Using free ProtonVPN with a wireguard configuration with Pale Moon

[andyprough]

ProtonVPN has over 100 free servers in 10 countries that seem to work pretty fast and well with Pale Moon to get around issues like geo-blocking, or for when you need an encrypted VPN while trying to do work in Pale Moon on un-trusted wifi like at a coffee shop or hotel.

Only problems with ProtonVPN's official app for GNU/Linux distros is that it is a bit of a memory hog and that it only installs on distros using the systemd init system. However, you can avoid using the official ProtonVPN app while still using the ProtonVPN servers by using the ProtonVPN wireguard manual configuration method. With this implementation all the VPN work is being handled in the Linux kernel by wireguard, which has been part of the kernel for a number of years. You are just going to give wireguard a configuration file to tell it to use ProtonVPN servers. There’s no extra external program to run.

For Pale Moon on Windows users, Proton has instructions to set up wireguard manually. I don't have any Windows systems, so I'll focus on how I set up ProtonVPN+wireguard for my Pale Moon browsing on a Debian-based GNU/Linux system.

This manual wireguard method has the added advantage of using almost zero extra memory or resources. It’s a good match with GNU/Linux distros and Pale Moon on lower resource systems and on distros that don't use systemd, such as antiX, Devuan, and certain versions of MX. There is almost no extra memory used and the only dependency is a package called openresolv. You can also run Mullvad VPN with just a wireguard config file as well using this same basic method, also a very good match with GNU/Linux distros and Pale Moon, but this How-to will focus on setting up a free ProtonVPN setup for the sake of simplicity.

Most GNU/Linux distros come with the "resolvconf" package installed by default, but from my extensive testing you do not want to run wireguard with resolvconf as it leaks DNS servers with both ProtonVPN and with Mullvad VPN. Instead, I'll show you how to use the "openresolv" package which does not leak the DNS servers in my testing. If you are leaking DNS servers then it seems to me that you are mostly defeating the purpose of using a VPN. Mullvad VPN in particular instructs us to use openresolv instead of resolvconf, and I am in discussions with Proton about adding a specific openresolv instruction to their manual wireguard installation page.

Here are the steps to set up this free ProtonVPN using wireguard on a GNU/Linux distro (using a Debian-based distro as an example) -

1. First set up a free ProtonVPN account if you don't already have one at https://account.protonvpn.com/signup. Look for the link that says, "Or sign up for free" in the bottom right-hand corner of the first box on the page.
2. Next, install wireguard-tools and openresolv:

Code: Select all

sudo apt install wireguard-tools openresolv

3. Purge the resolvconf package, or otherwise you’ll be seeing “failure to enable resolvconf” error messages in your boot logs:

Code: Select all

sudo apt purge resolvconf

4. Reboot to ensure you are using openresolv instead of the old resolvconf configuration:

Code: Select all

sudo reboot

5., In Pale Moon, sign into your ProtonVPN account and find the Wireguard section in the left-hand panel. Fill in the following information to create a ProtonVPN wireguard profile for the free server of your choice:
a. leave the "Name" field blank – Proton will give the wireguard server profile a suitable name
b. select GNU/Linux as the "Platform"
c. select if you want the wireguard server profile to block malware and ads, and check to use VPN Accelerator if you want a faster connection
d. choose the country you want your server to reside in and select one with a smaller load. If you want a good and private one, find one in Switzerland (home of Proton). Otherwise just choose something close to you. Click the CREATE button on that server line, and then click the DOWNLOAD button on the popup window. Download the server profile to your ~/Downloads folder or the folder of your choice. For example, you could download the profile for the Switzerland server CH-FREE#4, which will be downloaded as a file called wg-CH-FREE-4.conf

Next you will need to move a copy of that ProtonVPN Wireguard server profile to /etc/wireguard/ in your system in order to use it:

Code: Select all

sudo cp ~/Downloads/wg-CH-FREE-4.conf /etc/wireguard/

Now enable that ProtonVPN server profile in wireguard:

Code: Select all

wg-quick up wg-CH-FREE-4

To check to see if wireguard is up and running using your ProtonVPN profile:

Code: Select all

sudo wg

To ensure you don’t have any DNS leaks, point Pale Moon to dns.ipleak.net, and let that site run through its 300 tests to detect DNS servers that are outside the VPN tunnel.

