VPN

The main use of a VPN is to provide an encrypted connection with clean, non-interfering gateways, but it does not provide much anonymity depending on the threat.
While we pledge not to leak or sell your data to any business or government unless required by law, we still have to know some information for operational purposes that could be taken by force by a motivated attacker or government agency.

There are a few ways to combine our VPN with Tor for additional anonymity and privacy.
This page will go over the methods and their uses and issues.

[TOC]

a. Tor through the VPN

Much better for anonymity, but requires careful use of end-to-end encryption (HTTPS, SSH, ...)

Pros:

• it will hide your usage of the Tor network to your ISP or local network (and show a regular VPN or TLS connection instead).
• it will be as anonymous as using Tor directly.

Cons:

• VPN servers can get identified and blocked.
• it uses Tor exit nodes, which are not under our control and can intercept, monitor, and alter the traffic.

Installation:

1. Install the VPN.
2. Install tor or the Tor Browser Bundle.
3. By using the Tor SOCKS proxy or the Tor Browser, you will effectively be using Tor over the VPN.

b. VPN through Tor

Harder to keep anonymous but will provide a clean and secure connection even over Tor.

Pros:

• it will successfully bypass most firewalls and government censorships thanks to Tor (and Tor bridges).
• your connection to the VPN is anonymized.
• you replace untrusted Tor exit nodes with our servers, likely more reliable and safer.

Cons:

• your anonimity depends on the payment method used for the VPN.
• the bandwidth will be limited by Tor and its network.
• VPN servers aren't as anonymous as most Tor exit nodes. please don't get us into any trouble.

Installation:

1. We will assume using a separate host or virtual machine for Tor.
   This configuration is implemented by Whonix and Qubes, and we recommend it for strong anonymity. It also greatly simplifies routing and avoids some simple failure modes.

2. Set up the VPN on the "Workstation" (your host or VM behind the Tor gateway)

   • You will need a TCP configuration to go over Tor
   • Whonix Workstation: you will need to loosen the local firewall to be able to use a VPN:
     sudo iptables -I OUTPUT -j ACCEPT
     It shouldn't have serious security implications, providing that your physical network (or virtual network between VM) is properly isolated.
   • Whonix Workstation: change the default DNS server to use the VPN's server:
     echo "nameserver 10.99.0.20" | sudo tee /etc/resolv.conf
   • Whonix Workstation: using the default browser will always use Tor through a proxy. The easiest workaround is to install and use a regular version of Firefox:
     sudo apt install firefox-esr

3. Your trafic should be sent to the VPN, over Tor. Your current IP address as seen from a website visited on your workstation VM should be linked to the VPN.