I2P Running on Whonix Gateway

Support
97

That mechanism could be “abused” to comfortably launch any program into
the background on boot and have it terminated at shutdown.

looking into it, why not make it parse the /etc/anon-ws-disable-stacked-tor.d like whonix_firewall does ? (so we need only to add the port number to that config file) ? I don’t mind "abusing"it though. Your call

Is there a Version file for Whonix inside the Template and Appvm ?

I guess anon-ws-disable-stacked-tor.service should not be run in TemplateVMs.

Sorry I meant a file where I can see what Whonix Version the script is run.
Haven’t found anything in etc/

Not sure what you mean. The markup is sometimes broken such as bold and
code? That is indeed sometimes annoying. I did not check yet if there
already is an discourse upstream bug report.

I was able to mark text and then there would be a popup where i could select that text as quote.This is somehow missing. (I have tested with noscript disabled and two different browsers.

iceweasel on Whonix-Gateway should be only capable to visit localhost by
default - because there is no DNS access / no system default
networking. However, if a user would enable transparent proxying for
Whonix-Gateway itself ( Whonix-Gateway Traffic: Transparent Proxying ) then the user could connect anywhere.

ah ok , thanks for the info , going to test that.

It is possible using iptables. I would not mind a localhost-only user on Whonix-Gateway.

Great, going to look into that

98

I was wondering about that during development.

  • /etc/whonix_firewall.d is for sourceing a configuration snippets.
  • /etc/anon-ws-disable-stacked-tor.d works differently. Is for appending of commands to be launched into the background only. [Additional port redirections.]

I thought the need to express things like:
“Oh, I don’t want Whonix-Worksstation 127.0.0.1:9050 to be redirected to Whonix-Gateway. I want to add a snippet to disable that.”
…Would be very rare if ever existing. Would would make the configuration file and script a lot more complex.

It’s like /etc/grub.d, /etc/default/grub.d, /etc/profile.d, /etc/qubes/protected-files.d. They all work a bit differently. They don’t all let you easily overrule anything. Sometimes it is append only.

I had in mind: a socat command to redirect some port required for i2p from the workstation to the gateway.

If you need a redirected port, please tell me some port you need redirected and I can show an example.

It’s fine. If it gets “abused” I make that a generic package not tied to port redirection.

Whonix 14 and above.

99

If you need a redirected port, please tell me some port you need redirected and I can show an example.
If you need a redirected port, please tell me some port you need redirected and I can show an example.

from
https://github.com/cle4r/var/blob/master/i2p-whonix-socat-ws

These Ports needs to be forwarded

I2P_PORTS=“2827 3456 4444 4445 6668 7622 7650 7651 7654 7656 7658 7659 7660 7661 7662 8998”

100

Since Whonix 13 I changed instructions to use the foxyproxy in Jessie’s repo because better verification than installing it from the addon site.

Please see: 3. Install FoxyProxy

in Invisible Internet Project (I2P)

101

Will the port numbers for custom created service tunnels need to be added here also?

102

Create [and later ship in anon-ws-i2p-router-config package] a file /etc/anon-ws-disable-stacked-tor/40_anon-ws-i2p-router-config.conf with the following contents:

Either explicitly…

socat TCP-LISTEN:2827,fork TCP:$GATEWAY_IP:2827 &
socat TCP-LISTEN:3456,fork TCP:$GATEWAY_IP:3456 &
...

Or perhaps better a loop.

I2P_PORTS="2827 3456 4444 4445 6668 7622 7650 7651 7654 7656 7658 7659 7660 7661 7662 8998"
for i2p_port in $I2P_PORTS; do
   socat TCP-LISTEN:$i2p_port,fork TCP:$GATEWAY_IP:$i2p_port &
done
103

Since Whonix 13 I changed instructions to use the foxyproxy in
Jessie’s repo because better verification than installing it from the
addon site.

Please see: 3. Install FoxyProxy

I see, haven’t checked it in a while , thanks for the update.
I will change the setup to incorporate that. (Hopefully this won’t change in the next update , maybe we should consider dropping foxyproxy and replacing it with Privoxy or TransI2P GitHub - rbif/transi2p: Transparent proxying for I2P and forwarding other addresses to Tor or clearnet.
(going to test this later)

Will the port numbers for custom created service tunnels need to be added here also?

If you create one , yes , I’m thinking about shrinking that list as not all ports are needed or make the user choose what he wants . (eg. all ports , just http and mail , custom selection…)

What do you think about that?

Create [and later ship in anon-ws-i2p-router-config package] a file /etc/anon-ws-disable-stacked-tor/40_anon-ws-i2p-router-config.conf with the following contents:

Either explicitly…

ah , i get it thanks , reminds me to rename the current scripts…

104

The problem with any caching proxy between TBB and I2P is it destroys the anti-fingerprinting benefits of Tor Browser. So foxyproxy is the best option.

105

The problem with any caching proxy between TBB and I2P is it destroys the anti-fingerprinting benefits of Tor Browser. So foxyproxy is the best option.

Is there a site/test where i can test that because I think TransI2P wouldn’t destroy those benefits.

106

You can test here: https://fpcentral.irisa.fr/

Please see also what TBB dev Arthur Edelstein says on this:

https://lists.torproject.org/pipermail/tor-dev/2016-June/011037.html

@Patrick where can I add this info?

