@solene ok great thanks Solene! 
but you can confirm that i need i need to setup new squid proxy with other listening port e.g 3129? otherwise the client cube how it know to which one need to connect?
so from qube side i will set localhost:3128 for sys-proxy-out and let’s say localhost:3129
for sys-proxy-out-VPN right? in 50-squid.policy i can have:
qubes.ConnectTCP +3128 MyQube @default allow target=sys-proxy-out
qubes.ConnectTCP +3129 MyQube @default allow target=sys-proxy-out-vpn
?
can you so be kind to help me with dns topic ? i would like to know how you manage DNS. see the new topic opened (How do you manage DNS topic?). a guide would be very useful for all community.
thanks so much