In this guide we will set up a ProxyVM called "MullvadVPN", which will provide network to other AppVMs. This guide is using WireGuard.

Note: We will use Sweden (se-got-wg-001) as the server in this guide. If you want to use another server then replace the configuration with that.

This guide has been tested on Qubes OS 4.1.2.

Create a new qube

First install the Fedora 38 template (if you do not already have it) using the following command in the Terminal Emulator (dom0):

sudo qubes-dom0-update qubes-template-fedora-38

Click on the Qubes app menu > Qubes Tools > Create Qubes VM.

Name and label: MullvadVPN.
Type: AppVM (persistent home, volatile root).
Template: fedora-38 (or later).
Networking: default (sys-firewall).
Click on the Advanced tab and check (enable) Provides network access to other qubes.
Click on OK.

The newly created MullvadVPN ProxyVM qube will show up as "Service: MullvadVPN" in the Qubes app menu and not "Qube: MullvadVPN" due to its "provides network" setting.

Download a WireGuard configuration

In another AppVM (not MullvadVPN) that you use for web surfing:

Open a web browser and log in to our WireGuard configuration file generator.
Select Linux as the platform and then click on Generate key.
Select a country, a city and a server.
Click on Download file.
Click on the Qubes app menu and go to your current AppVM and open Files.
Open the Downloads folder and right click on the downloaded WireGuard file.
Select Copy To Other AppVM... and then enter MullvadVPN as the Target and click on OK. The MullvadVPN ProxyVM will start when you do this.

Install WireGuard

We will install WireGuard in the Fedora-38 template so your MullvadVPN ProxyVM can use that.

Click on the Qubes app menu and go to Template: fedora-38 and open the Terminal.
In the Terminal run the command sudo dnf install wireguard-tools -y
Shut down the VM with the command sudo shutdown -h now
Click on the Qubes app menu and go to Qubes Tools > Qube Manager.
In Qube Manager, restart the MullvadVPN ProxyVM (so that wireguard-tools is added to it).

Set the Network

In Qube Manager, select the AppVM that you want to use with the MullvadVPN ProxyVM and click on the Stop button in the toolbar to shut it down.
Right click on the same AppVM and select Settings.
On the Basic tab, click on the Net qube drop-down list and select MullvadVPN.
Click on OK.
Click on the Start button in the toolbar to start the AppVM again.

Configure WireGuard

Click on the Qubes app menu and go to Service: MullvadVPN and open the Terminal.

Copy the WireGuard .conf file that was copied from the other AppVM to the /home/user/ folder:
cp /home/user/QubesIncoming/*/se-got-wg-001.conf /home/user/

Enable autostart of WireGuard in Qubes 4.1 and older

Edit the /rw/config/rc.local file using a text editor like nano:
sudo dnf install nano -y
Run sudo nano /rw/config/rc.local
Add wg-quick up /home/user/se-got-wg-001.conf (or the config file you copied) on a new line in the bottom.
Press Ctrl+O (Enter) and then Ctrl+X to save and exit.

Enable autostart of WireGuard in Qubes 4.2 and newer

SELinux will block wg-quick from running at boot, unless you put the config file in /etc/wireguard/. Since that location is not persistent for AppVMs you have to copy it there on boot.
Edit /rw/config/rc.local and add two lines similar to these:

cp /home/user/se-got-wg-001.conf /etc/wireguard/
wg-quick up /etc/wireguard/se-got-wg-001.conf

Make sure that WireGuard connects

Run sudo wg-quick up /home/user/se-got-wg-001.conf
Run ping 10.64.0.1
Run curl https://am.i.mullvad.net/connected
Run sudo wg and check for a WireGuard network interface and a peer handshake.

Add DNS hijacking rules

Now we will add firewall rules to redirect DNS requests to 10.64.0.1 (the DNS on the VPN server) for all AppVMs that use the MullvadVPN ProxyVM.

iptables rules are no longer effective in Qubes OS 4.2.0 and newer.

Make sure that you have started an AppVM that has the Networking set to MullvadVPN, otherwise the "vif" IP address will not be visible.

Still in the MullvadVPN ProxyVM Terminal:

To find out your vif* IP address, run ip a | grep -i vif. Write down the "inet" address that you get, for example 10.137.0.47.
Edit the firewall user file with nano:
sudo nano /rw/config/qubes-firewall-user-script
Copy the text in the text area below and paste it in the bottom of your file.
Replace 10.137.0.47 with your own vif* IP address that you got before.

# replace 10.137.0.47 with the IP address of your vif* interface
virtualif=10.137.0.47
vpndns1=10.64.0.1
iptables -F OUTPUT
iptables -I FORWARD -o eth0 -j DROP
iptables -I FORWARD -i eth0 -j DROP
iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
iptables -F PR-QBS -t nat
iptables -A PR-QBS -t nat -d $virtualif -p udp --dport 53 -j DNAT --to $vpndns1
iptables -A PR-QBS -t nat -d $virtualif -p tcp --dport 53 -j DNAT --to $vpndns1

5. Press Ctrl+O (Enter) and then Ctrl+X to save and exit.

Add qube firewall rules

In Qube Manger, select MullvadVPN then right click and select Settings.

Make the following changes:

Make sure it is still set to use sys-firewall as "Networking".
Check Start qube automatically on boot.
Click on the Firewall rules tab.
Click on Limit outgoing internet connections to ....
Click on + and enter the IP addresses of the VPN servers that you want to be able to connect to. You can find it in the WireGuard configuration file (se-got-wg-001.conf) on the Endpoint line, or in our Servers list.
Click on OK.

In the next step ("Disable ping") you will edit the firewall manually. After this you can not open Qube Manager and add rules on the Firewall rules tab anymore, so make sure to add all the servers you need now. If you need to add more servers later then you can do it in the Terminal Emulator using the following command (replace SERVER-IP with the IP-address to the Mullvad VPN server).

qvm-firewall MullvadVPN add accept dsthost=SERVER-IP

If you need to undo the changes then you can remove all firewall rules and reset it to default (accept all connections) using this command:

qvm-firewall MullvadVPN reset

Disable ping (optional)

As noted in the qube Firewall rules window, those rules do not apply to DNS requests and ICMP (pings). If you want to block pings too then you can use the qvm-firewall command.

Click on the Qubes app menu and open Terminal Emulator.
Run qvm-firewall MullvadVPN list. Find the rule in the bottom that says "accept icmp" and note the line number.
Run qvm-firewall MullvadVPN del --rule-no NUMBER. Replace NUMBER with the line number you found above.
Run qvm-firewall MullvadVPN add --before NUMBER drop proto=icmp. Replace NUMBER with the line number you found above. This new rule will be added before the last "drop" line.
Check it by running qvm-firewall MullvadVPN list again. The rules should be in this order: accept (the IP addresses of the VPN servers), accept dns, drop icmp, drop.

FAQ

How do I verify that traffic is going out via the MullvadVPN proxy?

Open a web browser in your AppVM that is using the MullvadVPN ProxyVM and go to our Connection check.

Internet works in the ProxyVM, but not in the AppVM.

Try to lower the MTU in your AppVM: sudo ip link set dev eth0 mtu 1280

Mullvads hjälpcenter

Qubes OS

Guider

WireGuard on Qubes OS

Install Mullvad browser on Qubes OS

Hittar du inte det du letar efter?