ProtonVPN on antiX using wireguard manual setup method

[andyproughMember]

ProtonVPN works great on antiX if you use the wireguard manual setup method: https://protonvpn.com/support/wireguard-linux

First install wireguard-tools and openresolv
sudo apt install wireguard-tools openresolv

In a web browser, sign into your ProtonVPN account and find the Wireguard section in the left-hand panel. Fill in the information to create a ProtonVPN wireguard profile for the server of your choice:
1. leave the name blank – Proton will give the wireguard server profile a suitable name
2. select GNU/Linux as the Platform
3. select if you want the wireguard server profile to block malware and ads, and check to use VPN Accelerator if you want a faster connection
4. choose the country you want your server to reside in and select one with a smaller load. If you want a good and private one, find one in Switzerland (home of Proton) with a load below 50%. Otherwise just choose something close to you. Click the CREATE button on that server line, and then click the DOWNLOAD button on the popup window. Download the server profile to your ~/Downloads folder or the folder of your choice. For example, you could download the profile for the Switzerland server #228 – wg-CH-228.conf

Next you will need to move a copy of that ProtonVPN Wireguard server profile to /etc/wireguard/ in order to use it:
sudo cp ~/Downloads/wg-CH-228.conf /etc/wireguard/

Now enable that ProtonVPN server profile in wireguard:
wg-quick up wg-CH-228

To check to see if wireguard is up and running using your ProtonVPN profile:
sudo wg

To ensure you don’t have any DNS leaks, point your browser to dns.ipleak.net, and let that site run through its 300 tests to detect DNS servers that are outside the VPN tunnel.

To disable that ProtonVPN server profile in wireguard:
wg-quick down wg-CH-228

UPDATE – After installing and setting up wireguard with openresolv, you will need to run an ‘apt purge resolvconf’ and do a reboot, or otherwise you’ll be seeing “failure to enable resolvconf” error messages in your boot logs:

sudo apt purge resolvconf
sudo reboot

UPDATED to note that only the wireguard-tools package is needed, not the wireguard metapackage, thanks to @beras for the tip.

• This topic was modified 1 year ago by andyprough.
• This topic was modified 12 months ago by andyprough.

[olsztynMember]

Thank you @andyprough for this method of implementing vpn. I will follow this procedure and see how it works in practice for me.
I have been using ProtonVPV in antiX a lot when I was in Europe for the Summer. This was implementation of ProtonVPN for Network Manager and it was very straightforward and working solid. ProtonVPN implementation for Network Manager was published in this forum by @abc-nix.
Is your implementation using Connman or Network Manager?
I have both in antiX and able to switch between them.

Live antiX Boot Options (Previously posted by Xecure):
http://antixlinuxfan.miraheze.org/wiki/Table_of_antiX_Boot_Parameters

[andyproughMember]

With this implementation you can use it on a system with either connman or network manager, makes no difference because all the VPN work is being handled in the kernel by wireguard, which has been part of the kernel for a number of years. You are just giving wireguard a configuration file to tell it to use ProtonVPN servers. There’s no extra external program to run.

This method has the added advantage of using almost zero extra memory or resources.

[olsztynMember]

Thanks much @andyprough for this insight and procedure in the first post. The best implementation of VPN is of interest to me. So I will evaluate for sure.
Being in Europe for the Summer over the past several years highlighted to me the VPN as necessity in order to perform some basic transactions such as logins to some for payments.
So your method looks like important to look at…

Live antiX Boot Options (Previously posted by Xecure):
http://antixlinuxfan.miraheze.org/wiki/Table_of_antiX_Boot_Parameters

[andyproughMember]

It’s a good match with antiX, almost no extra resources needed and the only dependency is openresolv. You can run Mullvad VPN with just a wireguard config file as well, also a very good match with antiX.

[olsztynMember]

andyprough wrote:

It’s a good match with antiX, almost no extra resources needed and the only dependency is openresolv.

Thanks again @andyprough….
I was not familiar with wireguard before but now when you published this topic it definitely attracted my interest.
I did a test install on Bookworm antiX and it appeared to work fine. Just a question though: If I am not mistaken it appeared to install kernel 6.16 coming from Liquorix. I will need to redo install as I may have not interpretted correctly. To be clear, I am using Liquorix kernel 6.12 in my Trixie antiX and I should be focusing on that perhaps, as Trixie antiX appears to be rock solid in my testing and slowly Bookworm becomes history.
Looking forward to playing with Wireguard as it sounds very good from what I am reading so far…
Many thanks for raising this topic…

Live antiX Boot Options (Previously posted by Xecure):
http://antixlinuxfan.miraheze.org/wiki/Table_of_antiX_Boot_Parameters

[andyproughMember]

olsztyn wrote:

If I am not mistaken it appeared to install kernel 6.16 coming from Liquorix.

Sounds like you are getting some sort of liquorix kernel channel update or something. I didn’t have that happen.

[techoreMember]

Well done, @andyprough, and thank you for sharing. Book marking for my next install.

Knowledge speaks, but wisdom listens.

[andyproughMember]

techore wrote:

Well done, @andyprough, and thank you for sharing. Book marking for my next install.

I was just noticing it even works with the free ProtonVPN servers, you can sign into your free Proton account online and download free VPN server configs for wireguard. Seems to work pretty good too, I’m using a free server right now without a noticeable delay.

[olsztynMember]

andyprough wrote:

I was just noticing it even works with the free ProtonVPN servers, you can sign into your free Proton account online and download free VPN server configs for wireguard. Seems to work pretty good too, I’m using a free server right now without a noticeable delay.

