How to use VPN with Tor network?

Question

There are many VPNs and some of them can be used with Tor network depending on the setup. There are two ways to use a VPN with the Tor browser. You can either connect to the VPN first and then the Tor network (Tor over VPN) or you can connect to the Tor network first and then a VPN (VPN over Tor). There are also many different VPN providers that support either option. Which VPN setup and VPN provider would be the best to use with the Tor browser in term of privacy and speed (preferably a balance of both)? In fact, should you use a VPN with Tor?

Edit: I am not referring to self hosted VPNs.

Answer 1

TL;DR: It’s complicated. It depends on your threat model and how well you configure everything.

This is one of the top questions on the Tor Project site [1]. They recommend VPNs (with Tor) only for advanced users and refer to a wiki entry for details.

The discussion below is a summary of the wiki entry, together with some thoughts of mine:

1. The arrangement you have with the VPN provider, especially with regards to payment, is likely to decrease anonymity compared to using Tor alone. VPNs can also keep logs.
2. A VPN adds an extra hop, making passive attacks (slightly) harder, but increases the attack surface, making you more vulnerable to a global adversary.
3. On the other hand, a trusted VPN can help protect you from flaws in Tor itself, including colluding Tor nodes.
4. A VPN may offer a false sense of security. Without special precautions, a VPN failure could lead to you silently making connections without the VPN.

A VPN always acts as a permanent entry node or exit node. It is difficult to predict what effect this will have, but basically:

1. Having a VPN as a permanent entry node sounds good, as Tor itself tries to use a (semi-)permanent entry node. But this would give you two permanent nodes in a row, which is probably not good for anonymity.
2. The wiki entry says that going through Tor, then a VPN, is “generally a really poor plan” because it results in a permanent exit node, whereas Tor itself switches circuits frequently. The wiki entry also carries this warning:

Even if you pay for them anonymously, you're making a bottleneck where all your traffic goes -- the VPN/SSH can build a profile of everything you do, and over time that will probably be really dangerous.

(Going through Tor, then a VPN, is also difficult to configure, because it is non-standard and Tor can only carry TCP traffic.)

On a slightly off-topic note, a VPN can help to circumvent censorship of Tor, either by your ISP or the server operator’s ISP, and may look less suspicious than Tor. Of course, this all assumes you go through the VPN, then Tor.

But be warned: routing your Tor traffic through a VPN is no guarantee of hiding your Tor usage. Your Tor usage and even your browsing patterns might be revealed through traffic fingerprints; according to the wiki entry, there is no research on this.

Regarding speed, of course adding an extra hop is always going to increase latency compared to using Tor alone. But it should not matter which way around you put the hops: either Tor or the VPN can come first.

(Side note: An edit to the question confirmed that it is not referring to self-hosted VPNs. For those who might wonder how these are useful here, the wiki entry says they can be used to force all traffic through Tor.)

[1] Cleanet link: https://support.torproject.org/faq/faq-5/