(Scroll down for solution.)
ORIGINAL POST
Fresh 4.2 install
I strictly follow this (or this )
I had 4 working vpn qubes in 4.1 following guide, now i get ovpn error message, i do something wrong.
whenever i sudo openvpn --cd /rw/config/vpn --config openvpn-client.ovpn
I get error
read UDPv4 [ECONNREFUSED]: Connection refused (fd=3,code=111)
2024-04-04 14:57:28 write UDPv4 []: Operation not permitted (fd=3,code=1)
I try troubleshoot
sudo journalctl -u qubes-vpn-handler
– No entries –
sudo iptables -L -v
sudo: iptables: command not found
hmm ok??, i install in template and vm reboot. then I get:
user@vpnqube:/rw/config/vpn$ sudo iptables -L -v
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
user@vpnqube:/rw/config/vpn$ sudo iptables -L -v -t nat
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Nothing in /var/logs/syslog
I don’t think is this because i use iptables and script (fail-closed/killswitch threat model requirement). I look here, and here, here. I don’t use minimal templates, just fed39 and deb12
I think I need to open port somewhere? how and where? what doing wrong? I’m sad
E1&2: Formatting
E3: I read more nftables being used instead of iptables? Is there any orderly 4.2 VPN guide for Mullvad / ovpn?
Networking is super hard…
How I got my VPN qube / ProxyVM working
Requirements
- Mullvad VPN
- Use TCP, not UDP
- Debian 12 template
- Nftables replaces iptables
Step 1 - Prepare Template
Install openvpn in debian template sudo apt install openvpn nftables is already installed for me.
Step 2 - Create new qube.
Apply these settings:
- Network: sys-firewall
- Advanced: Check
Provides network access to other qubes. - Check
Launch qube settings after creating - Create, wait for settings or go to qube settings, then;
- Go to Services > Select a service: > Custom > + Add > Name of service:
vpn-handler-openvpn - Apply & OK
Note: Do not add any other network services or managers.
Step 3 - Create dir /rw/config/vpn
sudo mkdir -p /rw/config/vpn
Step 4 - Downloads and config files
ovpn config file
- Go to mullvad.net
- Account > Downloads > OpenVPN configuration > Linux > choose location > Advanced settings: TCP 443 > Download .zip archive
- Extract .zip
Qubes-vpn-support-replace-iptables-with-nftables.zip
- Go to 1cho1ce github
- Code > Download ZIP
Step 5 Copy the files
Copy all downloaded files to the ProxyVM’s ‘/rw/config/vpn’ folder.
Change config file name to ‘vpn-client.conf’
e.g sudo cp mullvad_*.conf vpn-client.conf
Step 6 Test connection (before script)
In VPN qube, first see if there is connection with ping qubes-os.org
then
sudo openvpn --cd /rw/config/vpn --config vpn-client.conf --auth-user-pass userpassword.txt
userpassword.txt might be mullvad_userpass.txt
I just copied both with sudo cp mullvad_userpass.txt userpassword.txt
You should see ‘Attempting to establish TCP connection with xxx’ and no errors.
Make sure ports in config file are correct (thanks @ DVM)
Step 7 - Install scripts
In /rw/config/vpn you should have unziped Qubes-vpn-support-replace-iptables-with-nftables
Now install with:
cd Qubes-vpn-support-replace-iptables-with-nftables
sudo bash ./install
Step 8 - Restart VM, check connection
Reboot the vpn qube and it should now start with
Ready to start link and shortly after LINK IS UP
Thanks for all the quick responses and help!