Officiel protonvpn version doesn't work with Qubes OS

ProtonVPN now offers Wireguard connections. Setting up a Wireguard VPN is easier and much less crufty than dealing with OpenVPN, and it is said that the ciphers are stronger too. There are probably instructions out there for using Wireguard with Proton on Linux, so follow those.

Also, just a heads up that Proton AG (which runs ProtonMail and ProtonVPN) isn’t exactly the darling of the privacy world right now:

https://news.ycombinator.com/item?id=28443449

https://news.ycombinator.com/item?id=29102776

2 Likes

I don’t know man. I would have thought using a minimal is a lowest common denominator and rules a lot of stuff out. A few have it working so it doesn’t make sense to me.

Who will be the first with data centers in space? No heat problem either. I don’t see wg support on their website yet.

1 Like

I’m unfamiliar with this turn of phrase in the context of this conversation–please elaborate.

Have you considered entering ‘protonvpn wireguard’ into a search engine of your choice?

Also see:

1 Like

If you’re concerned about dishonest providers, marketing scams, and legal jurisdiction, a data center in space has no jurisdiction.

I’m using it. It’s not available for linux through the app.

1 Like

The issues with Proton seem to be deeper (see the second link)

You’re correct here; I spoke too soon. Linux support should be here soon though:

https://www.reddit.com/r/ProtonVPN/comments/ox0xuj/wireguard_on_protonvpn_is_here_now_available_on/h7jfva2/

@joe.blough:

Who will be the first with data centers in space?

The Japanese?

data center in space has no jurisdiction

Article VIII of the 1967 Outer Space Treaty:

A State Party to the Treaty on whose registry an object launched into outer space is carried shall retain jurisdiction and control over such object, and over any personnel thereof, while in outer space or on a celestial body.

However, with private entities this might become more difficult.

What a rabbit hole! Thanks @joe.blough :wink:

Big news :fire: :fireworks: :partying_face:

Since it’s out, after almost one year of trying everything and waiting the release of new version fixing it, this day has come, I am now able to use the official protonvpn version, and remplace the community protonvpn inside QubesOS and use it as an intermediate Qubes.

Exemple : sys-net → sys-firewall → sys-VPN → debian-11-work

What I am using :

Qubes OS : 4.1 lastest version
Debian version : 11
Officiel protonvpn gui version : ProtonVPN: v1.7.0 (library: v3.8.0 / api-client: v0.7.1)
Officiel protonvpn cli version : ProtonVPN CLI v3.11.1 (protonvpn-nm-lib v3.8.0; proton-client v0.7.1)

Step 1 :

Create a new and clean Qubes with debian 11 template
Very important → :warning: In the configuration of that new Qubes, go in services and enable network-manager :warning:

Step 2 :

In command line

In any Qubes terminal with internet :

wget https://protonvpn.com/download/protonvpn-stable-release_1.0.1-1_all.deb

Move the file to the debian-11 template

In debian-11 template

sudo apt-get install ./protonvpn-stable-release_1.0.1-1_all.deb -y
sudo apt-get update
sudo apt-get install protonvpn-cli protonvpn -y

Step 3 :
Now start the new Qube you created with debian-11 template

You can use the graphical version for exemple, Log in and enjoy :partying_face:
Or use protonvpn-cli login

Community version

Secure-core :white_check_mark:
Netshield :no_entry_sign:
Do not use root :no_entry_sign:
KillSwitch not working well :no_entry_sign:
Command line :white_check_mark:

Everything is working perfectly fine with the official version:
Do not use root :white_check_mark:
Graphical interface :white_check_mark:
Command line :white_check_mark:
Secure-core :white_check_mark:
KillSwitch :white_check_mark:
Netshield :white_check_mark:

More info if you need :

1 Like

That’s old buddy. That’s where I got the info I posted earlier. I guess I should have thought to post those links.

Trying the Proton official method described above.

Have created a branch template from Debian-11 template. We’ll call it protonvpn-template.

Performed first step: ‘wget https://protonvpn.com/download/protonvpn-stable-release_1.0.1-1_all.deb

I noticed my terminal stated ‘HTTP request sent’ instead of ‘HTTPS request sent’- is that typical? Network pathway was: sys-net > sys-firewall > clearnet-appvm. No Tor or other VPN involved in this process.

Moved to my protonvpn-template. Success.

In protonvpn-template things not as expected. See below:

Action:

‘sudo apt-get install ./protonvpn-stable-release_1.0.1-1_all.deb -y’

Result:

‘Reading package lists… Done
E: unsupported file ./protonvpn-stable-release_1.0.1-1_all.deb given on commandline’.

Any thoughts?

Follow up: Opened up file manager in protonvpn-template and dragged the file with GUI into it’s associated protonvpn-template after ‘sudo apt-get install’. The whole thing in terminal appeared as 'sudo apt-get install ‘/home/user/QubesIncoming/protonvpn-stable-release_1.0.1-1_all.deb’.

Result: [mostly omitted because it appears to be what you’d expect?]

BUT AT THE END

‘N: Download is performed unsandboxed as root as file ‘[above referenced home directory location]’ couldnt be accessed by user ‘_apt’/ - pkgAquire: :Run (13: Permission denied)’

I take this to mean the permissions of the downloaded file are not such that I can run them after sending from one vm to another. Possibly because I downloaded the vpn stable release in step 1 with ‘sudo wget’ instead of ‘wget’. Maybe this puts some sort of lock on the file download? Am deleting all newly created vms and templates and starting over now.

After deleting all created vms and repeating this process, the cli and gui versions of protonvpn now do appear in my protonvpn qube. I cannot determine if it’s because if reinstalled in fresh qubes with ‘wget’ instead of ‘sudo wget’, or simply because i restarted qubes between loading up appvm qube this time around. I am able to log in with my proton credentials (it appears to recognize my status as a free user, but maybe that is just the default presentation when downloaded and it hasnt acknowledged my credentials at all). In any case- CANNOT CONNECT.

Initially all I had was a failed to connect notification in the protonvpn GUI. After trying to reconnect and making sure I had assigned a password for the default key that I was prompted to complete, I now get linked to a protonvpn troubleshooting window.

Anyone else had this? Will continue to troubleshoot and update.

1 Like

@anon59741345 Are you running KDE on your installation by any chance?
I had the exact same series of issues you mentioned while trying to set ProtonVPN up on Qubes 4.1.0 running KDE installed via sudo qubes-dom0-update kde-settings-qubes (but otherwise stock install).
Couldn’t figure out how to solve the issue, tried with all sorts of combinations of templates and settings but nothing stuck so ended up just reinstalling Qubes, skipping KDE and sticking instead with stock XFCE, repeating the “official” steps to set up ProtonVPN as sys-net → sys-firewall → sys-VPN → fedora-34 and all works fine now.