After setting your NetVM to sys-net, Whonix was fine?
Then it could be the following Qubes upstream bug:
Not a Whonix bug. But it affects Whonix. And could create some confusion. Therefore sharing it here.
opened 03:28PM - 01 Jul 16 UTC
closed 11:53PM - 15 Jul 16 UTC
T: bug
C: core
r3.1-wheezy-cur-test
r3.1-dom0-stable
r3.1-fc21-stable
r3.1-fc22-stable
r3.1-fc23-stable
r3.1-jessie-stable
r3.1-wheezy-stable
r3.1-stretch-stable
r3.2-stretch-cur-test
r3.2-fc23-stable
r3.2-fc24-stable
r3.2-dom0-stable
r3.2-jessie-stable
#### Qubes OS version (e.g., `R3.1`):
R3.2 (testing repository)
#### Affected T… emplateVMs (e.g., `fedora-23`, if applicable):
Probably any.
---
### Expected behavior:
An arbitrary proxy VM with NetVM set to sys-firewall should just work. (ping, nslookup, wget, etc.)
### Actual behavior:
An arbitrary proxy VM with NetVM set to sys-firewall does not work (ping, nslookup, wget, etc.).
### Steps to reproduce the behavior:
Unclear, since it seems to be happening only to me.
### General notes:
An arbitrary proxy VM (debian based) does not work behind sys-firewall. It however works behind sys-net.
Although this breaks Whonix by default, this bug report has been produced independent from Whonix. (sys-whonix does not work with its NetVM set to sys-firewall but it does work fine when set to sys-net.)
I have collected a ton of debug output.
- https://www.whonix.org/wiki/Dev/Qubes#Qubes_R3.2_sys-firewall_broken_bug
- http://archive.is/K9S0C
---
#### Related issues:
Perhaps https://github.com/QubesOS/qubes-issues/issues/1067.
The fix for it is currently only available in the Qubes testing repository. You might want to get that update or wait until it flows to stable.
It wasn’t all I did, I both UnWhonix’d the Gateway, AND set the NetVM to sys-net.
Now I’m trying to see which change exactly made it work, but it’s not so easy, sometimes when I restart Gateway it reverts back to the old configuration files…
EDIT: it’s now working with NetVM set to sys-net and a flushed iptables, but I get a warning Could not check for software udpates (apt-get has same error in the TemplateVM as well ).
How can it be it’s working for others but not for me in this case?
That is a bug. Reference:
opened 09:29PM - 21 Jul 16 UTC
closed 05:15PM - 04 Aug 16 UTC
T: bug
P: critical
C: Whonix
R3.2 with testing repository
There is a problem with the whonix-gw template. Pe… rhaps a release critical bug.
The symptom is starting with a fresh Tor data dir and Whonix Setup Wizard popping up again since /etc/tor/torrc settings get lost. Perhaps more.
The cause is a bug in [`bind-dirs.sh`](https://github.com/marmarek/qubes-core-agent-linux/blob/master/vm-systemd/bind-dirs.sh) in the `legacy` function.
Both, legacy folders `/rw/srv/qubes-whonix/` and `/rw/srv/qubes/` contained a folder `var`.
```
Jul 21 19:12:31 host mount-dirs.sh[484]: mv: cannot move ‘/rw/srv/whonix/var’ to ‘/rw/bind-dirs/var’: Directory not empty
```
```
user@host:~$ sudo ls /rw/srv/whonix/var
cache lib
user@host:~$ sudo ls /rw/bind-dirs/
etc var
user@host:~$ sudo mv /rw/srv/whonix/var /rw/bind-dirs/
mv: cannot move ‘/rw/srv/whonix/var’ to ‘/rw/bind-dirs/var’: Directory not empty
```
```
user@host:/rw/srv$ find .
.
./qubes-whonix
./qubes-whonix/var
./qubes-whonix/var/cache
./qubes-whonix/var/cache/qubes-whonix
./qubes-whonix/var/cache/qubes-whonix/whonix-ip-gateway
./whonix
./whonix/var
./whonix/var/cache
./whonix/var/cache/anon-base-files
./whonix/var/cache/whonix-setup-wizard
./whonix/var/cache/whonix-setup-wizard/status-files
./whonix/var/cache/whonix-setup-wizard/status-files/first_use_check.skip
./whonix/var/cache/whonix-setup-wizard/status-files/whonix_repository.skip
./whonix/var/cache/whonix-setup-wizard/status-files/disclaimer.skip
./whonix/var/cache/whonix-setup-wizard/status-files/whonixsetup.skip
./whonix/var/cache/tb-updater
./whonix/var/lib
./whonix/var/lib/tor
find: `./whonix/var/lib/tor': Permission denied
./whonix/var/lib/whonix
./whonix/var/lib/whonix/whonixblog
./whonix/var/lib/whonix/initial-packages
./whonix/var/lib/whonix/sources_temp_list.d
./whonix/var/lib/whonix/do_once
./whonix/var/lib/whonix/do_once/timesync_apparmor_profile_delete
./whonix/var/lib/whonixcheck
./whonix/var/lib/whonixcheck/write_lock
./whonix/var/lib/whonixcheck/whonixcheck_lastrun
./whonix/etc
./whonix/etc/tor
./whonix/etc/tor/torrc
./whonix/etc/tor/torrc.anondist-orig
./whonix/etc/tor/torrc.examples
./whonix/etc/tor/torrc.anondist
./whonix/etc/tor/torsocks.conf
```
```
-- Logs begin at Thu 2016-07-21 19:09:37 UTC, end at Thu 2016-07-21 19:16:12 UTC. --
Jul 21 19:09:43 host systemd[1]: Starting Initialize and mount /rw and /home...
