Mullvad VPN before Qubes-Whonix: Worth it for anonymity? Architecture tips

Questions
1

Hi everyone,

I’m new to Qubes OS and also new to the topic of threat modeling. I’m currently trying to understand whether it makes sense to run a VPN (specifically Mullvad) before Qubes-Whonix to increase anonymity.

My current understanding:

  • Whonix routes all traffic through Tor.

  • A VPN before Tor could hide Tor usage from my ISP.

My questions:

  1. Is it actually useful?
    Does running Mullvad before sys-whonix (i.e. User → sys-vpn → sys-whonix → Tor → Internet) meaningfully improve anonymity in a typical threat model, or does it mostly add downsides (more complexity, potential leaks, larger attack surface)?

  2. Qubes architecture:
    What would be a sensible Qubes architecture for this?

I don’t just want to get this working somehow—I’d like to understand why certain design choices are made, especially regarding anonymity vs. security vs. complexity.

Thanks in advance for your input!

2

Here is the PG documentation on Tor over VPN. Jonah also has a really good video that digs a little deeper on it. Some folks will argue against VPN with Tor, you’ll have to decide for yourself what your threat model is

I personally consider my ISP to be a bad actor, and thus value the ability to mask when I am conducting sensitive online activity by hiding Tor activity amongst the rest of my VPN traffic

Setup a Mulvad netVM, using either Mulvad’s documentation or Solene’s community guide. Once you have Whonix installed, reconfigure the NetVM for your ‘sys-whonix’ qube from your default netVM to use this MulvadVPN qube instead