Lean cutdown version of Whonix Gateway and Workstation for low spec notebooks + optional bare metal implementation


I appreciate Patrick is focusing on Qubes so its not a request for him per se. I have several low spec notebooks which I have managed to get Whonix working on but the performance is understandably painfully slow. I would like to build a lean cut-down version of Whonix to run on these notebooks so that all they offer me is Tor Browser + wget + vi as that is all I require of them. So a little like the low spec Chromebooks you find for ~150 USD which simply throw you into a browser and that is all you get. I would appreciate some pointers on how to make a secure implementation. To my mind I need to build a cut-down Debian Jessie system for each VirtualBox VM (I am happy to use KVM if that is preferred). Then download the Whonix source from GitHub and presumably there is documentation on how to install the source?

What I am missing without having done further research is the mechanism of applying the Whonix source to my custom OS build so that it functions like the standard VB download. Of course I appreciate that the download is an export of a prebuilt appliance and I am building a new VM, that is a small matter.

Any links to any existing useful posts on how to achieve this task would be appreciated.

As an aside, I wish to extend this principle to building a Whonix bare metal Gateway using a RPi or a low spec notebook. So basically the cut-down Gateway I build should be customisable to run on bare metal instead of within a VM. Then I can connect another notebook which just runs a cut-down version of Whonix Workstation either on bare metal or a VB or KVM VM. If I run the Workstation in a VM, does anyone have any advise on how to set the n/w parameters so the Workstation can see the Gateway running on the RPi ? I mean when both are on same m/c and belong to the Whonix n/w there is no issue, but now lets say I connect the Workstation notebook to the Gateway RPi or notebook via Ethernet cable, then presumably the Ethernet interface on the RPi will be a different network than the WiFi INTERNET connection feeding the bare metal Whonix Gateway? So the question is how to bridge them if that is the correct term.

Thanks in advance for any advise.


You can download the images, boot them in a VM and install all the drivers required to run them on your notebooks (like graphics card, wifi, ethernet). Of course you can also remove software you don’t need.
Then you can convert the qcow2 image to raw and dd this to the notebooks hard drive. I tested this once for the Whonix gw. You need to tweak the network settings a bit, most likely the external interface of the gateway, in a way that it successfully connects to your upstream router. If you use wifi for the external interface maybe also some firewall rules have to be changed.
You might also want to take a look at this thread: Whonix-Gateway in WLAN

When you run the gw on bare metal and the ws in a VM you can either attach the network interface to the VM (easiest) or use NAT from the host. The latter one maybe breaks stream isolation (not sure about that).

What hardware for whonix-gateway

Thx Algernon for your input. I am however already aware of the techniques you outlined. I want to build it ground up so first I get a better understanding of the issues involved and second it allows me the flexibility to use any Linux distro I wish and Whonixfy it. As regards bare metal issue, my question is more precise, I know I have those 2 options but more precisely how do I bridge things at the GW end, as I said the networks will have different numbers unlike the VM version running on same host.


The Whonix firewall will take care of bridging as long as you use the right interfaces.
If you connect the gw via wifi to the internet and the ws via ethernet to the gateway then you need to edit the interfaces file. eth0 on the gw will become wlan0 (could also be something else depending on your wifi adapter) and eth1 will become eth0 (or something else depending on your ethernet adapter). For wlan0 you will likely also need to change the network address or use dhcp. Then you also need to edit the firewall rules and change the interfaces there. DHCP might require some more tweaking.
But maybe you can skip most of that and just use udev to rename your wifi device to eth0 and your ethernet device to eth1 so the names would be the same as in the VM. Changing network address, dhcp stuff … still applies.


Algernon, thx for your tips, will certainly investigate your suggestion.