107

You can test here: https://fpcentral.irisa.fr/

Thanks for the link

Please see also what TBB dev Arthur Edelstein says on this

I read it , but this shouldn’t be an Issue with TransI2P (haven’t tested it though).

108

Another benefit of foxyproxy is its extensible. It allows access for many other networks/programs and that are inaccessible with TBB otherwise.

EDIT:

@goldstein

Another important thing: Fingerprint sites cannot detect the lack of stream circuit isolation though this is a huge thing and makes the network behavior of affected TBB instances different than normal ones.

109

Another benefit of foxyproxy is its extensible. It allows access for many other networks/programs and that are inaccessible with TBB otherwise.

True, I’m not dropping foxyproxy just looking for an alternative/fallback.

Edit:

Another important thing: Fingerprint sites cannot detect the lack of stream circuit isolation though this is a huge thing and makes the network behavior of affected TBB instances different than normal ones.

For Tor this may matter , for I2P it’s doesn’t.(I will keep that in mind though).
In the End the User should decide what kind of setup he prefers:
ex. Easy/Beginner Mode: Tor and I2P with Foxyproxy TBB etc…, advanced mode : I2P + VPN or I2P only and everything else dropped…

110

Can you get me up to speed please on that topic? What is foxyproxy being needed for at all? So urls typed into Tor Browser that end with .i2p are automatically redirected to i2p?

I don’t have a opinion on this topic yet.

One disadvantage of foxyproxy is, that it only works inside Tor Browser. Not for the whole system, but I do not know if this is relevant.

i2p as far I know does not use stream isolation.
( Sign in · GitLab )

Privoxy is not a caching proxy. (source: Miscellaneous)

I replied with some questions:
https://lists.torproject.org/pipermail/tor-dev/2016-August/011260.html

(I am not even sure privoxy does filtering by default.)
(Traffic flows still through it and I dunno if that does mess up something.)

Perhaps worth a different thread. Perhaps a separate wiki page called Privoxy?
http2socks is a useful feature that Privoxy has. Worth documenting?
The Tor Browser page could also use a stub recommending against Privoxy. TPO used to use recommend Privoxy in past but that is long time ago. Nowadays seldom anyone gets the idea of combining Tor with Privoxy. Generally a good idea to recommend to ask/research if certain modifications such as adding Privoxy to the mix is a sane idea rather than assuming it can only do things better perhaps worth adding to the Warning page or elsewhere.

Yes. All of these modes are interesting. Which end up being implemented / supported is up to the maintainers such as you implementing this one.

Transparent i2p sounds interesting. It has some search engine results.
Transparent Access to I2P eepSites - Grepular

I dunno if GitHub - rbif/transi2p: Transparent proxying for I2P and forwarding other addresses to Tor or clearnet. has any effect on the fingerprint. I could imagine that https://fpcentral.irisa.fr/ cannot catch all kinds of fingerprint issues.

What GitHub - rbif/transi2p: Transparent proxying for I2P and forwarding other addresses to Tor or clearnet. is doing in detail?

Btw any solution not requiring ip forwarding is also to be preferred since it has a lower chance of leaks.

111

The point of using foxyproxy is that its able to force localhost access in Tor Browser (which blocks that by default) and redirect domain names to multiple proxies at the same time - something plain iceweasel can’t do on its own. In summary - combine proxies with TBB’s fingerprinting defenses.

You don’t need foxyproxy for other programs to communicate with I2P on the WS. You simply set them to localhost and the port number to the one you assigned in the I2P tunnel settings.

For I2P on the GW you would use socat to redirect WS traffic to its respective tunnel port just as you would on the WS.

Yes

112

I’ll also add that I2P doesn’t have a dedicated TransProxy AFAIK. Any other applications besides web-browsing would need you to pick out a supporting tunnel transport type to be able to move a given program’s packets.

GitHub - rbif/transi2p: Transparent proxying for I2P and forwarding other addresses to Tor or clearnet. seems interesting for a very different reason. Its an implementation of the idea I proposed for this topic: Block all traffic except some hidden addresses - #9 by assd

The only use case I can think of is to create some foolproof intranet infrastructure where services are hosted using Tor/I2P or to create some kiosk mode - assuming your users are completely clueless.

113

transi2p/rules.sh at master · rbif/transi2p · GitHub implies that I2P does have a TransPort.

_i2p_port=7679
#redirect all other output to i2p's TransPort
iptables -t nat -A OUTPUT -p tcp --syn -d $_i2p_range -j REDIRECT --to-ports $_i2p_port
114

Hm. Nothing listed here:

https://geti2p.net/en/docs/ports

The closest thing is the SAM Bridge which seems application agnostic.

115

The closest thing is the SAM Bridge which seems application agnostic.

TransI2P uses the SAM Bridge.

I’ll also add that I2P doesn’t have a dedicated TransProxy AFAIK. Any other applications besides web-browsing would need you to pick out a supporting tunnel transport type to be able to move a given program’s packets

Thats what TransI2P is doing.

116

On the GW TransI2P can implement a whitelist feature that only allows localhost access so users don’t accidentally open eepsites there. IDK if all port ranges for 127.0.0.1 can be left open though.

1 Like