Tails says somthing about a permanent Entry- or Exit node. But why? the VPN isn't part of Tor. So it's not an Entrynode or is it?
This is very good question.
Some threats are described here: https://blog.torproject.org/blog/improv ... parameters
Permanent entry guard is a real problem, but I also don't understand how 'VPN before Tor' introduce it.
The only issue I can see is that your traffic comes unencrypted between Tor Exit Node and target website.
- VPN before Tor is used to hide Tor from your ISP.
- VPN after Tor is used to hide Tor from target webside, and also ensure Tor Exit Node doesn't modify or listen to your traffic.