DevLog 250526 — VPN + Tor Privacy Stack (Manual Install Route)

Now that i have a new OS (Ubuntu) and a new hard drive, today’s focus was building a privacy-first internet stack without relying on bloated GUI apps or broken packages. After fighting through ProtonVPN dependency hell, I landed on a clean OpenVPN route and layered in Tor Browser for maximum anonymity.

My Ubuntu system is now running ProtonVPN through manually imported `.ovpn` configs and routing Tor Browser traffic through the tunnel. Every step required manual intervention—perfect for a dev who wants absolute control and minimal bloat.

Initial Failures & Roadblocks

• `.deb` method failed (Proton dependencies not satisfiable)
• Flatpak installed but app was deprecated
• AppImage link dead — classic ghostware

sudo dpkg -i protonvpn-stable-release_1.0.8_all.deb
sudo apt update
sudo apt install protonvpn

Manual OpenVPN Setup

sudo apt install openvpn network-manager-openvpn network-manager-openvpn-gnome

Imported .ovpn configs from Proton's dashboard → entered OpenVPN credentials manually via Network Settings

Stability Fixes

# Disable IPv6
sudo sysctl -w net.ipv6.conf.all.disable_ipv6=1
sudo sysctl -w net.ipv6.conf.default.disable_ipv6=1
sudo sysctl -p

Set routing to "use connection only for resources on its network" in nm-connection-editor

# DNS Fix
sudo apt install resolvconf
sudo systemctl enable resolvconf
sudo systemctl start resolvconf

Set manual DNS in VPN config: 10.8.8.1, 1.1.1.1, 9.9.9.9

Tor Browser Manual Install

tar -xvJf tor-browser-linux-x86_64-14.5.2.tar.xz
cd tor-browser
chmod +x start-tor-browser.desktop
./start-tor-browser.desktop --detach

Tor launches and tunnels through ProtonVPN. ISP sees VPN, not Tor.

Current Stack

• VPN via OpenVPN (.ovpn, manual credentials)
• Tor Browser layered on top
• System: Ubuntu 20.04, zsh shell

Next Steps: Firewall + Kill Switch

1. Enable UFW and deny all but VPN interface
2. Write a VPN kill switch script
3. Auto-connect VPN via systemd or crontab
4. Create AppArmor policy for Tor isolation
5. Optional: Build an .onion relay

sudo ufw default deny outgoing
sudo ufw default deny incoming
sudo ufw allow out on tun0 from any to any
sudo ufw enable

From broken packages to full-stack privacy routing, today was a study in persistence. The terminal is my castle.

— Lorelei Noble
rainkeep devlogs