Can't connect to Tor (systemcheck: Connection timed out)

Qubes-Whonix
1

For the past few days, sys-whonix has been unable to connect to the Tor network.

I followed the Troubleshooting Guide, and made it to step 12 (run systemcheck --ip-test), but it’s not clear what I should do now.

user@host:/etc/torrc.d$ systemcheck --ip-test
[INFO] [systemcheck] sys-whonix | Whonix-Gateway | whonix-gateway-17 TemplateBased ProxyVM | Wed Sep 10 11:33:56 AM UTC 2025
[INFO] [systemcheck] Tor Connection Result:
- Connecting for 0 seconds. | 5 % done. 
- Tor Circuit: not established.
- Tor reports: WARN BOOTSTRAP PROGRESS=5 TAG=conn SUMMARY="Connecting to a relay" WARNING="Connection timed out" REASON=TIMEOUT COUNT=6 RECOMMENDATION=ignore HOSTID="REDACTED" HOSTADDR="REDACTED"
- Timesync status: not done.
- sdwdate reports: Preparation not done yet. More more information,             see: sdwdate-gui -> right click -> Open sdwdate's log
- onion-time-pre-script reports: 
__ ### START: ### /usr/libexec/helper-scripts/onion-time-pre-script
__ Status: Subsequent run after boot.
__ Static Time Sanity Check: Within minimum time 'Mon Jul 21 00:00:00 UTC 2025' and expiration timestamp 'Tue May 17 10:00:00 UTC 2033', ok.
__ Tor reports: WARN BOOTSTRAP PROGRESS=5 TAG=conn SUMMARY="Connecting to a relay" WARNING="Connection timed out" REASON=TIMEOUT COUNT=6 RECOMMENDATION=ignore HOSTID="REDACTED" HOSTADDR="REDACTED"
__ Tor circuit: not established
__ Tor reports: REASON=TIMEOUT
__ Tor Consensus Time Sanity Check: Consensus time sanity check failed.
__ anondate_use: Running 'anondate-set' (by creating file '/run/sdwdate/request_anondate-set')...
__ ### END: ### Exiting with exit_code '2' indicating 'wait, show busy icon and retry.'.

The documentation says:

If that succeeded, test Whonix-Workstation using the same command. If it fails, there is no need to test Whonix-Workstation and continue with the next steps.

It’s unclear if that means “if it fails, you should not test Whonix-Workstation and you should also not continue with the next steps"

Or if it means “If it fails, you should not test Whonix-Workstation, and instead you should instead continue with the next steps"

I’m assuming it means I should stop and neither test Whonix-Workstation nor continue with the next steps.

But I went to the documentation page on systemcheck, and I couldn’t find any information on that page for “timeout” errors, so I don’t know how to proceed with troubleshooting.

I confirmed that the time on dom0 and sys-whonix are both set to within 2 seconds of time.is

I also downloaded torbrowser-launcher in a Debian-12 VM, and I had no issues running, connecting, and using the Tor network.

I’m using Whonix 17 and QubesOS 4.2.4.

I have both “Bridges” and “Proxy” set to None in the sys-whonix tor-control-panel

1 Like
2

From the Logs tab in the tor-control-panel:

...
Sep 10 11:38... [notice] New control connection opened.
Sep 10 11:38... [warn] Problem bootstrapping. Stuck at 5% (conn): Connecting to a relay. (Connection timed out; TIMEOUT; count 15; recommendation warn; host REDACTED at REDACTED)
Sep 10 11:38... [warn] 14 connections have failed:
Sep 10 11:38... [warn] 14 connections died in state connect()ing with SSL state (No SSL object)
Sep 10 11:38... [notice] New control connection opened.
...
1 Like
3

The time was a couple hours off in sys-whonix, and I had fixed that (with date -s ). But it still couldn’t connect.

I thought, maybe, the issue was that I needed to give sys-whonix a reboot after setting the time. So I rebooted the VM. When it came up again, the time was correct (within 4 minutes of time.is). And I still have the same issue. Can’t bootstrap beyond 5%.

