ProtonVPN App 4.2 setup guide

Community Guides
81

Hmmm… now I see that it is a stadalone :man_facepalming:
Seems that you don’t have DNS resolution, even with the killswitch off… can you “ping dns.google” or “curl https://ip.me”?

82

Zero packet loss pinging dns.google.

64 bytes from dns.google (8.8.4.4): icmp_seq=1 ttl=117 time=12.9 ms
64 bytes from dns.google (8.8.4.4): icmp_seq=2 ttl=117 time=15.8 ms
64 bytes from dns.google (8.8.4.4): icmp_seq=3 ttl=117 time=19.2 ms
64 bytes from dns.google (8.8.4.4): icmp_seq=4 ttl=117 time=22.2 ms
64 bytes from dns.google (8.8.4.4): icmp_seq=5 ttl=117 time=14.3 ms
64 bytes from dns.google (8.8.4.4): icmp_seq=6 ttl=117 time=18.8 ms
64 bytes from dns.google (8.8.4.4): icmp_seq=7 ttl=117 time=9.72 ms
64 bytes from dns.google (8.8.4.4): icmp_seq=8 ttl=117 time=22.1 ms
64 bytes from dns.google (8.8.4.4): icmp_seq=9 ttl=117 time=18.3 ms
^C
--- dns.google ping statistics ---
9 packets transmitted, 9 received, 0% packet loss, time 8013ms
rtt min/avg/max/mdev = 9.720/17.026/22.249/3.971 ms

can’t connect to the server though

curl https://ip.me
curl: (7) Failed to connect to 127.0.0.1 port 8082 after 0 ms: Couldn't connect to server

Might just remake the standalone cloned from fedora-41.

83

I just really want to know why it isn’t working

84

Well, it tried to use the proxy server from earlier! Try “unset all_proxy” and the all the other proxy vars first, then retry the curl.

85

fedora-41 is not a valid value. Only the version number is required.
Your command should be this:

sudo dnf --releasever=41 distro-sync --best --allowerasing
2 Likes
86

This was it. Appreciate you! @barto you were also helpful as always. May not have been the solution but I still learned something!

1 Like
87

Hi,
As I (finally!) installed Qubes and start to mess around, I gave PVPN a try …
I followed your guide, but I stumble on unexpected questions:

I created the qubes, etyc … OK,
I went to a terminal to DL and install PVPN
But then since the qube doesnt have a desktop, how do I see if PVPN has installed ? how do I start it, where do I see the icon ?

88

You should have a “Proton VPN” entry in the qube’s applications list.

1 Like
89

Hi Solene,
Yes ! of course, dumb me … all good !
I now have the VPN conected, with the icon in the top main menu, I’ve added defaults cxions to it for quick access,
And I’ve redirected all qubeVM netwrok to this qube
KS is on “permanent”

Looks like it’s working :slight_smile: TY !

1 Like
90

Hello,
Should I keep sys-firewall ?
Should I keep sys-net->sys-firewall->sys-vpn->appVM
Or should I sys-net->sys-vpn->sys-firewall->appVM
Or just sys-net->sys-vpn->appVM

91

For me, it’s better to ALWAYS keep sys-firewall :slight_smile:

1 Like
92

I thought so, TY,
So then:
Should I keep - sys-net->sys-firewall->sys-vpn->appVM
Or should I go - sys-net->sys-vpn->sys-firewall->appVM

It seems the second option is not welcome by the system

93

Whatever happens, always keep this configuration: sys-net->sys-firewall->…

1 Like
94

Exactly, and for best practices, add a sys-firewall-whateverthename (it’s only a disposable qube with “provides network” checked and nothing more) between sys-vpn and the qubes using sys-vpn, this allows a layer of firewall in case the VPN is breached. This also allows to secure firewall rules of qubes using the VPN as they would be stored in sys-firewall-whatever instead of the vpn qube itself.

1 Like
95

But that would mean I will have two sys-firewall ?
sys-net->sys-firewall->sys-vpn-sys-firewall-name->appvm

I have the perm killSwitch on, and just tested it fine (PVPN disconnected, no appvm can reach internet)

I was thinking about retricting the (single) sys-firewall firwall to/from only allow cnxion to protonvpn IPs ?

96

:+1:

1 Like
97

Here is what I received from Proton:
As their IP are numerous and changes often-ish over time, they instead gave me their ports
Here are the ports that are used for Proton VPN:

OpenVPN:

  • UDP ports: 80, 1194, 4569, 5060, 51820
  • TCP ports: 443, 7770, 8443

WireGuard:

  • UDP ports: 88, 443, 500, 1224, 4500, 51820
  • TCP port: 443

Since all sys-net-proxy cnxion (i.e: dom0 update) goes through sys-net skipping sys-firewall, this restriction should not be a problem.

98

I don’t use the proton app. I go directly through the network-manager. You can try the @solene solution which should work with the proton app to block non-proton ips.

1 Like
99

Qubes 4.2.4 installed GUI in sys-vpn qube;
sys-net → sys-FW → sys-vpn → appVM,
If I disconnect VPN, no appVM have access to the net (only apt/dnf do, as is goes around)

100

Is there a question in your statement?

1 Like