GW as a host (WS in GW)

Physical Isolation
1

I’m wondering if anyone has any ideas on the feasibility of using a physical gateway to host a virtual workstation. I’m kind of pondering this idea as an alternative to the burden of needing two machines, be it the convenience burden of two physical machines, or the resource burden of two VMs.

2

No.

This seems related:

3

Okay, I see. From what I can tell, correct me if I’m wrong, the unistation is just a torified os, and whonix-host is a specialized host for the two separate whonix vms. But wouldn’t the unistation still be susceptible to a compromised system bypassing the firewall? And whonix-host is still running two vms.
What I’m wondering about is virtualizing the internal IF on a physical gateway, and hosting a virtual workstation with kvm. Obviously this wouldn’t be 100% as secure as physical isolation, but it seems like it would only be marginally less secure than total virtualization, with lower overhead and higher convenience.
If the virtualized workstation is compromised, deanonymisation would still require breaking out of the vm. In a properly physically isolated system, this would still mean needing to get through the gateway, but the result is the same in a fully virtualized whonix system, since gateway access or direct network access would now be trivial.
In this semivirtualized system, gateway compromise would be more severe, since the attack would grant access to both the physical network interface, and the workstation data, but this is also a pretty unlikely attack vector, right?
The only other consideration I think would be any incredibly boutique exploits involving a compromised workstation deanonymising the host by exploiting the kernel/hardware and the direct host-ws vif at the same time, since these didn’t exist together in any other implemented layout.

4

yes

yes

yes

That was called OneVM. See:

UniStation - A Tor TransparentProxy with only One Machine (ignore page title - wiki page was moved)

Saying “physical isolation” is inapplicable if there is no isolation in the physical - speak hardware - speak real world.

1 Like