To disable that ProtonVPN server profile in wireguard:

Code: Select all

wg-quick down wg-CH-FREE-4

It's a good idea to bookmark dns.ipleak.net in Pale Moon, and run that site to check occasionally to ensure you have a leak-proof connection to the ProtonVPN servers. I've found that if I refresh the wireguard connection each morning by disabling and then enabling it again, the connection seems to stay solid throughout the day.

[Mæstro]

I try to rotate VPN servers regularly, although this has become harder for me lately as more of PIA’s servers seem to annoy Cloudflare. Is it possible manually to switch ProtonVPN server without too much headache, or is it acceptable, as far as privacy is concerned, to keep to one faithful server? Also, are (paid) ProtonVPN servers less likely to trigger Cloudflare when JavaScript and cookies are disabled? I remember considering switching to ProtonVPN some years ago, but finding their own client’s memory use too much for me.

[andyprough]

I try to rotate VPN servers regularly, although this has become harder for me lately as more of PIA’s servers seem to annoy Cloudflare. Is it possible manually to switch ProtonVPN server without too much headache, or is it acceptable, as far as privacy is concerned, to keep to one faithful server?

Sure you can rotate servers easily with 'wg-quick down [server1]' and then 'wg-quick up [server 2]', or you can stick with one server. I often stick with one server when I find one that gives me good performance. I don't know about the privacy aspects of switching servers frequently vs sticking with one - you aren't using your own IP address either way. One thing I do is use servers from one country for certain kinds of browsing (like forum discussions and online research), and servers from another country for other types of browsing (like watching videos). Switzerland tends to have better privacy laws from my understanding, but my own country tends to have slightly faster response times.

Also, are (paid) ProtonVPN servers less likely to trigger Cloudflare when JavaScript and cookies are disabled?

I do not know, you might just have to try it. One nice thing with Proton and Mullvad is that with both of them you can buy one month and then cancel if you don't want to continue to pay.

I remember considering switching to ProtonVPN some years ago, but finding their own client’s memory use too much for me.

Yes, the official graphical ProtonVPN client is quite heavy in terms of memory usage - it's probably an electron app or something similar. Also, requiring systemd on GNU/Linux for such a program seems moronic to me. However, I must admit that the graphical client works extremely well.

[Gemmaugr]

This is good to know. I myself use https://5july.org/vpn/ with https://www.wireguard.com/ (with 7 country server options).

A useful site to check the integrity of VPN's is https://embed.kumu.io/9ced55e897e74fd80 ... ationships

[Mæstro]

One thing I do is use servers from one country for certain kinds of browsing (like forum discussions and online research), and servers from another country for other types of browsing (like watching videos).

This resembles my habits, although it is shaped more by the certain sites’ failure when accessed in certain places. For example, internet radio and television and voice chats suffer connexion failures and disruptions if traffic is sent through the antipodes, where latency can reach a third of a second or longer.

Switzerland tends to have better privacy laws from my understanding, but my own country tends to have slightly faster response times.

She borders us, so I have never had to choose between these. If not for Cloudflare and certain sites locking up behind cookie banners if they detect a European IP, I could keep to PIA’s Swiss server.

One nice thing with Proton and Mullvad is that with both of them you can buy one month and then cancel if you don't want to continue to pay.

About two years ago, I tried subscribing to Proton, chiefly for the storage, although I recall this was when I tested the VPN client also. Uploading was sluggish (whether Proton’s or my ISP’s fault, I do not know) and I desired a refund, but actually obtaining one in cash (as opposed to Proton credit) to my bank account, despite living within the EEA, was a painful process.

Yes, the official graphical ProtonVPN client is quite heavy in terms of memory usage - it's probably an electron app or something similar.

