Using a VPN/Proxy in Tails

Tails is designed to route all internet traffic through Tor. This guide covers two ways to use PIA with Tails:

• Option 1 (Recommended): Connect to Private Internet Access (PIA) VPN on a router or virtual machine, and run Tails behind it.
• Option 2 (Advanced): Use the PIA SOCKS5 proxy from within specific apps inside Tails.

Important: The steps in this guide must be repeated after restarting Tails unless you configure Persistent Storage and Additional Software. However, persisting app settings can reduce the amnesiac privacy benefits of Tails.

Jump To…

• Option 1: Use PIA VPN Before Tor
  • Via a Router
  • Via a Virtual Machine
• Option 2: Use the PIA SOCKS5 Proxy 
  • Step 1: Generate PIA SOCKS5 Credentials
  • Step 2: Resolve the PIA SOCKS5 Proxy IP Address
  • Step 3: Configure an App's SOCKS5 Settings
  • Step 4: Test with Curl
  • Optional: Enable Persistent Storage
• Troubleshooting

Option 1: Run Tails Behind PIA

This setup connects to PIA before Tails starts, so all Tails traffic passes through PIA first. The advantage of this setup is that it requires no changes inside Tails and preserves Tails' security model.

There are two ways to do this:

Via a Router

If you have a VPN-compatible router, follow the steps to configure PIA on your router. Then, connect the device running Tails to that router through Wi-Fi or Ethernet. In Tails, select Connect to Tor automatically.

Tails will then connect to Tor through the PIA VPN connection.

Use a Virtual Machine

Important: This setup is only supported on Linux using GNOME Boxes or virt-manager.

1. Connect your Linux host to PIA VPN using the PIA app.
2. In virt-manager, create a new virtual network and set it to forward traffic through tun0 (the PIA VPN interface on the host).
3. Start the Tails virtual machine and connect it to this virtual network.
4. Select Connect to Tor automatically in Tails.

Note: When running Tails in a virtual machine, both the host operating system and the virtualization software can monitor what you do in Tails. Only use this setup if you understand and accept these risks.

Option 2: Use the PIA SOCKS5 Proxy

Note: Tails does not support standard VPN connections inside the operating system. Installing or configuring a VPN inside Tails requires significant routing changes and can reduce the privacy protections Tails is designed to provide. The SOCKS5 proxy is an alternative for specific apps that support it, but it has known security limitations. Only use this option if Option 1 is not available to you.

Step 1: Generate PIA SOCKS5 Credentials

1. Visit the PIA Client Control Panel and log into your account.

2. Select Downloads.

3. Go to the VPN Settings > SOCKS section and click Generate or Re-generate. Copy the SOCKS5 username and password.

Note: Your SOCKS5 credentials are different from your standard PIA account credentials.

Step 2: Resolve the PIA SOCKS5 Proxy IP Address

Current Tails versions may not resolve proxy-nl.privateinternetaccess.com correctly from inside Tails. Before starting Tails, resolve the hostname from another operating system:

host proxy-nl.privateinternetaccess.com

Copy one returned IPv4 address.

Example:

• proxy-nl.privateinternetaccess.com is an alias for proxy-nl.regions.cluster.piaservers.net.
• proxy-nl.regions.cluster.piaservers.net has the address 77.247.181.218.

Use the returned IP address in Tails instead of the hostname.
 

Step 3: Configure an App's SOCKS5 Settings

1. Start Tails and select Connect to Tor automatically.

2. Open the app you want to route through the PIA SOCKS5 proxy and go to its proxy settings.
3. Enter the following: 

• Proxy type: SOCKS5
• Host: PIA proxy IP address. Use the IP address you resolved earlier. Do not use proxy-nl.privateinternetaccess.com.
• Port: 1080
• Username: your PIA SOCKS5 username
• Password: your PIA SOCKS5 password. Remember that this password will be exposed to the TOR exit node.

Step 4: Test with Curl

Use this test to confirm that Tails can reach the PIA SOCKS5 proxy through Tor and that your SOCKS5 credentials work:

curl --socks5 PIA-proxy-IP-address:1080 --proxy-user 'USERNAME:PASSWORD' https://ipinfo.io/json

Example:

curl --socks5 77.247.181.218:1080 --proxy-user 'USERNAME:PASSWORD' https://ipinfo.io/json

If the setup works, the output should show an IP address in the Netherlands.

Important: This only confirms the curl command used the PIA SOCKS5 proxy. It does not configure a global proxy for Tails and does not mean other apps are using the proxy.

Optional: Enable Persistent Storage and Additional Software

By default, Tails forgets everything when it restarts. You can enable Persistent Storage to avoid repeating these steps on every reboot, but note that persisting app settings reduces the amnesiac privacy benefits of Tails.

To enable it: 

1. Click Apps in the top-left corner and select Persistent Storage.

2. Select Continue.

3. Set a password, confirm, and select Create Persistent Storage.

4. Enable the Additional Software option.

Install New Apps Persistently

If you have not installed apps like curl or proxychains4 yet (or if they are gone upon a reboot), you can install them with this command:

sudo apt install curl proxychains4

You will get a pop-up window asking if you want to install these apps only once (for this session only) or every time (automatic reinstallation on every session). Select Install Every Time to add these apps to persistent storage.

Add Already Installed Apps to Persistent Storage

If you have already installed temporarily and want to add them to persistent storage, do this:

1. Look for Synaptic Package Manager in your Tails search menu.

2. Look for the apps you want to add to persistent storage using the Search option on the right. We’ll add curl and proxychains4 to persistent storage for this guide.

3. Right-click an app and select Mark for Reinstallation. This app will be automatically installed on every Tail session.

4. Click Apply at the top.

5. Select Apply to confirm.

Important: This will reinstall apps after reboot, but it does not guarantee that the app’s proxy settings or saved credentials persist. You may still need to re-enter per-app proxy settings after each restart.

Troubleshooting

• The app cannot resolve proxy-nl.privateinternetaccess.com: Resolve the hostname outside Tails and use one returned IPv4 address.
• The app supports SOCKS5 but not username/password: This app cannot use the PIA SOCKS5 proxy.
• The test still shows a Tor exit node: The app is not using the PIA SOCKS5 proxy. Check the proxy IP, port 1080, username, and password.
• The proxy rejects the username/password: Check that you are using your PIA SOCKS5 credentials, not your PIA account password.
• The proxy connects but websites fail to load: Try another IPv4 address returned by:

host proxy-nl.privateinternetaccess.com

• Can I use VPN > Tor or Proxy > Tor in Tails? Not through the current Tails GUI. The current Tails Tor connection does not provide authenticated SOCKS5 proxy fields for startup.