1 Like
4

I right-clicked on the whonix lock in the xfce panel → sys-whonix → Open sdwdate’s log

Then I right-clicked again on the whonix lock in the xfce panel → sys-whonix → Restart sdwdate.

The following poped-up in the terminal that opened when I clicked Open sdwdate’s log

2025-09-10 17:24:53 - sdwdate - INFO - PREPARATION: running onion-time-pre-script...
2025-09-10 17:24:53 - sdwdate - INFO -
__ ### START: ### /usr/libexec/helper-scripts/onion-time-pre-script
__ Status: Subsequent run after boot.
__ Static Time Sanity Check: Within minimum time 'Mon Jul 21 00:00:00 UTC 2025' and expiration timestamp 'Tue May 17 10:00:00 UTC 2033', ok.
__ Tor reports: WARN BOOTSTRAP PROGRESS=5 TAG=conn SUMMARY="Connecting to a relay" WARNING="Connection timed out" REASON=TIMEOUT COUNT=3 RECOMMENDATION=ignore HOSTID="REDACTED" HOSTADDR="REDACTED"
__ Tor circuit: not established
__ Tor reports: REASON=TIMEOUT
__ Tor Consensus Time Sanity Check: Consensus time sanity check failed.
__ anondate_use: Running 'anondate-set' (by creating file '/run/sdwdate/request_anondate-set')...
__ ### END: ### Exiting with exit_code '2' indicating 'wait, show busy icon and retry.'.
2025-09-10 17:24:53 - sdwdate - INFO - PREPARATION RESULT: onion-time-pre-script recommended to wait. Consider running systemcheck for more information.
2025-09-10 17:24:53 - sdwdate - INFO -

Again, I checked the documentation page for sdwdate, but I saw no information on the error TIMEOUT

1 Like
5

I ran anon-verify as root on sys-whonix

root@host:~# anon-verify 
/===================================================================\
|                      Report Summary                               |
\===================================================================/
No error detected in your Tor configuration.
Tor verify exit code: 0
/===================================================================\
|                      Tor Full Report                              |
\===================================================================/
Sep 10 17:33:31.906 [notice] Tor 0.4.8.15 running on Linux with Libevent 2.1.12-stable, OpenSSL 3.0.17, Zlib 1.2.13, Liblzma 5.4.1, Libzstd 1.5.4 and Glibc 2.36 as libc.
Sep 10 17:33:31.906 [notice] Tor can't help you if you use it wrong! Learn how to be safe at https://support.torproject.org/faq/staying-anonymous/
Sep 10 17:33:31.906 [notice] Read configuration file "/usr/share/tor/tor-service-defaults-torrc".
Sep 10 17:33:31.906 [notice] Read configuration file "/etc/tor/torrc".
Sep 10 17:33:31.906 [notice] Processing configuration path "/etc/torrc.d/*.conf" at recursion level 1.
Sep 10 17:33:31.906 [notice] Including configuration file "/etc/torrc.d/60_network.conf".
Sep 10 17:33:31.906 [notice] Including configuration file "/etc/torrc.d/65_gateway.conf".
Sep 10 17:33:31.906 [notice] Including configuration file "/etc/torrc.d/65_leak_tests.conf".
Sep 10 17:33:31.906 [notice] Including configuration file "/etc/torrc.d/70_workstation.conf".
Sep 10 17:33:31.906 [notice] Processing configuration path "/usr/share/tor/tor-service-defaults-torrc.anondist" at recursion level 2.
Sep 10 17:33:31.906 [notice] Including configuration file "/usr/share/tor/tor-service-defaults-torrc.anondist".
Sep 10 17:33:31.907 [notice] Including configuration file "/etc/torrc.d/95_whonix.conf".
Sep 10 17:33:31.907 [notice] Processing configuration path "/usr/local/etc/torrc.d/*.conf" at recursion level 2.
Sep 10 17:33:31.907 [notice] Including configuration file "/usr/local/etc/torrc.d/40_tor_control_panel.conf".
Sep 10 17:33:31.907 [notice] Including configuration file "/usr/local/etc/torrc.d/50_user.conf".
Sep 10 17:33:31.908 [notice] You configured a non-loopback address 'REDACTED' for DNSPort. This allows everybody on your local network to use your machine as a proxy. Make sure this is what you wanted.
Sep 10 17:33:31.908 [notice] You configured a non-loopback address 'REDACTED' for TransPort. This allows everybody on your local network to use your machine as a proxy. Make sure this is what you wanted.
Configuration was valid
ERROR: invalid file system object (fso) (abs_path): ''
ERROR: invalid file system object (fso) (abs_path): ''
/===================================================================\
|                 Used Tor Configuration Files                      |
\===================================================================/
0 files are used as Tor configuration files: 

=====================================================================
root@host:~#

Anyone know what these error messages mean?

