How does Tor browser in Whonix workstation use as socksport?

In Whonix 9.4, eth1 of the gateway has the address <>. But in the workstation, Tor browser is configured with socksport <> rather than <>. As I recall, in earlier Whonix versions, Tor browser was configured with socksport <>, matching the gateway eth1 address.

How does Whonix 9.4 workstation manage to use a local socksport?


(the footnote)

Thanks :slight_smile:

I was looking at iptables, and finding no joy.