one sided at the moment, I think the best thing I can do at this stage is make a donation to the project.

Donations are always a good idea, but asking good questions and providing feedback to the answers is 50% of creating a useful thread that will help many others after the fact. I am delighted to read you attitude towards the project. Thank you for joining the community!

I have been able to get Qortal up and running in a new qube, took a bit of tweaking but got there in the end, the only frustrating issue is that every time I load the system I need to reinstall java, is it possible to make java persistent for only this cube?

clone the template and install java in that clone, then only use it for this particular qube
use a downloadable java version instead of the one from the repository and install it
2a) … in your home directory
2b) … somewhere else and use bind dirs to make it persistent

My recommendation would be method 1)