ProtonVPN GUI based on Debian 13 minimal template in Qubes 4.3.1

[Greg.K]

Hi there.

Warning: the minimal templates are intended only for advanced users. To understand why, read the following:

• Minimal templates — Qubes OS 4.3.1 documentation
• and Why Use Minimal Templates? - #15 by adw

I looked for a minimal template so that my AppVM does not take more place than needed and also to reduce potential attack surface. The sole purpose of my VPN AppVM is to serve as VPN. Debian seems also more stable and secure to me than Fedora.

I just collected other community member’s guides and pasted them together. As I am a newbie myself I thought this topic may be useful to others so here am I.

Please feel free to give advice and advises

ProtonVPN minimal Debian Qube
Create a ProtonVPN Minimal Template and create the AppVM’s based on it.

1 - Clone an unaltered Debian 13 minimal template to serve as the template for the Proton VPN AppVM, name it e.g. sys-protonvpn-minimal

2 - Debian 13 minimal templates don’t have wget or curl installed, so use another VM to download the available .deb file.
As of September 2026, that is version 1.0.8. (repo.protonvpn(dot)com/debian/dists/stable/main/binary-all/protonvpn-stable-release_1.0.8_all.deb)
Then, move the file to sys-protonvpn-minimal so that it appears in /home/user/QubesIncoming.

Open a terminal in the newly-created template as the root user.
[user@dom0 ~]$ qvm-run --user root sys-protonvpn-minimal uxterm

In the just-opened terminal, install the .deb file and then the required software.
This will use the default dom0 update qube for network access, which you could have chosen to be sys-whonix.
[root@sys-protonvpn-minimal ~]$ apt install /home/user/QubesIncoming/anon-whonix/protonvpn-stable-release_1.0.8_all.deb

(If you aren’t sure which folder, check it by [root@sys-protonvpn-minimal ~]$ ls /home/user/QubesIncoming)
[root@sys-protonvpn-minimal ~]$ apt install proton-vpn-gnome-desktop qubes-core-agent-networking qubes-core-agent-network-manager network-manager-applet gnome-shell-extension-appindicator gnome-shell-extension-prefs
[root@sys-protonvpn-minimal ~]$ usermod -G netdev -a user # from ``https://github.com/ProtonVPN/linux-app/issues/27

KillSwitch (even if you can toggle it on in the GUI menu):

Add the rules below in /rw/config/qubes-firewall-user-script in the qube:

#Prevent the qube to forward traffic outside of the VPN

nft add rule qubes custom-forward oifname eth0 counter drop
nft add rule ip6 qubes custom-forward oifname eth0 counter drop

Remove the ProtonVPN download
[root@sys-protonvpn-minimal ~]$ rm /home/user/QubesIncoming/anon-whonix/protonvpn-stable-release_1.0.8_all.deb

3 - Create a new AppVM:
Check “provide network access to other qubes” in the Advanced settings tab
In the qube settings:

• Give it 800 MB of memory minimum
• Add the service qubes-firewall
• Add the service network-manager

Remember, if you want to use sys-whonix (Tor) as NetVM for your ProtonVPN qube, choose “TCP” as protocol in the GUI menu of ProtonVPN.

Sources :

Tutorial: Installing ProtonVPN CLI in a Debian 12 Minimal VM in 4.1.2

This guide explains how to set up the official ProtonVPN command line interface (CLI) as a ProxyVM for other AppVMs to connect through. This has the advantage of not needing to maintain a list of active ProtonVPN servers as OpenVPN or Wireguard configuration files. It also has the advantage of relying on the CLI’s built-in kill switch and does not require modifications of sys-firewall. This method can easily be chained with sys-whonix to avoid connecting to the VPN provider directory from your I…

ProtonVPN installation based in fedora-43 minimal

Even if you’re a new user, I definitely support trying to embrace minimal templates if you plan on running many qubes simultaneous! But @parulin’s warning above is true: you will run into issues at the beginning. I’d recommend first trying to install things using Xfce templates, and once that’s confirmed working, replicate in minimal templates. That way, if you run into issues with the minimal template, you’ll know it’s because of missing dependencies and not something else. In any case, here’…

Bye!

[WhiteShadow]

Thank you for your hard work and for sharing your approach. However, there is an official guide available with Proton repository.

How to install Proton VPN on Debian and Ubuntu | Proton VPN

[Greg.K]

The question was, how to use that guide so you can make it work in a minimal Debian config.

As “simple” as that…

This topic is for the complete newbie as myself.

[WhiteShadow]

@Greg.K

This topic is for the complete newbie as myself.

Minimal templates target advanced users, not beginners, and require manual configuration. Including AppArmor profiles, firewall rules, and related setup. See Minimal templates — Qubes OS 4.3.1 documentation for details.

[Greg.K]

If you think that what I’ve written may cause harm to other users who try it, tell me and I’ll delete it with my excuses.

If you would like to give advices to improve it you’re most welcome!

[sm95]

I needed to add the user account to the netdev group to get the ProtonVPN CLI/GUI apps to work for me in a Debian 13 minimal setup: usermod -G netdev -a user

Ref: Tutorial: Installing ProtonVPN CLI in a Debian 12 Minimal VM in 4.1.2

Edit: I see that the netdev group addition is in the above. I missed it because of the code formatting. My bad.