Tor before VPN problem

  1. Added another Whonix-Workstation, with a new MAC created by VirtualBox, and set in /etc/network/interfaces.d/30_non-qubes-whonix

  2. Used Tor Browser Downloader, everything works well.

  3. Ran sudo apt-get update && sudo apt-get dist-upgrade. Everything is good.

  4. D/L VPN specific files from my VPN provider. Copied them to /etc/openvpn

5, Followed the instructions in Connecting to Tor before a VPN carefully, step by step

  1. Once done and I ran

sudo service openvpn@openvpn start

I get no error messages.

When I run

sudo service openvpn@openvpn status

Initially everything looks good. Active: active (running) in green. And all the messages seem positive.
However there is no connection. When I repeat (after say 10 seconds)

sudo service openvpn@openvpn status

I get “Active: failed” in red, with the error:

host ovpn-openvpn[24580]: WARNING: Failed running command (–up/–down): external program exited with error status: 2

When I try to debug start on the command line as in the instructions, a long sequence of positive messages finally ends with:

sbin/resolvconf: 159: / sbin/resolvconf: cannot create tun0.openvpn_new.27993: permission denied
WARNING: Failed running command (–up/–down): external program exited with error status: 2

I tried to look in the toubleshooting section, I do use tun0 and not tun

Hi Henry,

Sorry your having trouble with your VPN configuration.

Could you please run the following command and post the output.

ls -al /run/resolvconf

Hi 0brand,

Thank you for your quick reply. Please see below:

user@host:/etc/openvpn$ ls -al /run/resolvconf
total 4
drwxr-xr-x 3 root tunnel 100 Jun 8 19:42 .
drwxr-xr-x 31 root root 840 Jun 8 19:40 …
-rw-r–r-- 1 root root 0 Jun 8 19:42 enable-updates
drwxrwxr-x 2 root tunnel 60 Jun 8 20:00 interface
-rw-r–r-- 1 root root 171 Jun 8 19:42 resolv.conf

I now noticed I had an extra line in the /etc/sudoers.d/tunnel-unpriv file, between

tunnel ALL=(ALL) NOPASSWD: /bin/ip
tunnel ALL=(ALL) NOPASSWD: /usr/sbin/openvpn *
Defaults:tunnel !requiretty


Defaults:tunnel env_keep += script_type
Defaults:tunnel env_keep += dev

I removed that line, and I now get good results while running

sudo service openvpn@openvpn status

I also manage to get results for ping and nslookup.

However when I run something like




or any other site, it just freezes.

Also, nothing gets loaded with Tor Browser.

When I debug again, I get:

/etc/resolvconf/update.d/libc: 133: /etc/resolvconf/update.d/libc: cannot create /etc/resolvconf/run/resolv.conf_new.4036: Permission denied
run-parts: /etc/resolvconf/update.d/libc exited with return code 2
WARNING: Failed running command (–up/–down): external program exited with error status: 1
Exiting due to fatal error

I now changed ownership and permissions, output of ls is now:

ls -al /run/resolvconf

drwxrwxr-x 3 root tunnel 100 Jun 8 21:17 .
drwxr-xr-x 31 root root 840 Jun 8 21:04 …
-rwxrwxr-x 1 root tunnel 0 Jun 8 21:02 enable-updates
drwxrwxr-x 2 root tunnel 60 Jun 8 21:17 interface
-rw-r–r-- 1 tunnel tunnel 171 Jun 8 21:17 resolv.conf

I noticed resolv.conf was

-rwxrwxr-x 1 root tunnel 151 Jun 8 21:02 resolv.conf

but when I restart the openvpn@openvpn service again, it changes back to:

-rw-r–r-- 1 tunnel tunnel 171 Jun 8 21:17 resolv.conf

After the changes in permissions / ownership, I debug again, and the only error I get it:

Note: Cannot set tx queue length on tun0: Operation not permitted (errno=1)

But it runs until

Initialization Sequence Completed

Doesn’t exit for some reason. When I break it, no connection to any site again.

I think I solved it.

I previously skipped the section of “Prevent Bypassing of the Tunnel-Link” (I thought it’s optional), so ping and nslookup and traceroute worked but curl and wget and tor browser didn’t.

So I deactivate the uwt wrappers with


in /etc/uwt.d/50_user.conf

and set


in /etc/enviornment



in /etc/torbrowser.d/50_user.conf

Then, I restarted the machine and… nothing worked! not even ping…

I then noticed the permissions I set before in /usr/lib/tmpfiles.d/50_openvpn_unpriv.conf were wrong. I used 755 instead of 775 in one of the lines. I fixed it, restarted the service and things seem to work, including tor browser.

Hope it stays that way!

Follow up on the above (which has been working smoothly since my last post).

If I upgrade from Whonix 13 to Whonix 14 using the instructions in Release Upgrade - Whonix, can it break the setup of Tor before VPN?

Could be, could not be.

ping btw:
Frequently Asked Questions - Whonix ™ FAQ

I see. So I’ll have to duplicate the VM first / create a snapshot or start from fresh. Will wait till I have some spare time.

Regarding ping in my initial posts, I wasn’t trying to ping the Gateway, I was pinging other sites from the Workstation. That works nicely when the Tor before VPN setup is done.