VPN between clearnet and whonix gateway on Qubes

Just want to update this.

Through some testing either sys-net or sys-firewall give the desired results. I prefer sys-net.

I am just wondering if my suspicions are correct for my purposes I require a VPN between my clearnet connection so that all tor traffic passes through the VPN.

The netvm topology on Qubes is as follows
sys-net -> sys-firewall -> whonix-gw -> whonix-ws

I had it running on Sys-Firewall but just realized there’s also clearnet access on Sys-Net.

I’m thinking Sys-Net start with the lowest common denominator.