Combining Tunnels with Tor is the long answer.
Because:
- That is: user → VPN → Tor → onion. (possible)
- That is not: user → Tor → VPN → onion. (impossible)
VPN on the host:
Because VPN on the host connects before anything else can connect. This includes Tor. VPN connects before Tor can establish any connections. That’s why it’s user → VPN → Tor → destination.
VPN inside Whonix-Workstation:
All connections originating from within Whonix-Workstation are torified, meaning routed over Tor. That includes the VPN. Therefore it’s user → Tor → VPN → destination.
Only the Tor can connect to onions. It’s a Tor network internal thing. Tor handles the connections to onions.
If Tor is “obstructed” by a VPN, then the connection is not really internal to the Tor network. Nobody can connect to onions without the use of Tor. But if a VPN is used in a chain of user → Tor → VPN → destination, then one is “not really using Tor” from the perspective of destination onions.