I was just trying to figure out how to combine Tor with a VPN for the times when I may need to.

I know most of you are going to avoid answering my question by trying to talk me out of doing it, but I just want to know HOW to do it for the times I might need to do so.

I know how to do Me -> OpenVPN -> Tor. This is really easy. But I want to learn how to do

Me -> Tor -> OpenVPN.

I have searched, searched and searched but was unable to find a clear answer to how to do this.

Can anybody help me figure this out? Bonus points if you can tell me how to do Tor -> Tails

  • 1
    Tails already runs all traffic over Tor. How would "Tor -> Tails" be something new? Jan 8, 2014 at 7:56
  • 1
    ConcealmEnt - I am sorry, but I am what they call a newbie. And while I appreciate your answer, its a bit too complex for me. Can you please go into further detail for me? @Andrew Lott - I want to do Tor -> Tails -> VPN -> Internet There are cases when using Tor to do things online are not possible, for example posting on Stack Exchange, sometimes I get messages that my IP is being flagged as spam. So being able to connect to a VPN using TOR, thus staying anonymous to the VPN would benefit me.
    – user915
    Jan 8, 2014 at 17:31
  • Did you sign up for the VPN provider anonymously? If not, then they already know who you are! Jan 10, 2014 at 0:51
  • Might be relevant: tor.stackexchange.com/questions/4245/…
    – unhammer
    Oct 9, 2014 at 10:23

3 Answers 3



$ openvpn --help
--socks-proxy s [p] [up] : Connect to remote host through a Socks5 proxy at


SocksPort 9050 # what port to open for local application connections
SocksListenAddress # accept connections only from localhost


As a newbie, you are probably meet troubles with wrapping a connection.

While you'll start openvpn directly from host where Tor works, you'll lost connection. Simple, routing will be looped, somethings like:

Host -> Vpn -> Tor -> Host -> Vpn -> Tor ->...

You need to get middle box. Thereafter, connect to your VPN provider with

# openvpn config.ovpn --socks-proxy 9050 --verb 6

Your can get any Virtual Machine. Launch Tor on the Host, configure middle box, open socks5 proxy for Virtual Machine. Launch openvpn inside Guest with previous flags.

You might be safe from leakage in this case, if you deny Guest to connect to external network, only internal ( virtual ) NAT.

Or, you can take 2 Stations:

1 Station with 2 ethernet cards is a middle box: one eth look to internet, second into internal network.

2 Station - is your work station.

You might, again, open only Socks5 port on the first Station for internal network, to prevent leakage.

1 Station(openvpn --socks-proxy) ---> 2 Station ( Tor middle box ) --> Internet

You might read this my answer: https://tor.stackexchange.com/questions/1229/how-to-chain-proxy-after-tor/1234#1234


This can be done using VirtualBox VMs. It's easy with Whonix. Just set up a VPN client in the workstation VM in /etc/openvpn/, and add socks-proxy 9150 up and socks-proxy-retry to the configuration file. The requirement for an up proxy-authentication file is an OpenVPN bug. The up file must exist, but it's not parsed, so its content doesn't matter. You'll need to reconfigure apps that are set up to use the Whonix gateway as proxy.

A lighter solution uses a pfSense VM that provides a Tor SocksPort. In the simplest case, you would use this with a Linux VM running a VPN client and Tor Browser. More generally, you could use the pfSense Tor-gateway VM with various pfSense VPN-client VMs to construct nested chains of VPNs and Tor.

In order to use the latest Tor release, you need to build a Tor package in FreeBSD 8.3 from the latest port:

fetch ftp://ftp.freebsd.org/pub/FreeBSD/ISO-IMAGES-i386/8.3/FreeBSD-8.3-RELEASE-i386-disc1.iso
[create local FreeBSD VM with 1024 MB RAM and 200 GB thin VDI]
portsnap fetch extract
mkdir /usr/ports/packages
cd /usr/ports/security/tor/
make package-recursive
cd /usr/ports/devel/google-perftools/
make package-recursive
cd /usr/ports/packages/All/

Now you can install Tor in pfSense 2.1.4 as described here. But don't do the proxy server part, just Tor install. You can get your new packages into pfSense using Diagnostics: Execute command: Upload in the webGUI. Before installing, move the package files from /tmp/ to /root/ by running mv /tmp/[package].tbz /root/. Then work in the pfSense console, hitting 8 and enter for a command line. You will need to fix the libevent 2.0 screwup by adding two links:

ln -s /usr/local/lib/event2/libevent-2.0.so.6 /usr/lib/libevent-2.0.so.6
ln -s /usr/local/lib/event2/libevent_openssl-2.0.so.6 /usr/lib/libevent_openssl-2.0.so.6

Edit torrc using vi /usr/local/etc/tor/torrc:

RunAsDaemon 1

Now reboot the pfSense VM. Tor should be running. Using the webGUI, lock down pfSense. First delete all outbound NAT routes in Firewall: NAT: Outbound:

select "Manual Outbound NAT rule generation", save and apply changes
check all outbound NAT routes, and delete using [x] at lower right
save and apply changes

In Firewall: Rules: LAN, allow access from LAN only to the Tor SocksPort:

edit default allow rule
allow TCP from LAN subnet to port 9050
save and apply changes

The pfSense Tor-gateway VM only needs to access your entry guards, and NTP servers so that Tor has the correct time. For additional security, you can create rules on WAN that allow that, and block all other outbound traffic. Working at the command line in the pfSense console, view your entry guards:

cat /var/db/tor/state | less

Browse Atlas and get the corresponding IP addresses. Browse Firewall: Aliases: IP, and create an alias for those IPs. You will need to update the alias periodically as your entry guards change. Also create an alias for the pfSense NTP server <0.pfsense.pool.ntp.org>. Then use those two aliases to create outbound pass rules in Firewall: Rules: WAN. At the bottom, add a block rule for everything else.

Finally, in System: Advanced: Miscellaneous: Gateway Monitoring, check Skip Rules When Gateway is Down and hit Save. Now your pfSense VM provides a Tor SocksPort, and blocks all other traffic.

Please see my answer to this question for advice about paying anonymously for VPN services.


What are you guys thinking about that solution: VPN over Tor - is this an easy way to do it?

Essenitally what you are doing is changing the .ovpn VPN config file and the kernel routing table to:

proto tcp
#rest of the file
socks-proxy 9050
# using tor as proxy and using the non-VPN standard gateway 
to connect to the Entry/Guard node

The routing table should look like this:

destination       gateway          Genmask         Flags Metric Ref    Use   Iface         UG    0      0        0   tun0 UGH   0      0        0   wlan0 UGH   0      0        0   wlan0 UGH   0      0        0   tun0 UH    0      0        0   tun0   U     600    0        0   wlan0

The downside of this solution is obviusly that you need to change the ovpn cfg file each time your entry node changes. You could also change the entry node to a fixed one but that is not recommended. You would have to change it back after a while.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .