[Notes] Mullvad VPN Qubes OS debian-13-minimal template and firewall rules

[vecna13]

Thank you for your guide to setting up Mullvad VPN on Qubes OS! It was very helpful to me. I wanted to mention a couple things I did in case they're helpful to anyone else.

I decided to start with a Debian 13 minimal template. From there, the minimal set of packages needed to set up a Mullvad ProxyVM seems to be:
libasound2t64 libnspr4 libnss3 mullvad-vpn qubes-core-agent-networking systemd-resolved

Also, if it's of interest, my approach to firewalling is to use multihop and allowlist api.mullvad.net and some set of entry servers I might want to use in qvm-firewall for my ProxyVM. So qvm-firewall <ProxyVM qube name> list outputs something like:

NO  ACTION  HOST              PROTOCOL  PORT(S)  SPECIAL TARGET  ICMP TYPE  EXPIRE  COMMENT
0   accept  45.83.223.196/32  tcp       443      -               -          -       api.mullvad.net
1   accept  185.209.196.74/32 udp       -        -               -          -       de-fra-wg-004
[...]
XX  drop    -                 -         -        -               -          -       -

(The IP address for api.mullvad.net is hardcoded into the app, so it's not necessary to allow DNS before connecting to the VPN.)

And I set up custom lists in the "Select location" selector so I can easily restrict the app to trying only these allowed servers.