QubesOS 4.3.1 is facing connectivity issues. VPN as Linux Router/Gateway requires a lot of Improving Potencial.
Standalone with Nym VPN > connects over mixnet > routes to (via Provides Network setting) Whonix Gateway 18 > and this one routes to an Workstation VM / Standalone VM via Provides Network setting.
The Connectivity appears certain times functional , sometimes its timesouts , its generally considered slow (10sec-15sec page/loading time).
The Gateway had times when it run flawlessly.
Same concept with -
Standalone with Nym VPN > connects over dvpn > routes to (via Provides Network setting) Whonix Gateway 18 > and this one routes to an Workstation VM / Standalone VM via Provides Network setting.
This connection stops to work and doesnt receive the Net from Nym VM arriving to the Whonix Gateway VM. It has to do with the Routing rules , where mixnet functions over HTTP Tunneling , while dvpn creates its own tunnel infrastructure within the vm , not routing & attaching to a potencial whonix gateway.
I consider potencially that due to dvpn´s infrastructure , it might not be functional with the dvpn , so when thats the case , the mixnet infrastructure over whonix gateway 18 , workstation & qubes 4.3.1 should be massively improved and start to work flawlessly , otherwise Qubes os as a system with the whonix gateway can´t operate efficiently over nym vpn , in comparison to mac / windows
I had very similar issues. I determined that it is because NymVPN runs its own DNS server or something similar that does not allow outside connection (your client qubes) to query DNS. It could also be that the nftables rules generated by NymVPN do not allow that setup. I did try to circumvent them and it still did not work, therefore I am pretty certain that it’s not just the nftables rules.
You can check if it is DNS by using curl 1.1.1.1 and curl example.com. If curl 1.1.1.1 works but curl example.com doesn’t, DNS is most likely the issue.
I wanted to report this as well, but I didn’t find the time to do so. Also for me no single DNS request was ever successful. Not using DNS however always worked.
If the qube directly uses NymVPN however (it is installed inside the qube itself), then it did work.
I think it is quite easy to resolve by just adding a toggle to Use resolv.conf for DNS on Linux. This would avoid adding a loopback address as DNS resolver and just add fex. 1.1.1.1 or whatever is used directly to resolv.conf.
I think mullvad does this by default and ivpn has a toggle for it: Settings → DNS → Force management of DNS using resolv.conf.
I really hope that nymvpn will support qubesos soon and that there will also be a reliable lockdown mode, otherwise it is inferior to both mullvad and ivpn on qubes.
I use Qubes (4.3.1). As things stand, I think it is a waste of time trying to get Nym VPN working on Qubes.. Fundamentally, Qubes’ nft rules do not coexist well with Nym’s rules and AFAICT Nym VPN is currently not designed to run on a headless server; it’s a user-facing product that requires manual input to run. I did try to offload Nym onto a Debian 13 VM running on a local server to which I could point my Qubes traffic but the vpnc/vpnd split processes don’t lend themselves to a robust headless server environment. I therefore abandoned the project.
A qube really isn’t or doesn’t have to be a “headless server”. They are meant to be able to run gui applications. It is more secure to run wireguard directly instead of running gui applications, but that isn’t specific to qubesos. And for me even vpnc did work flawlessly, just not DNS which at least wasn’t a problem for ivpn/mullvad to resolve and shouldn’t be for nym (tested on some prior 2026.12.x version).
Hi, the reference to a headless server is in the context of the VPN VM automatically starting when an AppVM runs if the VPN VM is its network VM. While Qubes does provide for a graphical environment, a netvm that uses a minimal (non-graphic) template in order to minimise its attack surface usually won’t need all that graphical bloat and command line access will be sufficient. As for DNS not working, yep, you’re right, Nym blocks it. But I managed to get an LLM to solve the problem and I’ll post its answer in another thread.