Many thanks @andyprough for this thread.
I tested wireguard using config from my free ProtonVPN selecting a server in Florida, as I did for Openvpn before. It appears to work nicely. I have not done performance testing yet but feels snappy.
What I also noticed:
It integrates very nicely with Network Manager automatically, which is without any additional configuration the wg VPN connection shows along with the previously defined OpenVPN connection and when VPN connected the Network Manager icon shows padlock to indicate VPN tunneling.
This is all working very nicely…
Your publishing this is greatly appreciated…

Live antiX Boot Options (Previously posted by Xecure):
http://antixlinuxfan.miraheze.org/wiki/Table_of_antiX_Boot_Parameters

[kempelenMember]

Thanks for this, copied to my setup notes. I use Proton with OpenVPN, but I collect all alternatives that are explained here in the forum.

[olsztynMember]

Just to update with additional observation, posting this from my VPN session using Wireguard and my current IP address in Miami, Florida:
– I decided to fall back to using resolvconf in place of Openresolv, which was part of the wireguard procedure in the original post. The reason was that with Openresolv I kept getting an error regarding resolvconf, saying ‘Failed to enable updates’, meaning updates of DNS servers was failing. I tried various ways to get rid of that message but not successful so far. Re-installing resolvconf (which entails removal of Openresolv) appears to fix that error message with no adverse impact to Wireguard VPN.
Is there any way to have Openresolv (which is from my reading better than resolvconf) not to cause the above error message?
– All my previously reported observations stand, such as nice integration with Network Manager, which recognizes Wireguard VPN and shows padlock on the NM icon, indicating VPN tunneling, etc.
Thanks again…

Live antiX Boot Options (Previously posted by Xecure):
http://antixlinuxfan.miraheze.org/wiki/Table_of_antiX_Boot_Parameters

[andyproughMember]

olsztyn wrote:

Just to update with additional observation, posting this from my VPN session using Wireguard and my current IP address in Miami, Florida:
– I decided to fall back to using resolvconf in place of Openresolv, which was part of the wireguard procedure in the original post. The reason was that with Openresolv I kept getting an error regarding resolvconf, saying ‘Failed to enable updates’, meaning updates of DNS servers was failing. I tried various ways to get rid of that message but not successful so far. Re-installing resolvconf (which entails removal of Openresolv) appears to fix that error message with no adverse impact to Wireguard VPN.
Is there any way to have Openresolv (which is from my reading better than resolvconf) not to cause the above error message?
– All my previously reported observations stand, such as nice integration with Network Manager, which recognizes Wireguard VPN and shows padlock on the NM icon, indicating VPN tunneling, etc.
Thanks again…

Good point. Per this comment by dolphin_oracle: https://forum.mxlinux.org/viewtopic.php?p=555916&sid=5c05cf442349d5fa12ced0e1f2e4f37f#p555916
we need to run an ‘apt purge resolvconf’ and do a reboot after installing wireguard and openresolv in order to completely remove the resolvconf files in /etc/. That will remove the “Failed to enable updates” error messages in the boot logs. I’ve updated the original instructions to include this.
Running
sudo apt purge resolvconf
even after apt has done a normal ‘apt remove’ of resolvconf during the openresolv installation will get rid of those extra files in /etc/ and the error messages in my experience.

From my extensive testing you do not want to run wireguard with resolvconf as it leaks DNS servers with both ProtonVPN and with Mullvad VPN. openresolv does not leak the DNS servers in my testing. If you are leaking DNS servers then it seems to me that you are mostly defeating the purpose of using a VPN. Mullvad VPN in particular instructs us to use openresolv instead of resolvconf, and I am in discussions with Proton about adding a specific openresolv instruction to their manual wireguard installation page.

• This reply was modified 1 year ago by andyprough.

[olsztynMember]

andyprough wrote:

From my extensive testing you do not want to run wireguard with resolvconf as it leaks DNS servers with both ProtonVPN and with Mullvad VPN. openresolv does not leak the DNS servers in my testing.

Thanks for the info…
I will proceed with the purge option, as posted by dolphin_oracle in MX forum…
Greatly appreciated…

Live antiX Boot Options (Previously posted by Xecure):
http://antixlinuxfan.miraheze.org/wiki/Table_of_antiX_Boot_Parameters

[olsztynMember]

andyprough wrote:

even after apt has done a normal ‘apt remove’ of resolvconf during the openresolv installation will get rid of those extra files in /etc/ and the error messages in my experience.

Update:
Getting rid of the resolvconf error message ‘Failed to enable updates’ continues to be elusive. I have done a great multitude changes to remove resolvconf remnants from various places and this error message still appears during boot process.
In trying to list all I did in various stages removing incrementally more:
– purged per your recommendation
– executed resolvconf -u
– deleted resolvconf.conf from /etc
– deleted resolveconf folder from /etc
– deleted resolvconf from /etc/default
– deleted resolvconf folder from /var/run
– renamed resolvconf folder in /usr/lib
And likely some more, just did not take notes…

After doing this all, the darn message still appears during boot!
But the network and dns resolution works just fine and I am typing this from such system after reboot… it works fine likely because now the Openresolv takes care of dns resolution.

So it seems resolvconf is quite embedded somewhere in antiX and so far elusive in attemt to purge it completely.
Just to be also clear, at first I started my purge attempts on Live antiX, but after some time I redid all this on an installed antiX 23.1, just to eliminate any state preservation factors…
I will likely continue this resolvconf eradication excercise just to find out why this meesage continues to show during boot…

Live antiX Boot Options (Previously posted by Xecure):
http://antixlinuxfan.miraheze.org/wiki/Table_of_antiX_Boot_Parameters

[Author]

Posts