The guide is based on debian13-minimal, but it should work on debian-13-xfce or debian-13.

Prepare the template

• Start "Terminal Xfce" in dom0
• Run qvm-template install debian-13-minimal
• Run qvm-clone debian-13-minimal debian-13-minimal-openvpn

> ℹ️ The following steps are required to install packages in the new template, as it's a minimal template, you can't use sudo from a regular terminal.

• Run "Terminal Xfce" in dom0
• Run qvm-run -u root debian-13-minimal-openvpn xterm

• Run this command in the terminal that opened: apt install -y qubes-core-agent-networking qubes-core-agent-network-manager network-manager-openvpn-gnome

• Shutdown debian-13-minimal-openvpn qube

> ℹ️ The following steps will create an AppVM qube that will connect to the OpenVPN server and be used as a NetVM for other qubes.

• Start "Terminal Xfce" in dom0
• Run qvm-create --property provides_network=true --template debian-13-minimal-openvpn --label red --property maxmem=512 sys-vpn-openvpn
• Run qvm-service --enable sys-vpn-openvpn network-manager true

Copy the OpenVPN configuration file to sys-vpn-openvpn

Move the OpenVPN configuration (unzip the file before if needed, the appvm does not have the tools to unzip) to the qube sys-vpn-openvpn you just created.

This can be done by right-clicking on the downloaded file in the file explorer of the Qube that downloaded the configuration file, and choose "Move to other qube..." menu entry in the contextual menu.

Import the configuration file in sys-vpn-openvpn

• Start "Terminal Xfce" in dom0

• Run qvm-run -u root sys-vpn-openvpn xterm

• Run nmcli conn import type openvpn file /home/user/QubesIncoming/.... (complete the path to the configuration file)

• When prompted with "Choose new password for keyring" click on "Continue", you can fill the password fields if you want to add a password to unlock the VPN password but this is useless for most users as the qube is dedicated for the VPN task. You will be asked if you really don't want to use a password, click "Continue".

> ⚠️ DRAFT work in progress, saving credentials does not work for some reasons... Seems like certificates are stored in /root/ which is not persistent.