# Qubes OS, VPN Before Tor, and My Anonymity Model **URL:** https://discuss.privacyguides.net/t/qubes-os-vpn-before-tor-and-my-anonymity-model/40061 **Category:** General **Created:** 2026-08-20T14:42:52Z **Posts:** 6 ## Post 1 by @anon11110000 — 2026-08-20T14:42:52Z Privacy and anonymity aren’t the same thing, but they often work best together. I’ve been refining my setup around Qubes OS and would appreciate feedback from others who take compartmentalization and network privacy seriously. My current model is: - Qubes OS with separate, hardened qubes - IVPN running in a dedicated VPN gateway qube - A kill switch and restrictive firewall rules - VPN connection established before Tor - Ethernet only - no Wi-Fi or Bluetooth - Hardened templates with minimal software and a reduced attack surface - Sensitive activities separated from my everyday identity and browsing The goal isn’t to create a “perfectly anonymous” system. It’s to reduce correlation, contain possible compromises, and prevent applications from directly exposing my normal network connection. - Does VPN-before-Tor make sense for this threat model? - Is the extra VPN layer worth the additional trust and complexity? - How much protection does this setup realistically provide against ISP monitoring, malicious websites, and application leaks? - Are there weaknesses in relying on a Qubes VPN gateway, kill switch, or firewall rules? - Does using Ethernet exclusively provide any meaningful security benefit beyond avoiding Wi-Fi-related risks? - Would you change anything in this model without making it unnecessarily complicated? - What is the biggest source of false confidence in a setup like this? I’m aiming for a practical balance between anonymity, compartmentalization, usability, and realistic threat modeling - not an elaborate setup that only looks secure on paper. I would love to hear about your similar qubes os setup / similar. --- ## Post 2 by @sha123 — 2026-08-20T15:46:37Z > [@anon11110000](#): > > - Qubes OS with separate, hardened qubes Depending on what you mean by hardened, just be aware that in-VM isolation is not within Qubes OS’s threat model. There are multiple ways to escalate privileges (horizontally and vertically), due to the X11 window manager and qubes services which where not designed with isolation in mind. What you can do is try to mitigate arbitrary code execution by compiling applications with better exploit mitigations and use a hardened memory allocator. --- ## Post 3 by @rjqBV3WTh3dG1j — 2026-08-20T22:53:10Z I sense many claudisms in this post --- ## Post 4 by @not-wittingly — 2026-08-20T23:17:45Z The only reasons I see to use VPN \> Tor is: 1. to stop your ISP from seeing that you are using Tor at all 2. create system-wide IP obfuscation, if you are just using Tor at the browser level, so you can’t get a leak of your bare IP (though this is pretty flimsy protection) If you aren’t doing either of those things, I don’t see a benefit, and unless you can justify it I think Tor alone is perfectly fine. Especially since are you are likely using Tor through a whonix-qube and you have system-wide IP leak protection.. why bother? I could see a possible benefit to VPN \> Tor if you had a dedicated adversary, maybe they could correlate your public Tor activity to your Tor traffic at an ISP level. For example, if you were posting/active on Reddit over Tor, and your Tor traffic spiked at the ISP level at those exact times, over time that could be profiled. But honestly, this is not something you need to worry about unless you do actually have a dedicated adversary and therefore an extremely high threat model. If that was the case then it’s probably best to not even use your own internet at all. This is all just theoretical stuff 99.9999% of people simply do not need to consider. I would think the kill switch is fairly effective in Qubes, as you can enforce this at both the network-qube level and VPN application level, which provides 2 separate fail safes, similar to binding your VPN to your torrent client and enabling Lockdown mode. There’s a cool channel called [Tech for Dissidents](https://www.youtube.com/@TechForDissdents) you might be interested which discusses various Qubes set ups, and privacy / anonymity online. They discuss full schizo mode which is pretty cool to learn about to see how stuff works, but just not actually practical or necessary for the vast majority of people to even consider. > [@anon11110000](#): > > - Does using Ethernet exclusively provide any meaningful security benefit beyond avoiding Wi-Fi-related risks? Again not unless your threat model is as above. > [@anon11110000](#): > > - How much protection does this setup realistically provide against ISP monitoring, malicious websites, and application leaks? Not really sure what you mean by this. > [@anon11110000](#): > > - Would you change anything in this model without making it unnecessarily complicated? Depends on your threat model. --- ## Post 5 by @john.982387487 — 2026-08-21T05:39:27Z For example I have vpn on router, so can’t use tor without. At least at home systems. On phone i have separate profile for tor browser with torvpn. --- ## Post 6 by @not-wittingly — 2026-08-21T11:40:22Z If it’s already enabled on your router that’s fine, I don’t think there’s any reason to take it off. The whole Tor with or without a VPN argument just requires that people understand what the implications are, neither is actually “better” for every situation. For a case like [Eldo Kim](https://www.wnycstudios.org/podcasts/otm/articles/harvard-bomb-threat) .. yeah he should not have connected directly to Tor on a monitored network, so a VPN would have likely mean he would not have been caught. But even in that case, he could have just used a bridge. I do question bridges though because they will likely get found out at some point to be Tor guard nodes, and then I wonder if people could retrospectively realise that you were actually using Tor? Sounds very theoretical and no documented cases I am aware of.