Well, first of all - you need to use Linux or FreeBSD box or VM for that. At that box you're connecting through VPN and after that it depends on what your VPN is giving you in a matter of the IP:
- NAT - worst scenario, because it usually also grants you a dynamic and sometimes also a private IP. In this case you need to route
tor
process' user - it's a deian-tor
or tor
usually - through the firewall by user basis to use the tunX
device of your VPN making an exception for all private networks. And - if your VPN ip is a private one - make an exception for this network in your firewall rules
- Direct IP - even if it's a dynamic one, there's no problem, just route tor's user through the device and make all the private networks an exception.
Only after that moves your entry guard will see the VPN server as a query originator for sure. Do not use Windows for that tricks - even using a ProtonVPN-like apps that do offer a per-application routing settings, leaks happening