Multiple Whonix-Workstations with one Gateway (KVM)

KVM
1

From https://www.whonix.org/wiki/Multiple_Whonix-Workstation#Non-Qubes-Whonix article (I’m not allowed links) I understood that in order to use the Whonix-Gateway with Multiple Workstations at the same time I need to duplicate the Whonix-Internal network for every new Workstation but with a new MAC address which I did but https://www.whonix.org/wiki/KVM#Creating_Multiple_Internal_Networks article doesn’t seem to also include the fact that without also editing the bridge parameter creating a new internal network (either by GUI or by terminal) will fail with:

error: internal error: bridge name ‘virbr2’ already in use

So I also incremented the bridge parameter to virbr3 and then proceeded to increment the IP address of the new cloned workstation. But after starting both virtual machines only the original (on Whonix-Internal) seems to work while the cloned one (on Whonix-Internal2) doesn’t connect to the internet at all.

How exactly should I accomplish this?

My intuition tells me that you only need to increment the IP address of the new virtual machine and skip the part with cloning the internal network (which is required only if you use multiple Whonix-Workstations with multiple Whonix-Gateways also on a 1:1 ratio). If so, both documentation pages need to be updated to explicitly mention that you need to clone the internal network only if you use multiple gateways otherwise skip.

Is incrementing the IP address sufficient to use multiple Whonix Workstations with one gateway? Do I benefit from separate (unlinkable unless Gateway compromised) Tor identities?

2 Likes
2

You don’t need to duplicate the internal network initially, although maybe it could be done and could be a good security measure (I don’t know actually). What you need to do is clone the workstation and edit the file vim /etc/network/interfaces.d/30_non-qubes-whonix changing the IP because Whonix don’t use DHCP by default although I think could be implemented. There you’re going to find this:

## When using Virtual Machines (not Physical Isolation),
## - eth0 is an internal, isolated, virtual network
## - provided and only visible inside Virtual Machines
## - solely used to communicate with the Gateway
## - it has no access to the host.
## - Thus, the following IP address can NOT cause conflicts
##   with your LAN network or router.
auto eth0
iface eth0 inet static
       ## Increment last octet of address
       ## on optional additional workstations.
       ## IP HARDCODED unfortunately.
       address 10.152.152.11 -> CHANGE THIS IP TO e.g "10.152.152.12" 
       netmask 255.255.192.0
       gateway 10.152.152.10

The Whonix_Internal_Network is a isolated network that only allow communication between Workstation and the Gateway. If you duplicate this network I think you will need to change something into the Gateway to be able to communicate with this new network. Create a new interface like eth3, add it to both machines and create a new IP address with another network portion, because I think won’t be able to use the same already used → 10.152.152.0/24. For example create a 10.152.153.0/24.

Whonix-Gateway have 2 network devices:

  1. eth0: for internet communication that use the Whonix_External_Network.
  2. eth1: for the isolated internal network that allow the communication with the workstation.

It would be great if some developer share documentation or posts about how QEMU/KVM networks interfaces, which type there are and how create them. Because there isn’t much interesting info, with examples.

1 Like