VPN instructions for 4.2

[1choice]

EDIT:
Are you talking about disposable template?
If not then read next:

Did you follow the readme correctly?

TemplateVM e.g. debian-12
AppVM (ProxyVM) e.g. sys-openvpn

@dispuser

I put the .conf files in the vpn directory (in rw/config/). I ran the script to set things up in the template.

Then I opened a new sys-openvpn qube based on this template. I did not see VPN was up. Nothing happened.

You need to put them inside your AppVM and not in TemplateVM. And you need to rename or make a link from your myvmpconfig.conf to vpn-client.conf:

Copy the VPN config files from your service provider to the ProxyVM’s ‘/rw/config/vpn’ folder, then copy or link the desired config to ‘vpn-client.conf’:

sudo mkdir -p /rw/config/vpn
cd /rw/config/vpn
sudo unzip ~/ovpn-configs-example.zip
sudo cp US_East.ovpn vpn-client.conf

@dispuser

I also created a service called vpn-handler-openvpn in the template. That service is not listed in sys-openvpn.

You need to add this service to your AppVM and not to TemplateVM:

Next, add vpn-handler-openvpn to the ProxyVM’s Settings / Services tab by typing it into the top line and clicking the plus icon. Do not add other network services such as Network Manager.

@dispuser

I had been using a qube that provides network with network-manager-openvpn installed and network-manager and then used a drop-down menu for different files. This worked well, but when it dropped, it did not close the connection and revealed my real IP.

Is there something I am doing wrong? Is there a way to use network manager so I can see the different vpn options? I would like sys-openvpn to block connection if the vpn drops.

You need to add killswitch. Like this but replace iptables rules with nftables:

Wireguard VPN setup

Good news, with fedora-38 the network manager supports Wireguard out of the box! The only thing required are extra firewall rules in the VPN qube, as explained in the community documentation about VPN. What you’ll need This guide assumes you are using a VPN service that has wireguard support, most of them do, but you can also add your own if you have a server. ProtonVPN has a free plan, it has limits but gives you a fully working VPN and they support WireGuard. This pro…

You can also use Qubes OS firewall to restrict your VPN qube connections only to your VPN server IP:port:

Wireguard VPN setup

Good news, with fedora-38 the network manager supports Wireguard out of the box! The only thing required are extra firewall rules in the VPN qube, as explained in the community documentation about VPN. What you’ll need This guide assumes you are using a VPN service that has wireguard support, most of them do, but you can also add your own if you have a server. ProtonVPN has a free plan, it has limits but gives you a fully working VPN and they support WireGuard. This pro…