ERROR: invalid file system object (fso) (abs_path): ''
1 Like
6

Here’s the output of systemcheck --verbose --leak-test in sys-whonix

user@host:~$ systemcheck --verbose --leak-test
[INFO] [systemcheck] sys-whonix | Whonix-Gateway | whonix-gateway-17 TemplateBased ProxyVM | Wed Sep 10 05:42:09 PM UTC 2025
[INFO] [systemcheck] Environment variables test result: Ok.
[INFO] [systemcheck] Check 'privleapd --check-config' Result: OK
[INFO] [systemcheck] Check 'leaprun check-privleap' Result: OK
[INFO] [systemcheck] Check 'leaprun check-privleap-environment-variables' Result: OK
[INFO] [systemcheck] Check 'leaprun check-sudo' Result: OK
[INFO] [systemcheck] Check 'sudo' Result: OK
[INFO] [systemcheck] Check 'pkexec /usr/libexec/systemcheck/pkexec-test' Result: OK
[INFO] [systemcheck] Whonix build version: 3:10.5-1
https://www.whonix.org/wiki/Systemcheck#Build_Version
[INFO] [systemcheck] whonix-gateway-packages-dependencies-cli: 25.1-1
[INFO] [systemcheck] derivative_major_release_version /etc/whonix_version: 17
[INFO] [systemcheck] Whonix Support Status of this Major Version: Ok.
[INFO] [systemcheck] Spectre Meltdown Test: skipping since spectre_meltdown_check=false, ok.
[INFO] [systemcheck] Package Manager Consistency Check Result: Output of command dpkg --audit was empty, ok.
[WARNING] [systemcheck] systemd journal check Result:
   ########################################
   Sep 10 17:02:17 host memlockd[1048]: Mapped file /lib/x86_64-linux-gnu/libgpg-error.so.0
Sep 10 17:15:20 host upgrades-status-notify[7020]:   Something wicked happened resolving 'deb.qubes-os.org:https' (-4 - Non-recoverable failure in name resolution)
Sep 10 17:22:37 host upgrades-status-notify[7020]: E: Failed to fetch tor+https://deb.debian.org/debian/dists/bookworm/InRelease  SOCKS proxy socks5h://127.0.0.1:9050 could not connect to deb.debian.org (0.0.0.0:0) due to: TTL expired (6) [IP: 127.0.0.1 9050]
Sep 10 17:22:37 host upgrades-status-notify[7020]: E: Failed to fetch tor+https://deb.debian.org/debian/dists/bookworm-updates/InRelease  SOCKS proxy socks5h://127.0.0.1:9050 could not connect to deb.debian.org (0.0.0.0:0) due to: TTL expired (6) [IP: 127.0.0.1 9050]
Sep 10 17:22:37 host upgrades-status-notify[7020]: E: Failed to fetch tor+https://deb.debian.org/debian-security/dists/bookworm-security/InRelease  SOCKS proxy socks5h://127.0.0.1:9050 could not connect to deb.debian.org (0.0.0.0:0) due to: TTL expired (6) [IP: 127.0.0.1 9050]
Sep 10 17:22:37 host upgrades-status-notify[7020]: E: Failed to fetch tor+https://deb.debian.org/debian/dists/bookworm-backports/InRelease  SOCKS proxy socks5h://127.0.0.1:9050 could not connect to deb.debian.org (0.0.0.0:0) due to: TTL expired (6) [IP: 127.0.0.1 9050]
Sep 10 17:22:37 host upgrades-status-notify[7020]: E: Failed to fetch tor+https://fasttrack.debian.net/debian-fasttrack/dists/bookworm-fasttrack/InRelease  SOCKS proxy socks5h://127.0.0.1:9050 could not connect to fasttrack.debian.net (0.0.0.0:0) due to: TTL expired (6) [IP: 127.0.0.1 9050]
