Are you running into 403 errors with more clearnet websites blocking Tor exit nodes? Qubes OS makes it pretty easy and painless to circumvent those restrictions by adding a VPN to the end of the chain. It's simple:
- Set up a Whonix Gateway Qube
- Create a new App Qube using stock Fedora or Debian
- Use the Whonix Gateway as the Net Qube for the App Qube
- Install OpenVPN on the App Qube with:
Debian:
sudo apt install openvpn
Fedora:
sudo dnf install openvpn
- Now purchase a short–term VPN subscription (only for a couple of days)
- Download the configuration file and copy it to your App Qube
- Now start the VPN:
openvpn --config <YOUR CONFIG>.ovpn
And that's it. You can check the Whonix Gateway onion circuits to verify the connection to the VPN.
As for the browser, I recommend using the Mullvad Browser as it mimics the Tor Browser signature and is more likely to blend in.
You can now access websites routing Tor →VPN, while still remaining anonymous.
There are a few important little details to note however:
- The reason I suggest using short–term VPN subscriptions is because technically all activity using the VPN is now linked together as you are using the exact same keys. For that reason, I suggest spending a few Euro on a new subscription each time you have to use it for a different service.
- I recommend always verifying the connection is routed over Tor. While it is unlikely for there to be a technical issue with the Whonix Gateway, you may make the mistake of using the wrong App Qube or selecting an incorrect Net Qube.
- Keep your activity minimal and only use it when absolutely necessary. The Tor nodes rotate, but the VPN does not.
- You can't use Wireguard as it only supports UDP, while Tor only supports TCP, which means you will have to opt for OpenVPN. Ensure the OpenVPN configuration uses TCP.
Happy browsing!
