Hi. Are the following instructions " ProxyVM as a VPN gateway using iptables and CLI scripts" still valid for Qubes 4.2? Or should iptables be changed to nftables? But what would that mean practically? What modifications should be made? Thank you.
I also would like to know how this is handled. I have been using VPN qubes in 4.1 running mullvad based on their instructions here, but I saw in the above mentioned github post that the firewall is changing a bit in 4.2. Does anyone have information on practical application?
iptables based rules for VPNs are not working anymore in 4.2, thatâs one of the reason why Iâm still on 4.1. There is an open pull request on github for qubes-vpn-support port to nftables but I donât really know the status of it:
Iâve also been trying to get a vpn to work in Qubes 4.2 rc3
Trying to get an openvpn file to work using Qubes vpn support by Taskett:
But in a Fedora app qube it does not work, nor does any kill switch function. Web requests in an app qube just pass straight through the vpn qube.
In Debian it doesnât work either but does block any internet connection.
In Fedora I got this error message when using the test command in Link Testing and Troubleshooting section of the README:
( GitHub - tasket/Qubes-vpn-support: VPN configuration in Qubes OS ) :
[user@sys-vpn vpn]$ sudo openvpn --cd /rw/config/vpn --config vpn-client.conf --auth-user-pass userpassword.txt
2023-09-05 07:55:00 DEPRECATED OPTION: --cipher set to âAES-256-CBCâ but missing in --data-ciphers (AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305). OpenVPN ignores --cipher for cipher negotiations.
2023-09-05 07:55:00 Note: Kernel support for ovpn-dco missing, disabling data channel offload.
2023-09-05 07:55:00 WARNING: cannot stat file âuserpassword.txtâ: No such file or directory (errno=2)
Options error: --auth-user-pass fails with âuserpassword.txtâ: No such file or directory (errno=2)
Options error: Please correct these errors.
Use --help for more information.
[user@sys-vpn vpn]$
This worked very well in 4.0 and 4.1.
I do have at least some bright news for the guidance aspect in the future: I reached out to mullvad, a company that runs a VPN based in sweden and who also publishes guide pages (as noted in my above post) specifically for using their VPN in qubes, and they informed me that they are aware of the switch in qubes 4.2 to nftablles and they are already planning to create a guide once the official release of 4.2 is complete. Still, it would be awesome to get some guidance on how to use a VPN in the interim. I looked through the syntax for policies a bit, but I donât really understand how to integrate that into qubes itself.
1 Like
Hi, guys, any update on this situation? Do we have nftables based rules that can Tor before VPN? Iâm looking for alternative to tasketâs Qubes-vpn-support. My daily work depends on this and itâs the only reason I canât move on to 4.2.
Yes this is the only thing stopping me upgrading to 4.2 as well. No vpn no 4.2.
Just tried remaking a tasket âQubes vpn supportâ qube but it still doesnât work . . .
Does anyone know how to get a vpn working in 4.2?
Thanks.
Works fine for me Wireguard VPN setup
4 Likes
You can try my PR:
4 Likes
@solene , do you know youâre amazing?! 
1 Like
Thanks 
Gave this a go in debian-12. Still getting the following error in the app VM when it starts:
iptables: Bad rule (does a matching rule exist in that chain?
This was after (1) doing the template install and (2) doing the app VM setup
Iâve just tried it with both template and AppVM install and with OpenVPN and Wireguard and it worked.
Are you sure that youâre using the Qubes-vpn-support with my patches?
You need to either download zip from this link:
GitHub - 1cho1ce/Qubes-vpn-support at replace-iptables-with-nftables
Or if youâre using git then:
git clone https://github.com/1cho1ce/Qubes-vpn-support.git
cd Qubes-vpn-support
git checkout replace-iptables-with-nftables
Or just:
git clone -b replace-iptables-with-nftables https://github.com/1cho1ce/Qubes-vpn-support.git
1 Like
Wow. This is amazing! Thank you!
So, as I understand it, it will no longer be possible to use openvpn with qubes 4.2 unless you use this script? Do I understand?
No, you can use OpenVPN in Qubes OS 4.2 even without this script. You just need to replace iptables rules with nftables rules.
1 Like
ok, nice 
thanks for your answer @1choice
Bit more debugging here. Yes I am definitely using your patched version, and Iâm re-creating the app VM from scratch. After installing and restarting this I get the following error:
Oct 18 12:56:23 test-vpn-new qubes-vpn-setup[1384]: Error: No such file or directory
Oct 18 12:56:23 test-vpn-new qubes-vpn-setup[1384]: list chain ip qubes custom-forward
Oct 18 12:56:23 test-vpn-new qubes-vpn-setup[1384]: ^^^^^
Oct 18 12:56:23 test-vpn-new qubes-vpn-setup[1383]: Traceback (most recent call last):
Oct 18 12:56:23 test-vpn-new qubes-vpn-setup[1383]: File ââ, line 46, in
Oct 18 12:56:23 test-vpn-new qubes-vpn-setup[1383]: File ââ, line 9, in main
Oct 18 12:56:23 test-vpn-new qubes-vpn-setup[1383]: IndexError: list index out of range
Oct 18 12:56:23 test-vpn-new qubes-vpn-setup[1371]: Error: Firewall rule(s) not enabled!
Any ideas why?
It seems that youâre using minimal template but you donât have required packages installed.
I think for debian-12-minimal it should be:
apt install qubes-core-agent-networking qubes-core-agent-network-manager wireguard openvpn xfce4-notifyd
1 Like