Sep 10 17:22:37 host upgrades-status-notify[7020]: E: Failed to fetch tor+https://fasttrack.debian.net/debian-fasttrack/dists/bookworm-backports-staging/InRelease  SOCKS proxy socks5h://127.0.0.1:9050 could not connect to fasttrack.debian.net (0.0.0.0:0) due to: TTL expired (6) [IP: 127.0.0.1 9050]
Sep 10 17:22:37 host upgrades-status-notify[7020]: E: Failed to fetch tor+https://deb.kicksecure.com/dists/bookworm/InRelease  SOCKS proxy socks5h://127.0.0.1:9050 could not connect to deb.kicksecure.com (0.0.0.0:0) due to: TTL expired (6) [IP: 127.0.0.1 9050]
Sep 10 17:22:37 host upgrades-status-notify[7020]: E: Failed to fetch tor+https://deb.whonix.org/dists/bookworm/InRelease  SOCKS proxy socks5h://127.0.0.1:9050 could not connect to deb.whonix.org (0.0.0.0:0) due to: TTL expired (6) [IP: 127.0.0.1 9050]
Sep 10 17:22:37 host upgrades-status-notify[7020]: E: Failed to fetch https://deb.qubes-os.org/r4.2/vm/dists/bookworm/InRelease  Something wicked happened resolving 'deb.qubes-os.org:https' (-4 - Non-recoverable failure in name resolution)
Sep 10 17:22:37 host upgrades-status-notify[7020]: E: Some index files failed to download. They have been ignored, or old ones used instead.
Sep 10 17:26:18 host qubes-gui[1434]: WARNING handle_focus: FocusIn: Window 0xe00003 data not initialized
Sep 10 17:32:12 host privleapd[928]: auth_signal_request: WARNING: Action run request: Account 'user' is not authorized to run action 'anonymizer-tor-verify-config'
Sep 10 17:42:08 host qubes-gui[1434]: WARNING handle_focus: FocusIn: Window 0x800ab7 data not initialized
   ########################################
   If you know what you are doing, feel free to disable this check.
Create a file /etc/systemcheck.d/50_user.conf and add:
systemcheck_skip_functions+=" check_journal "
[INFO] [systemcheck] check network interfaces Result: Ok.
[INFO] [systemcheck] Qubes qubes-db Test Result: Connection to local qubes-db daemon succeeded, ok.
[INFO] [systemcheck] Qubes Settings Test Result: Ok. (GATEWAY_IP: 127.0.0.1)
[INFO] [systemcheck] Qubes Settings Test Result: Ok, qubes_vm_type is ProxyVM.
[INFO] [systemcheck] Check Kernel Messages Test Result: Found nothing remarkable, ok.
[INFO] [systemcheck] Whonix firewall systemd unit check Result: Ok.
[INFO] [systemcheck] Check Package Manager Running Result: None running, ok.
[INFO] [systemcheck] Tor Check Result: "DisableNetwork 1" not active, ok.
[INFO] [systemcheck] Tor Config Check Result: Tor config ok.
[INFO] [systemcheck] Tor Running Check Result: Pid running.
[INFO] [systemcheck] Control Port Filter Proxy Test Result: OK
/usr/sbin/anondate: ERROR: Variable 'vstart' is empty or contains only whitespace/newlines.
/usr/sbin/anondate: ERROR: Variable 'vstart' is empty or contains only whitespace/newlines.
/usr/sbin/anondate: ERROR: Variable 'vend' is empty or contains only whitespace/newlines.
/usr/sbin/anondate: ERROR: Variable 'vstart' is empty or contains only whitespace/newlines.
[INFO] [systemcheck] check_anondate_do debugging information:

tor_consensus_status       : verified
current_time_in_valid_range: false

current_time_torish        : 2025-09-10 17:42:20
tor_consensus_valid_after  : 
tor_consensus_valid_until  : 
tor_consensus_middle_range : 

