Does anyone have a script to randomly rotate between vpns in sys-vpn using this setup?
I wanted to randomly switch between 10-40 mins
I don’t think this would give you any privacy improvements as your sessions would be linked to the same IP. You’re probably more in need of Tor browser, which different circuits for different websites and rotates every 10 minutes.
im using a proxychain config though
BTW what are the advantages / disadvantages with a manual setup like this and tasket-vpn-qube?
I probably tried every VPN guide for qubes there is and tasket is by far the best experience. Even though I feel much safer whitelisting ip addresses in the qubes firewall.
I didn’t know about GitHub - tasket/Qubes-vpn-support: VPN configuration in Qubes OS but I don’t really understand what it brings compared to a simpler setup using NetworkManager 
There are many ways to achieve a vpn qube, I provided a pretty vanilla one.
Works fine with debian-12-minimal based disposable. The only packages you need to install are qubes-core-agent-networking and qubes-core-agent-network-manager --no-install-recommends.
In disposable template set killswitch firewall rules and import configs. The only difference from fedora is that you need to import wireguard configs as root and setup autoconnect from the command line. Use the command nmcli c to list connections and nmcli connection modify <connection-name> autoconnect no to disable autoconnect. Leave only one vpn connection with enabled autoconnect or it wouldn’t work at startup.
Also, you need to autostart network manager in disposable template by choosing custom in Services tab and manually typing network-manager in.
3 Likes
This was the last thing I was missing in the guide - gonna try it out later. Thanks @Isolator!
I do not recommend this one. It is much more cumbersome to setup. Then if you forget to install it again when doing template upgrades, the killswitch won’t be enforced without any warning…
Overall, the setup in this guide is the best of all guides I have tried.
1 Like
The correct way to install qubes-vpn-support is inside an AppVM. If the configuration is set up correctly with the appropriate qube service, it will not be possible to reach the outside, even if qubes-vpn-handler ends up in a failed state, because the nftables/iptables rules are set up and only the group 9 interface can forward packets upstream (which doesn’t exist unless the VPN is working).
I agree that this guide is simpler, but I prefer the hardening with interface groups provided by qubes-vpn-support and the fact that I don’t have multiple network managers in my widget bar for all my different vpn qubes.
2 Likes
To configure killswitch + (DNS) leak protection + ICMP/ping blocking + protection in case of sys-vpn compromise, you can alternatively execute a three-liner in dom0, no nft/iptables needed:
qvm-firewall sys-vpn reset # (1)
qvm-firewall sys-vpn add accept dsthost=1.2.3.4 # (2)
qvm-firewall sys-vpn del --rule-no 0 # (3)
(1) resets firewall to one single rule accepting everything
(2) whitelists specific VPN gateway IP
(3) removes rule (1), so there is just one whitelisted IP from (2) left
Everything else is blocked safely outside sys-vpn.
4 Likes
this is already explained in the guide by using the firewall GUI
Not quite I think 
. Using the firewall GUI as described in your guide, Qubes still allows any ICMP or DNS requests outside VPN. If you don’t do further hardening via iptables/nft, this might end up with DNS or ping leaks. The only way to block DNS/ICMP with Qubes’ firewall is to use qvm-firewall CLI and remove wildcard rule for everything (accept) and dns special target + icmp, if exists. Above is a reproducible way to catch all cases consistently by first resetting firewall and then applying whitelist rules.
You can recheck with qvm-firewall sys-vpn list. End result should look similar to
NO ACTION HOST PROTOCOL PORT(S) SPECIAL TARGET ICMP TYPE EXPIRE COMMENT
0 accept 1.2.3.4/32 - - - - - -
3 Likes
indeed! I’ll add this to the guide 
3 Likes
Now, the guide looks a bit unclear to me. Maybe it is better to explicitly mark it as a ‘VPN hardening’ chapter with two subchapters
A1: ‘3-liner quick hardening’ and
A2: ‘Hardening with nft’
If not, it is not clear (for newbies) that one harding is enough.
That’s indeed confusing…
But they do different things 
I’ll think about how to rework this part.
I added a snippet of code to pick a random VPN at the qube start
Direct link 
Wireguard VPN setup
1 Like
this seems kind of ridiculous, I would change to another vpn provider, where its quick and easey, don’t need taskets setup , starts with a M
@Clodius you above comment is a bit enigmatic. What is ridiculous. With an M? What’s quick an easy in other providers? I don’t get it…
in the past I used the tasket way, it was fine, but seems things have changed for a basic setup, just works
Hi! I have successfully used wg cube customized according to the guide in cube 4.1. Now I have upgraded to os 4.2 and faced a problem.
My setup:
internet<sys-net<sys-firewall<vpn1-vless<vpn1-firewall<vpn2-wg<vpn2-firewall
In the sys-firewall/vpn1-vless cubes, ping service/dns works fine.
vpn2-wg is powered by fedora 38. From settings only imported wg configuration, dns/firewall unchanged.
In vpn2-wg inside the cube ping/dns work. I can open the site.
Next I try to add firewall cube, but inside this cube ping and dns are not working.
What could be the problem?
