# Mullvad VPN before Qubes-Whonix: Worth it for anonymity? Architecture tips

**URL:** https://discuss.privacyguides.net/t/mullvad-vpn-before-qubes-whonix-worth-it-for-anonymity-architecture-tips/41063
**Category:** Questions
**Tags:** please-eli5
**Created:** 2026-09-28T14:08:19Z
**Posts:** 2

## Post 1 by @AgileFinch91 — 2026-09-28T14:08:19Z

Hi everyone,

I’m new to Qubes OS and also new to the topic of threat modeling. I’m currently trying to understand whether it makes sense to run a VPN (specifically Mullvad) _before_ Qubes-Whonix to increase anonymity.

My current understanding:

- Whonix routes all traffic through Tor.

- A VPN before Tor could hide Tor usage from my ISP.

**My questions:**

1. **Is it actually useful?**  
Does running Mullvad _before_ sys-whonix (i.e. User → sys-vpn → sys-whonix → Tor → Internet) meaningfully improve anonymity in a typical threat model, or does it mostly add downsides (more complexity, potential leaks, larger attack surface)?

2. **Qubes architecture:**  
What would be a sensible Qubes architecture for this?

I don’t just want to get this working somehow—I’d like to understand why certain design choices are made, especially regarding anonymity vs. security vs. complexity.

Thanks in advance for your input!

---

## Post 2 by @privacy.slouchy — 2026-09-28T18:12:05Z

> [@AgileFinch91](#):
>
> 1. Is it actually useful

[Here](https://www.privacyguides.org/en/advanced/tor-overview/) is the PG documentation on Tor over VPN. Jonah also has [a really good video](https://www.youtube.com/watch?v=vo22D-dUeCA) that digs a little deeper on it. Some folks will argue against VPN with Tor, you’ll have to decide for yourself what your threat model is

I personally consider my ISP to be a bad actor, and thus value the ability to mask when I am conducting sensitive online activity by hiding Tor activity amongst the rest of my VPN traffic

> [@AgileFinch91](#):
>
> 1. **Qubes architecture:**  
> What would be a sensible Qubes architecture for this?

Setup a Mulvad netVM, using either [Mulvad’s documentation](https://mullvad.net/en/help/wireguard-on-qubes-os) or [Solene’s community guide](https://forum.qubes-os.org/t/mullvad-vpn-app-4-3-and-4-2-setup-guide/). Once you have Whonix installed, reconfigure the NetVM for your ‘sys-whonix’ qube from your default netVM to use this MulvadVPN qube instead