Struggling with setting up ProtonVPN cube on Qubes 4.2.4 – any recent working guide?

[pjotr]

Hi all,

I’m trying to set up a dedicated VPN cube for ProtonVPN on Qubes OS 4.2.4 (using a Fedora 39 minimal template), but I’m completely stuck. I’ve gone through multiple forum posts and guides, but most seem outdated or no longer work properly.

Here’s what I’ve tried so far:
• Created a standalone Qube with Fedora 39 minimal
• Added network-manager and qubes-firewall services
• Tried both ProtonVPN CLI and ProtonVPN GUI (both fail to connect or throw errors)
• Followed WireGuard setup instructions from GitHub and PrivacyGuides — also ran into dependency issues or broken configs

What I’m looking for:
• A working, up-to-date guide for setting up ProtonVPN on Qubes 4.2.4
• I have a paid ProtonVPN account, so I can use full server options
• Preferably CLI-based (no GUI bloat), but anything stable and secure is fine

If anyone has a working setup from 2025, I’d really appreciate a walkthrough or link. Thanks in advance!

[Tezeria]

it’s working fine for me with fedora/debian-minimal and kicksecure:

Wireguard VPN setup

Good news, with fedora-38 the network manager supports Wireguard out of the box! The only thing required are extra firewall rules in the VPN qube, as explained in the community documentation about VPN. What you’ll need This guide assumes you are using a VPN service that has wireguard support, most of them do, but you can also add your own if you have a server. ProtonVPN has a free plan, it has limits but gives you a fully working VPN and they support WireGuard. This pro…

edit: According to what I remember, it works very well with OpenVPN too, for other vpn than protonvpn.

[rubberducky1]

Solene’s excellent guide works for me and others. Even a minimal setup was created as an option. I would suggest you update to the latest supported fedora template which is fedora 41.

ProtonVPN App 4.2 setup guide

Intro This guide explains how to setup a VPN with ProtonVPN app on Qubes OS 4.2 using a Fedora template. A cool thing with ProtonVPN is that they have a free offer - though it comes with limitations it’s nice. They seem also a legit service to use as per the trustable source Private VPN Service Recommendations and Comparison, No Sponsors or Ads - Privacy Guides If you want to set up a ProtonVPN using WireGuard without the App, see Wireguard VPN setup Setup Qube creation Create a dedicated q…

[KitsuneNoBaka]

I’ve just made duplicate of standard fedora template, added protonvpn repository to new template, installed vpn in new template, made app qube on base of this template with “providing network” option, sys-firewall as network source, added network-manager service, run this app qube, run proton, configured it, made run with connected qube and aded desktop file to run proton gui on start.

[solene]

I guess my guide should work to use with the CLI, I didn’t try it though. But this doesn’t change much, you need to setup everything the same and install protonvpn package, then just use the cli.

[alfonsius]

Solene’s guide works for me perfectly, with deb-12 too. 2 days ago my last setup.

[pjotr]

Hi Solene, appreciate your guide but I’m getting stuck at the ProtonVPN part. What am I doing wrong?

[deeplow]

You’re missing there “41” to be fedora-41-stable and not fedora–stable, according to How to install Proton VPN on Fedora | Proton VPN.

[deeplow]

@Tezeria

According to what I remember, it works very well with OpenVPN too, for other vpn than protonvpn.

Last time I checked via OpenVPN the “autoconnect” does not work due to some weird interactions with the way Qubes modifies network manager. But for wireguard this works flawlessly. So I highly recommend wireguard instead if your server supports it.

[Tezeria]

i don’t know, i never use “autoconnect” i prefer to choose my server.

@deeplow

So I highly recommend wireguard instead if your server supports it.

I do with protonvpn

[hUt4Ke107Y7VyK]

I just created an AppVM (sys-protonvpn) with “provides network” and installed ProtonVPN with flatpak. It needs to be manually upgraded from time to time though.

flatpak remote-add --user --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
flatpak --user install flathub com.protonvpn.www

[solene]

I’d advise against using ProtonVPN from flatpak for these reasons:

• The Flatpak is not handled by ProtonVPN people
• Last change of the Flatpak version happened 25th March while there was an official update for ProtonVPN Linux App 2nd April

It’s possible the changes between 4.9.5. and 4.9.6 which were done in the official repo were not useful for the flatpak version (it was path changes) so the maintainer did not update it. But it would still be better to use the official package when possible.