{{Open with root rights|filename=
/etc/sudoers.d/tunnel_unpriv
}}

Comment in the following and remove the single hashes ({{Code2|#}}) in front of all lines, but do not remove the double hashes ({{Code2|##}}). The edited file should look like this.

Use of wildcard / asterix <code>*</code> is non-ideal security wise. <ref>
https://github.com/QubesOS/qubes-issues/issues/2852
</ref>

<pre>
tunnel ALL=(ALL) NOPASSWD: /bin/ip
tunnel ALL=(ALL) NOPASSWD: /usr/sbin/openvpn *
Defaults:tunnel !requiretty
</pre>

Save and exit.