Flushing iptables once, else no connection

KVM
14

Did you change any settings on Whonix-Gateway?

Modified something?

Hosting onion services?

Did you run tor from command line?

Whonix is using system Tor from the Debian tor package. User debian-tor is allowed to make external connections. Relevant parts…

whonix-firewall/whonix-gateway-firewall at master · Whonix/whonix-firewall · GitHub

   [ -n "$TOR_USER" ] || TOR_USER="$(id -u debian-tor)"

      NO_NAT_USERS+=" $TOR_USER"

   local no_nat_user
   for no_nat_user in $NO_NAT_USERS ; do
      $iptables_cmd -t nat -A OUTPUT -m owner --uid-owner "$no_nat_user" -j RETURN
   done

   for no_nat_user in $NO_NAT_USERS ; do
      $iptables_cmd -A OUTPUT -m owner --uid-owner "$no_nat_user" -j ACCEPT
   done

And then incoming connections are allowed.

$iptables_cmd -A INPUT -m state --state ESTABLISHED -j ACCEPT

Long time ago we were using ESTABLISHED,RELATED but this was changed for hardening.

Maybe Tor, linux kernel or some other change I am unaware off now necessities making that ESTABLISHED,RELATED again.

Otherwise I am at loss why only now and only in your case firewall is blocking this.

1 Like