Of course, that is another red line for me. With your tutorial and comments, I am willing to consider giving Proton another chance, but the inability to test for Cloudflare problems in advance precludes me. I like that Proton seems to offer many European servers within a country, coverage in that respect is far better than PIA.

[andyprough]

About two years ago, I tried subscribing to Proton, chiefly for the storage, although I recall this was when I tested the VPN client also. Uploading was sluggish (whether Proton’s or my ISP’s fault, I do not know) ...

ProtonVPN speeds used to be rather sluggish like you say, but in the past year or so I've found I can leave it on all the time and not notice any particular slowdowns. Or if I do, I just switch to a different server.

... and I desired a refund, but actually obtaining one in cash (as opposed to Proton credit) to my bank account, despite living within the EEA, was a painful process.

I've never requested a refund, so I don't know that process. If money is tight then I would go with the MullvadVPN 5 Euro a month deal, it's always seemed good to me, and I only pay for Mullvad when I intend to use it for that particular month.

One additional thing I was wondering, and you may be the type of knowledgeable person that might be able to figure this out, is how good is the ProtonVPN ad-blocking/malware blocking? It's available both in the official graphical app and in this manual wireguard configuration that I've written about here. I've used the ad-blocking/malware blocking from Proton both with and without uBlock also running on Pale Moon, and I can't really tell a difference between the two. I might be missing some things since I don't go to youtube though. But if you get a chance, I'd like to hear your opinion of how their ad-blocking/malware blocking feature functions in comparison to something like uBlock.

[Moonchild]

VPN-adblocking tends to be limited to DNS blacklisting. The VPN operated at the network layer and can't really do any advanced in-application blocking, so anything hosted on the domain itself will not be blocked, by definition. It can still be effective since a lot of ad servers operate on third-party domains directly, but anything first-party (or proxied through a sub or what not) will just not be blockable by DNS blacklists.

[andyprough]

VPN-adblocking tends to be limited to DNS blacklisting. The VPN operated at the network layer and can't really do any advanced in-application blocking, so anything hosted on the domain itself will not be blocked, by definition. It can still be effective since a lot of ad servers operate on third-party domains directly, but anything first-party (or proxied through a sub or what not) will just not be blockable by DNS blacklists.

OK good to know. It's probable then that my browsing is so simple that I don't run into sophisticated sites and therefore can't perceive a difference.

[Mæstro]

ProtonVPN speeds used to be rather sluggish like you say, but in the past year or so I've found I can leave it on all the time and not notice any particular slowdowns. Or if I do, I just switch to a different server.

I was actually talking about upload speeds for Proton’s online storage, which I was then considering using for backups. But perhaps it has got better in this respect also.

If money is tight then I would go with the MullvadVPN 5 Euro a month deal, it's always seemed good to me, and I only pay for Mullvad when I intend to use it for that particular month.

My annual PIA subscription is below €50, billed each August. My VPN usage is continuous, making the late summer my natural time to reconsider subscriptions. A (now ex-)friend used Mullvad and found nothing wrong with it, and I see that Mullvad offers far more servers and countries, soundly distributed, than I believed in 2024. PIA has met my needs for years, but I have always paid yearly despite the discounts to afford myself greater freedom to switch if anything stupid happens. I will keep both Proton and Mullvad in mind if the Cloudflare triggering worsens.

One additional thing I was wondering, and you may be the type of knowledgeable person that might be able to figure this out, is how good is the ProtonVPN ad-blocking/malware blocking? […] But if you get a chance, I'd like to hear your opinion of how their ad-blocking/malware blocking feature functions in comparison to something like uBlock.

Academic work shall be more intense for January and (to a lesser extent) February this year, and I planned the next three days for preparing an important talk, so I might not be able to do it at once, but I should be able to experiment with this in the springtime, and would be happy to share the results.

[andyprough]

I was actually talking about upload speeds for Proton’s online storage, which I was then considering using for backups. But perhaps it has got better in this respect also.

Oh ProtonDrive? Yeah, last i checked a couple of months ago that's still got upload speeds that are quite slow compared to services like DropBox and Mega.