Hey folks... WORDS MATTER when describing a process or method to help the average (non-expert) computer user. You are NOT talking to fellow geeks on this web site and you should keep that in mind when you post. Please be PRECISE and COMPLETE in your choice of words so we can ALL understand what you are trying to convey. ASSUMING we start with the same computer shorthand or understanding as you may have, is not "helpful" it's FRUSTRATING in the extreme. Also, please do not just provide a link to highly technical web sites that also DO NOT SOLVE the question asked !
That said, a question that asks how to set up "vpn OVER Tor" is the EXACT OPPOSITE of a question asking how to set up "Tor over VPN". Usually, responders don't even READ the question and instead, try to SELL you a subscription to a VPN service.
This latter set up is discouraged by the genuine TOR Project for good reason. In that scenario, you are trusting your REAL IP address to a VPN provider who may or may not keep logs of it, and may associate it with your REAL payment information. So called "free" VPNs (despite their self-congratulatory hype and bought-and-paid-for "endorsers")may not be located beyond the reach of subpoena power, may not have rigorous encryption, and may be monetizing YOUR information for their profit. Think about it... other than TOR (and to an extent Protonmail) who do you know that keeps NO LOGS, never retrieves your IP address AND provides a truly "free" tool for real anonymity ?? By the way, I don't work for EITHER of those organizations, or for TOR, and have no interest except in trying to find the most truly anonymous way for ordinary, law-abiding, non-abusive users who nevertheless VALUE their anonymity, to connect to those idiotic but necessary web sites like Craigslist who choose to block ALL Tor traffic.
If you are being blocked from accessing any particular website, you use Tor as your main browser on a Windows 10 system, you should know certain basics. First, most websites are "hosted" on a "secure" platform that provides the website's owner with a bundle of services such as a payment portal, analytics to help the website owner know what is working or not working and who the website's actual v. expected audience is, 24/7 maintenance and guaranteed accessibility of the website in question, "security" from malicious attacks that might overload and shut down the website, identification of those "malicious actors" so the web site can take legal action against them, and storage for information the website would like to collect from its users.
Depending on the platform a website creator chooses to host their site, the methods of providing protection from those malicious attacks of abusive uses of their site varies. So too, does the platform's method of identifying the alleged offender. For a basic understanding of how different hosting platforms choose to provide security protections to THEIR website creator customers, see this excellent post edited by Alexander Færøy http://eweiibe6tdjsdprb4px6rqrzzcsi22m4koia44kc5pcjr7nec2rlxyad.onion/legacy/trac/-/wikis/org/doc/ListOfServicesBlockingTor. To gain an understanding of a platform provider's thinking on the use of Tor... checkout this posting from CloudFlare https://blog.cloudflare.com/the-trouble-with-tor/ .
In some cases, a particular website has its OWN blocking algorithm or threshold page that any request for access to its website must pass through before a typical user can view or use their site.
THIS IS THE CASE WITH CRAIGSLIST.
Typically when a website chooses to do its own "policing" rather than have their site independently "hosted" by a platform... they use the "meat cleaver" rather than the "surgical" approach to "keeping the bad guys off their site". Often the criteria they use (beyond specific incidents of abuse or non-compliance with their posting policies, is to just ban ALL internet traffic coming from certain "exit nodes" (ie the last computer IP address to connect directly to their site)and sometimes ALL IP addresses associated with those "suspect" exit nodes.
Since the TOR network has a limited number of
exit nodes (though they are constantly trying to get more), and since TOR makes the IP addresses of all THEIR registered exit nodes PUBLIC (in order to protect the identity of YOUR real IP address), It is not difficult for a website such as Craigslist to simply block all traffic coming from, and IP addresses associated with, those exit nodes. In effect, they block Tor, they block YOU.
It is important to understand that most such site specific blocks are NOT based on YOUR personal computer's IP address, nor on its specific and unique device ID, but rather on the IP address and (maybe) the unique device id of the Tor network server (computer)which is the last computer in the chain that directly connects to the web site you want to view. Tor is a relay system and all you, the user, put into that relay is a request (search)and a temporary delivery address.
The first Tor network computer only knows that your IP made a request (which is encrypted) for something on the internet(it doesn't know what the request was)and it sends that message to only the next randomly selected computer in the daisy chain. The second Tor network computer only knows that it got a message from the first Tor computer with instructions to pass it on. The last Tor network computer (exit node) only knows that it got a message from the second or third Tor network computer to request info from a certain website. The destination website only knows that the last Tor network computer requested permission to view or get information from it. Whatever the website provides to the last Tor network computer is encrypted, wrapped in a message and sent back through the network only to be unencrypted and read AFTER it is safely back on your computer. Tor does not log the original request or where it came from so it can't turn over that information to anyone.
Accordingly, it won't help you get access to these kinds of Tor blocking sites to change your personal device ID, or your personal IP address. These are two different things, by the way. In Widows 10, your actual PC has a unique ID, but also each separate PART of that PC (like your card reader,motherboard, storage, video/graphics card, sound card, monitor, USB readers, etc.) EACH have their own unique "hardware device ID". Too many folks providing advice out there use all three terms as if they are interchangeable, they are NOT !!
This is why IF you have to circumvent TOR blocking sites... the safest configuration is
You ==> TOR ==> Free Protonmail VPN. The advantage of this setup is that you never give to ANYONE your personal details. You can use a disposable e-mail to get the Free Protonmail VPN. Tor doesn't require ANYTHING to download its browser bundle. Both organizations have a LONG and extensively reviewed track record on NOT keeping logs, or collecting your IP address.
Ideally, you would set up one FREE Protonmail VPN as the proxy INSIDE the Tor browser which would keep even your ISP (Internet Service Provider) from knowing you use Tor as a browser (connect to the internet via proxy option) AND also be able to use a second FREE Protonmail VPN as the exit node at the END of the Tor relay daisy chain. It seems possible to set up 2 different FREE VPNs through Protonmail by just using 2 different disposable e-mails to get two different VPNs. Since Protonmail is committed to user privacy as its reason for being, there should not be any objection.
The difficulty is that I'm not exactly sure how to properly configure TOR (and/or Windows 10) for each part of the protection (VPN set as proxy in Tor Browser) and then (separate VPN as set as the preferred exit node in Tor relay).
If someone could lay out that process in a CLEAR, UNDERSTANDABLE, step-by-step process you would be doing all of us a HUGE favor.
If I can figure it out, I'll update this post and fill you in... but I am NOT a real computer guru so it could take a long while.
Hope this helps !