VPN -> Tor -> VPN
Any paranoid tell you "the more, the merrier"
- 1) VPN -> Tor. ( VPN inside Tor )
If you have enough skill, you know VPN protocol, you see that it is raw, aggressive protocol, it talks everytime about everything.
Provider see your Tor session, crop your connection to uncontrollable nodes, you are going through nodes under control of your provider, your session looks like torrent traffic, raw UDP ( lesser often TCP ).
- 2) Tor -> VPN ( Tor inside VPN )
Your session could look like raw Tor session, nothing changes. Provider will see only encrypted VPN traffic. Beware, there is whisper that ALL VPN protocols are compromised by NSA.
In this case, provider will read your VPN traffic plainly. He will see that you use Tor, only.
Thereafter, provider collaborate with NSA and sell you. You are marked like a Tor user.
Imagine such abstract picture:
You --> VPN Provider ( Probably listening by NSA) --> Tor --> Proxy ( Any free proxy ) --> VPN Provider( Another one listening by NSA ) --> Tor --> Proxy ( Any free proxy ) --> Target
NSA read that you get session with Tor.
Thereafter, NSA read that someone from Free Proxy got session with Tor.
Target will see only the Last Proxy as a client.
Nowadays, you can get 10/100 mb/s for cents. It is paradize for cryptopunks.
You can wrap 10-100 middle nodes, your bandwidth will be the same 14,400 like it was 10 years ago.
Partially, the question of "What should be wrapped into what ?" - is a question of gourmet. My answer here: "As you wish."