iptables based rules for VPNs are not working anymore in 4.2, that’s one of the reason why I’m still on 4.1. There is an open pull request on github for qubes-vpn-support port to nftables but I don’t really know the status of it:
I’ve also been trying to get a vpn to work in Qubes 4.2 rc3
Trying to get an openvpn file to work using Qubes vpn support by Taskett:
But in a Fedora app qube it does not work, nor does any kill switch function. Web requests in an app qube just pass straight through the vpn qube.
In Debian it doesn’t work either but does block any internet connection.
In Fedora I got this error message when using the test command in Link Testing and Troubleshooting section of the README:
( GitHub - tasket/Qubes-vpn-support: VPN configuration in Qubes OS ) :
[user@sys-vpn vpn]$ sudo openvpn --cd /rw/config/vpn --config vpn-client.conf --auth-user-pass userpassword.txt
2023-09-05 07:55:00 DEPRECATED OPTION: --cipher set to ‘AES-256-CBC’ but missing in --data-ciphers (AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305). OpenVPN ignores --cipher for cipher negotiations.
2023-09-05 07:55:00 Note: Kernel support for ovpn-dco missing, disabling data channel offload.
2023-09-05 07:55:00 WARNING: cannot stat file ‘userpassword.txt’: No such file or directory (errno=2)
Options error: --auth-user-pass fails with ‘userpassword.txt’: No such file or directory (errno=2)
Options error: Please correct these errors.
Use --help for more information.
[user@sys-vpn vpn]$
This worked very well in 4.0 and 4.1.
I do have at least some bright news for the guidance aspect in the future: I reached out to mullvad, a company that runs a VPN based in sweden and who also publishes guide pages (as noted in my above post) specifically for using their VPN in qubes, and they informed me that they are aware of the switch in qubes 4.2 to nftablles and they are already planning to create a guide once the official release of 4.2 is complete. Still, it would be awesome to get some guidance on how to use a VPN in the interim. I looked through the syntax for policies a bit, but I don’t really understand how to integrate that into qubes itself.
1 Like
Hi, guys, any update on this situation? Do we have nftables based rules that can Tor before VPN? I’m looking for alternative to tasket’s Qubes-vpn-support. My daily work depends on this and it’s the only reason I can’t move on to 4.2.
Yes this is the only thing stopping me upgrading to 4.2 as well. No vpn no 4.2.
Just tried remaking a tasket ‘Qubes vpn support’ qube but it still doesn’t work . . .
Does anyone know how to get a vpn working in 4.2?
Thanks.
You can try my PR:
4 Likes
Thanks 
Gave this a go in debian-12. Still getting the following error in the app VM when it starts:
iptables: Bad rule (does a matching rule exist in that chain?
This was after (1) doing the template install and (2) doing the app VM setup
I’ve just tried it with both template and AppVM install and with OpenVPN and Wireguard and it worked.
Are you sure that you’re using the Qubes-vpn-support with my patches?
You need to either download zip from this link:
GitHub - 1cho1ce/Qubes-vpn-support at replace-iptables-with-nftables
Or if you’re using git then:
git clone https://github.com/1cho1ce/Qubes-vpn-support.git
cd Qubes-vpn-support
git checkout replace-iptables-with-nftables
Or just:
git clone -b replace-iptables-with-nftables https://github.com/1cho1ce/Qubes-vpn-support.git
1 Like
Wow. This is amazing! Thank you!
So, as I understand it, it will no longer be possible to use openvpn with qubes 4.2 unless you use this script? Do I understand?
No, you can use OpenVPN in Qubes OS 4.2 even without this script. You just need to replace iptables rules with nftables rules.
1 Like
Bit more debugging here. Yes I am definitely using your patched version, and I’m re-creating the app VM from scratch. After installing and restarting this I get the following error:
Oct 18 12:56:23 test-vpn-new qubes-vpn-setup[1384]: Error: No such file or directory
Oct 18 12:56:23 test-vpn-new qubes-vpn-setup[1384]: list chain ip qubes custom-forward
Oct 18 12:56:23 test-vpn-new qubes-vpn-setup[1384]: ^^^^^
Oct 18 12:56:23 test-vpn-new qubes-vpn-setup[1383]: Traceback (most recent call last):
Oct 18 12:56:23 test-vpn-new qubes-vpn-setup[1383]: File “”, line 46, in
Oct 18 12:56:23 test-vpn-new qubes-vpn-setup[1383]: File “”, line 9, in main
Oct 18 12:56:23 test-vpn-new qubes-vpn-setup[1383]: IndexError: list index out of range
Oct 18 12:56:23 test-vpn-new qubes-vpn-setup[1371]: Error: Firewall rule(s) not enabled!
Any ideas why?
It seems that you’re using minimal template but you don’t have required packages installed.
I think for debian-12-minimal it should be:
apt install qubes-core-agent-networking qubes-core-agent-network-manager wireguard openvpn xfce4-notifyd
1 Like
It’s a full debian-12 template but I will check if the prerequisite packages are all there…
Then what’s the output of these commands?
sudo nft list ruleset
ip a