automate VPN setup

[SCBuergel]

This uses qubes-tunnel to set up a VPN net qube.

Overview

[sys-net]
     ↑
[sys-firewall]
     ↑
[sys-vpn] ← [vpn-template]
     ↑
[your app qube]

Steps

1. Create vpn-template as a TemplateVM from debian-11. Then in that template run

sudo apt install qubes-repo-contrib qubes-tunnel -y

2. Create app qube sys-vpn from the previously created template vpn-template, in the Advanced tab activate Provides network access to other qubes
3. In the settings of sys-vpn add the service qubes-tunnel
4. Obtain Open VPN Username & Password, e.g. on ProtonVPN at https://account.protonvpn.com/account and then run the following in sys-vpn and provide username & password when prompted:

sudo /usr/lib/qubes/qtunnel-setup --config

5. Download Open VPN config file (e.g. on ProtoVPN at https://account.protonvpn.com/downloads ) and store it as /rw/config/qtunnel/qtunnel.conf in sys-vpn
6. Set sys-vpn as net-qube of any app qube that should be behind VPN.
7. If you are any custom port forwarding, apply the config to this sys-vpn qube as well.