tor_cert_lifetime_output   : 
tor_cert_lifetime_valid    : true
tor_cert_valid_after       : 

tor_consensus_user_permission : debian-tor
tor_consensus_group_permission: debian-tor
[INFO] [systemcheck] Tor SocksPort Reachability Test Result: Reachable. (curl exit code: 22 | curl status message: [22] - [HTTP page not retrieved. The requested url was not found or returned another error with the HTTP error code being 400 or above. This return code only appears if -f, --fail is used.])
[INFO] [systemcheck] Tor Connection Result:
- Connecting for 0 seconds. | 5 % done. 
- Tor Circuit: not established.
- Tor reports: WARN BOOTSTRAP PROGRESS=5 TAG=conn SUMMARY="Connecting to a relay" WARNING="Connection timed out" REASON=TIMEOUT COUNT=27 RECOMMENDATION=warn HOSTID="REDACTED" HOSTADDR="REDACTED"
- Timesync status: not done.
- sdwdate reports: Preparation not done yet. More more information,             see: sdwdate-gui -> right click -> Open sdwdate's log
- onion-time-pre-script reports: 
__ ### START: ### /usr/libexec/helper-scripts/onion-time-pre-script
__ Status: Subsequent run after boot.
__ Static Time Sanity Check: Within minimum time 'Mon Jul 21 00:00:00 UTC 2025' and expiration timestamp 'Tue May 17 10:00:00 UTC 2033', ok.
__ Tor reports: WARN BOOTSTRAP PROGRESS=5 TAG=conn SUMMARY="Connecting to a relay" WARNING="Connection timed out" REASON=TIMEOUT COUNT=27 RECOMMENDATION=warn HOSTID="REDACTED" HOSTADDR="REDACTED"
__ Tor circuit: not established
__ Tor reports: REASON=TIMEOUT
__ Tor Consensus Time Sanity Check: Consensus time sanity check failed.
__ anondate_use: Running 'anondate-set' (by creating file '/run/sdwdate/request_anondate-set')...
__ ### END: ### Exiting with exit_code '2' indicating 'wait, show busy icon and retry.'.
[INFO] [systemcheck] Tor Connection Result:
- Connecting for 2 seconds. | 5 % done. 
- Tor Circuit: not established.
- Tor reports: WARN BOOTSTRAP PROGRESS=5 TAG=conn SUMMARY="Connecting to a relay" WARNING="Connection timed out" REASON=TIMEOUT COUNT=27 RECOMMENDATION=warn HOSTID="REDACTED" HOSTADDR="REDACTED"
- Timesync status: not done.
- sdwdate reports: Preparation not done yet. More more information,             see: sdwdate-gui -> right click -> Open sdwdate's log
- onion-time-pre-script reports: 
__ ### START: ### /usr/libexec/helper-scripts/onion-time-pre-script
__ Status: Subsequent run after boot.
__ Static Time Sanity Check: Within minimum time 'Mon Jul 21 00:00:00 UTC 2025' and expiration timestamp 'Tue May 17 10:00:00 UTC 2033', ok.
__ Tor reports: WARN BOOTSTRAP PROGRESS=5 TAG=conn SUMMARY="Connecting to a relay" WARNING="Connection timed out" REASON=TIMEOUT COUNT=27 RECOMMENDATION=warn HOSTID="REDACTED" HOSTADDR="REDACTED"
__ Tor circuit: not established
__ Tor reports: REASON=TIMEOUT
__ Tor Consensus Time Sanity Check: Consensus time sanity check failed.
__ anondate_use: Running 'anondate-set' (by creating file '/run/sdwdate/request_anondate-set')...
__ ### END: ### Exiting with exit_code '2' indicating 'wait, show busy icon and retry.'.
1 Like
7

I tried deleting /var/lib/tor/state and restarting Tor. It’s still unable to bootstrap past 5%.

1 Like
8

No, that’s not what it is supposed to communicate.

Yes.

There is no point in testing Whonix-Workstation connectivity if Whonix-Gateway connectivity is broken.

This has been clarified in the wiki just now.

1 Like
9

related: Tor Consensus Re-Download

1 Like