Tor over Wireguard VPN failing

[pr1vacy]

Hello guys,

because Mullvad decided to drop support for OpenVPN starting January 2026, Im trying to switch to Wireguard now.

Im trying to archieve a Tor over VPN setup by attaching the wireguard VPN NetVM to sys-whonix.

I strictly followed this official guide by Mullvad:

WireGuard on Linux terminal (easy)

Im using a standalone debian-12-xfce and a .conf file without killswitch and multihop.

VPN works perfectly fine when I attach the netVM to any qube… But when I use it to provide network to sys-whonix, tor connection fails every time

Rarely it connects, but its really slow and keeps crashing all the time.

I tried limiting MTU in the .conf files because I heard wireguard can cause issues with this, no effect.

Does anyone have a clue why sys-whonix has trouble picking up the network provided by the wireguard VPN netVM?

I have been using an OpenVPN netVM for this setup before without any issues:

Mullvad on Qubes OS 4

Thank you in advance.

[MellowPoison]

Try to fix the MTU problem using firewall:

Wireguard VPN setup

Good news, with fedora-38 the network manager supports Wireguard out of the box! The only thing required are extra firewall rules in the VPN qube, as explained in the community documentation about VPN. What you’ll need This guide assumes you are using a VPN service that has wireguard support, most of them do, but you can also add your own if you have a server. ProtonVPN has a free plan, it has limits but gives you a fully working VPN and they support WireGuard. This pro…

[solene]

Tor can only carry TCP packets, wireguard is exclusively UDP. This can’t work.

[MellowPoison]

I think the OP meant this configuration (or at least that’s how I understood the OP):
sys-net ↔ sys-vpn ↔ sys-whonix