Reproduce following steps if you want to forward nginx (or any other service) from Whonix Workstation to your Whonix Gateway and Host
In this example, I am also configuring a hidden service for Nginx (although you can skip this)
- Editing Tor Configuration in Whonix Gateway:
sudo nano /usr/local/etc/torrc.d/50_user.conf
HiddenServiceDir /var/lib/tor/hidden_service/
HiddenServicePort 80 10.152.152.11:8083 # IP assigned in Workstation
Restarted tor and get the generated onion domain (my_onion_domain)
- Opening external port in Whonix Gateway:
sudo mkdir -p /usr/local/etc/whonix_firewall.d
nano /usr/local/etc/whonix_firewall.d/50_user.conf
EXTERNAL_OPEN_PORTS+=" 80 "
sudo whonix_firewall
- Prepare Nginx in Whonix Workstation
In Nginx config add:
server {
server_name my_onion_domain;
listen 8083;
…
I restarted nginx and at that point I could access my onion domain in Tor Browser
- At this point we can test using curl if we can connect to Nginx directly from inside Whonix Gateway
To test that the connection is working we must circumvent stream isolation in the Gateway using the following command:
UWT_DEV_PASSTHROUGH=1 curl --output - 10.152.152.11:8083
Curl’s output must be the same than you get in your Workstation or accessing your hidden service in Tor Browser, in case not double check that Nginx is working and that you are using the proper ports
- Port Forwarding from Workstation to Gateway
Once we can access our nginx directly from our Gateway we need to forward the IP and Port from our Whonix Workstation to our Whonix Gateway. Patrick suggested systemd-socket-proxyd, socat or ssh port forwarding (maybe it is possible to use sshuttle and faster than traditional openssh’s port forwarding but it is untested as mentioned before footnotes here: Connecting to Tor before SSH). In my case I decided to use socat because it seemed easier to me, it was a personal choice
socat TCP-LISTEN:80,fork,bind=10.152.152.10 TCP:10.152.152.11:8083
10.152.152.10 assigned to eth1 Gateway internal interface
10.152.152.11 assigned to my Workstation
Before continuing we must test if the port forwarding is working. We repeat the process as the previous step
UWT_DEV_PASSTHROUGH=1 curl --output - 10.152.152.10:80
- Port forwarding from Gateway to Host
In Whonix Gateway we go to Settings > Network > Adapter 1 > Advanced > Port Forwarding and added
Name: Nginx
Protocol: TCP
Host IP: 127.0.0.1
Host Port: 80
Guest IP: 10.152.152.10
Guest Port: 8083
In case you want to do it from the command line check it here: Access Whonix-Gateway Ports from the Host
After restarting Whonix Gateway we can test from our host if we have direct access to our Nginx running in the Workstation
curl 127.0.0.1:80
- Use systemd to start automatically socat at boot
If you want to start automatically your socat command follow next steps to create a new service and start it automatically at boot using systemd
sudo nano /lib/systemd/system/socat_autostart.service
[Unit]
Description=Start at boot socat command
After=network.target
[Service]
ExecStart=socat TCP-LISTEN:80,fork,bind=10.152.152.10 TCP:10.152.152.11:8083
[Install]
WantedBy=multi-user.target
chmod 644 /lib/systemd/system/socat_autostart.service
sudo systemctl enable socat_autostart
sudo systemctl start socat_autostart
You can check if your service is working fine with
sudo systemctl status socat_autostart
@Patrick feel to free to move this post or modify it if you see some typo.
P.S. I am facing a small issue with systemd when booting the system
My service is working fine if I start/stops when Whonix Gateway is on but after restarting the Gateway, my service is executed but socat is failing with the following output (from systemctl status socat_autostart):
E bind(5, {AF=2 10.152.152.10:80}, 16): Cannot assign requested address
Any idea about how maybe delay the execution of my service after the reboot? (Edited: now it is fixed in my edit)
