Hello everyone
I want to install ProtonVPN based fedora-43 minimal, then I wan’t to create sys-prtonvpn and another firewall and then connect AppVM which I want to run through ProtonVPN Could you please guide me regards this matter step by step
The minimal templates are intended only for advanced users. Most things will not work out-of-the-box, and you will have to fix them yourself. If you are not prepared to do a lot of reading, searching, learning, and troubleshooting, then you should instead stick to the standard templates, which are perfectly suitable for the vast majority of users. In particular, if you are new to Qubes, you should not attempt to use minimal templates until you have gained more experience.
Even if you’re a new user, I definitely support trying to embrace minimal templates if you plan on running many qubes simultaneous!
But @parulin’s warning above is true: you will run into issues at the beginning. I’d recommend first trying to install things using Xfce templates, and once that’s confirmed working, replicate in minimal templates. That way, if you run into issues with the minimal template, you’ll know it’s because of missing dependencies and not something else.
In any case, here’s what I did to install Proton VPN on Fedora 43 minimal template:
- Clone an unaltered Fedora 43 minimal template to serve as the template for the Proton VPN AppVM, name it e.g. t-protonvpn
- Open Dom0’s Xfce terminal and open a root terminal in that new template: $ qvm-run -u root t-protonvpn
- Install packages: $ sudo dnf install qubes-core-agent-networking qubes-core-agent-network-manager network-manager-applet -y
- Install Proton VPN:
- $ sudo dnf install wget apt-transport-https -y
- $ export https_proxy=http://127.0.0.1:8082/
- $ wget “https://repo.protonvpn.com/fedora-$(cat /etc/fedora-release | cut -d’ ’ -f 3)-stable/protonvpn-stable-release/protonvpn-stable-release-1.0.3-1.noarch.rpm”
- $ sudo dnf install ./protonvpn-stable-release-1.0.3-1.noarch.rpm
- $ sudo dnf check-update --refresh && sudo dnf install proton-vpn-gnome-desktop
- Delete deb file: $ rm protonvpn-stable-release-1.0.3-1.noarch.rpm
- Shutdown template
- Create new AppVM based on the above template, call it e.g. sys-protonvpn, with networking = sys-firewall, check “launch settings after creation” and check “Provides network access to other qubes” in “Advanced”
- Set “Private storage” size to 5GB, uncheck “include in memory balancing” (leave initial memory at 400 and 2 CPU), add “network-manager” and “qubes-firewall” in Services, and add “Proton VPN” in Applications
- Open Dom0’s Xfce terminal and open a root terminal in that new AppVM: $ qvm-run -u root sys-protonvpn
- Create autostart folder: $ mkdir /home/user/.config/autostart
- Set Proton VPN to autostart: $ ln -s /usr/share/applications/proton.vpn.app.gtk.desktop /home/user/.config/autostart/
- Open your firewall config: $ nano /rw/config/qubes-firewall-user-script
- Paste the below at the end the page, save and exit with CTRL+X and then S
# Prevent the qube to forward traffic outside of the VPN
nft add rule qubes custom-forward oifname eth0 counter drop
nft add rule ip6 qubes custom-forward oifname eth0 counter drop
- Shut down AppVM, and clone it if you want to use multiple instances of Proton VPN
- Boot ProtonAppVM, it will ask for keyring password, you have to put something (even just one letter / number)
- Log into ProtonVPN
Everything is working perfectly for me, but note two things:
- You cannot use this qube as “Dom0 update” unless you install “qubes-core-agent-dom0-updates” package in the template, and also increase the initial memory to 800mb for the appVM.
- Proton’s taskbar icon no longer appears when running as of the most recent update. Not a huge deal imo, you can e.g. create your own desktop shortcut to launch it instead.
At this point you should be able to create other AppVMs, and have them use “sys-protonvpn” as the Net qube.
Good luck!
2 Likes
Thank you Dear Lilly ,