Hi. I needed a VPN to bypass the so-called “whitelists” in Russia. The setup: VPN qube → sys-whonix. In other words: VPN at the entry point, Tor at the exit point.
I’ve already tried several VPN subscriptions. During the whitelist restrictions, many servers respond to pings and Karing connects to them, but sys-whonix fails to connect to Tor — it behaves as if it’s still connecting via sys-firewall instead of Karing. I need to determine whether connection fails because the VPN servers themselves cannot bypass the whitelists or because Qubes requires additional configuration.
Here is a description of exactly what I did:
Initially, I used the portable version of Karing to manage my VPN subscriptions/configurations.
I created a dedicated Debian-based qube for it, using sys-firewall as its network qube.
During testing, I set the network qube for sys-whonix to the qube containing Karing (which I named sys-karing).
Next, I used the Karing application to connect to a server that was successfully responding to pings.
After that, I attempted to connect sys-whonix to Tor using Snowflake bridges.
The result: sys-whonix fails to connect. The behavior is identical to what happens when it fails to connect during the whitelists.
Here is what I tried next:
I cloned the Debian template of Karing and installed the Karing .deb package inside it.
I consulted the Amnezia VPN installation guide and, just in any case, installed all the additional packages listed in the Amnezia VPN manual into the template:
I changed the template for the sys-karing qube from the standard Debian one to the cloned template containing the installed Karing .deb version. I added it to the applications list and launch it exclusively from there.
I started by trying the free servers from this GitHub repository, then moved on to a paid subscription for Quattro VPN. The situation is the same in both cases: many servers respond to pings during the whitelist phase. Karing connects to them, yet sys-whonix still fails to connect to Tor. I’ve tried every bridge option as well as direct connections (without bridges). I’ve tested a multitude of servers that respond to pings, but to no avail.
Interestingly, when sys-whonix attempts to connect via certain VPN servers, the Karing interface shows a small amount of traffic—up to 4 KB download. However, the traffic always stalls at that point and goes no further.
Did I set everything up correctly? How can I verify that sys-whonix is actually attempting to connect through Karing, rather than simply using Karing’s network qube (in this case, sys-firewall)?
Qubes networking is fiddly even if you have good a understanding of Networking and Linux.
Did you read Joanna’s “Playing with Qubes Networking for Fun and Profit” from 15 years ago? Still a good read! (link here). Read this caveat also: unman’s post.
That said, when you use an “app”, in your case - “Karing”(? - of which I know nothing), to establish a VPN connection in a qube, and that app is not designed for QubeOS use, you have to fix manually at least a lot of the nft (firewall) rules to achieve what you desire.
To check if your sys-karing is actually accepting and forwarding connections (acting as a netvm), I would connect a simple disposable to it and run “curl https://ip.me”. If it shows your local IP, it’s not working. If it shows the VPN IP chosen through Karing, it is working. Like this:
(xterm on )dispNNNN -> sys-karing -> sys-firewall -> sys-net -> "THE INTERNET(s)"
Thanks for the advice! I did as you said. When whitelists worked, an error was displayed in the terminal. When they didn’t, I received the IP address of my ISP, which means that the qube receives the Internet not from the VPN, but from the sys-karing’s network qube directly (it has sys -firewall).
In other words, the Internet bypasses the VPN. In the meantime, the connection to the VPN servers is successful and they mostly ping successfully (I mean in sys-karing).
Could you tell me a program that will perform the role of Karing (an app that intended to work with VPN subscriptions/configs. I hope you understand what I am talking about), but at the same time will work in Qubes as expected? Otherwise, I feel skeptic about working according to the 2011 guide and, moreover, due to ignorance, I am afraid to go into the firewall, so as not to accidentally screw up anything unnecessary there. Still, the issue of network security is a serious issue.
Hello everyone! I fixed this all! It all turned out to be f*cking simple: you just had to enable Tune mode in Karing (it asks for a password for sudo, and that password is literally the word “sudo” ). I checked it after enabling Tune and it’s confirmed. IP belongs to VPN provider.
). I checked it after enabling Tune and it’s confirmed. IP belongs to VPN provider. 
