This is an interesting question. I guess it could lead to more stuff and analysis than I can foresee.
Possible in theory but undocumented and not researched.
Stream isolation might get into the way depending on which application you tried to use. Background information on stream isolation:
Applications inside whonix-ws AppVMs either A) directly connect to the local network where a SocksPort where Tor is listening or B) use the operating system’s default networking. This is also called transparent proxying.
A) complicates things for this kind of advanced endeavors. I would advice to disable stream isolation (for the applications that you may be using that may be pre-configured) during development of this. Then later when it works figuring out if stream isolation can be re-enabled. For instructions on stream isolation deactivation, see:
B) is easier. sys-fw-whonix would, as I imagine, be a Qubes ProxyVM. Use IP forwarding. (Unless you figure out some solution that does not require it. But maybe not important.) Accept the traffic, filter it with iptables, then forward it to sys-whonix. Probably in the first iteration just using transparent proxying.
As an pre-exercise it may be useful to to remove Whonix from the equation. Have some AppVM that connects to some ProxyVM that does some filtering and then forwards to sys-net. Re-applying this setup to Whonix than may be simpler because by then you would have figured out all the non-Whonix stumbling points.
