Just want to update this.
Through some testing either sys-net or sys-firewall give the desired results. I prefer sys-net.
I am just wondering if my suspicions are correct for my purposes I require a VPN between my clearnet connection so that all tor traffic passes through the VPN.The netvm topology on Qubes is as follows
sys-net → sys-firewall → whonix-gw → whonix-wsI had it running on Sys-Firewall but just realized there’s also clearnet access on Sys-Net.
I’m thinking Sys-Net start with the lowest common denominator.