The most glaring compromise in using VPNs is that the operator knows your IP. You are only as private as the VPN server. But what if the VPN server does not even know your real IP? Welcome to VPN over Tor.
Buy Mullvad VPN via Tor using Monero.
Buy a Tor VPN router such as GL.iNet GL-MT3000 (Beryl AX).
Enable Tor on router under Apps or VPN section of dashboard.
Enable in VPN settings > Anti-censorship > UDP-over-TCP in Mullvad client (this is required as Tor is TCP only).
Tor mode sends all traffic on the router through the Tor network. Granted the router does not leak traffic, this is extremely secure and private. The Beryl AX has open firmware that allows you to use the latest OpenWRT builds with the latest tor client.
For real privacy either a separate Linux laptop with a generic live distro be used (such as Ubuntu or Fedora) or a Virtual Machine with a firewall blocking all traffic except that which is going to the VM.
You might be wondering why use Mullvad if all traffic is routed through Tor? Mullvad is essentially acting as a proxy that gives you access to sites that may be VPN friendly (or haven’t blocked Mullvad yet) but Tor hostile. It also can act as another layer of protection, incase Mullvad or Tor fail, you can fallback on the other. If the router looses access to Tor, it blocks all internet access but leaks may still occur.
https://mullvad.net/
https://www.amazon.com/dp/B0BPSGJN7T?
https://dl.gl-inet.com/router/mt3000/openwrt24