Jul 21 19:09:44 host mount-dirs.sh[484]: tune2fs 1.42.12 (29-Aug-2014)
Jul 21 19:09:44 host mount-dirs.sh[484]: Setting reserved blocks percentage to 0% (0 blocks)
Jul 21 19:12:31 host mount-dirs.sh[484]: + for source_folder in /usr/lib/qubes-bind-dirs.d /etc/qubes-bind-dirs.d /rw/config/qubes-bind-dirs.d
Jul 21 19:12:31 host mount-dirs.sh[484]: + true 'source_folder: /usr/lib/qubes-bind-dirs.d'
Jul 21 19:12:31 host mount-dirs.sh[484]: + '[' '!' -d /usr/lib/qubes-bind-dirs.d ']'
Jul 21 19:12:31 host mount-dirs.sh[484]: + for file_name in '"$source_folder/"*".conf"'
Jul 21 19:12:31 host mount-dirs.sh[484]: + bash -n /usr/lib/qubes-bind-dirs.d/40_qubes-whonix.conf
Jul 21 19:12:31 host mount-dirs.sh[484]: + source /usr/lib/qubes-bind-dirs.d/40_qubes-whonix.conf
Jul 21 19:12:31 host mount-dirs.sh[484]: ++ binds+=('/var/lib/tor')
Jul 21 19:12:31 host mount-dirs.sh[484]: ++ binds+=('/var/lib/whonix')
Jul 21 19:12:31 host mount-dirs.sh[484]: ++ binds+=('/var/lib/whonixcheck')
Jul 21 19:12:31 host mount-dirs.sh[484]: ++ binds+=('/var/cache/whonix-setup-wizard')
Jul 21 19:12:31 host mount-dirs.sh[484]: ++ binds+=('/var/cache/anon-base-files')
Jul 21 19:12:31 host mount-dirs.sh[484]: ++ binds+=('/var/cache/qubes-whonix')
Jul 21 19:12:31 host mount-dirs.sh[484]: ++ binds+=('/var/cache/tb-updater')
Jul 21 19:12:31 host mount-dirs.sh[484]: ++ binds+=('/etc/tor')
Jul 21 19:12:31 host mount-dirs.sh[484]: + for source_folder in /usr/lib/qubes-bind-dirs.d /etc/qubes-bind-dirs.d /rw/config/qubes-bind-dirs.d
Jul 21 19:12:31 host mount-dirs.sh[484]: + true 'source_folder: /etc/qubes-bind-dirs.d'
Jul 21 19:12:31 host mount-dirs.sh[484]: + '[' '!' -d /etc/qubes-bind-dirs.d ']'
Jul 21 19:12:31 host mount-dirs.sh[484]: + continue
Jul 21 19:12:31 host mount-dirs.sh[484]: + for source_folder in /usr/lib/qubes-bind-dirs.d /etc/qubes-bind-dirs.d /rw/config/qubes-bind-dirs.d
Jul 21 19:12:31 host mount-dirs.sh[484]: + true 'source_folder: /rw/config/qubes-bind-dirs.d'
Jul 21 19:12:31 host mount-dirs.sh[484]: + '[' '!' -d /rw/config/qubes-bind-dirs.d ']'
Jul 21 19:12:31 host mount-dirs.sh[484]: + continue
Jul 21 19:12:31 host mount-dirs.sh[484]: + main
Jul 21 19:12:31 host mount-dirs.sh[484]: + prerequisite
Jul 21 19:12:31 host mount-dirs.sh[484]: ++ qubesdb-read /qubes-vm-persistence
Jul 21 19:12:31 host mount-dirs.sh[484]: + qubes_vm_persistence=rw-only
Jul 21 19:12:31 host mount-dirs.sh[484]: + '[' '!' rw-only = rw-only ']'
Jul 21 19:12:31 host mount-dirs.sh[484]: + '[' -f /var/run/qubes-service/qubes-dvm ']'
Jul 21 19:12:31 host mount-dirs.sh[484]: + init
Jul 21 19:12:31 host mount-dirs.sh[484]: + '[' -n '' ']'
Jul 21 19:12:31 host mount-dirs.sh[484]: + rw_dest_dir=/rw/bind-dirs
Jul 21 19:12:31 host mount-dirs.sh[484]: + '[' -n '' ']'
Jul 21 19:12:31 host mount-dirs.sh[484]: + symlink_level_max=10
Jul 21 19:12:31 host mount-dirs.sh[484]: + mkdir --parents /rw/bind-dirs
Jul 21 19:12:31 host mount-dirs.sh[484]: + shopt -s nullglob
Jul 21 19:12:31 host mount-dirs.sh[484]: + shopt -s dotglob
Jul 21 19:12:31 host mount-dirs.sh[484]: + legacy
Jul 21 19:12:31 host mount-dirs.sh[484]: + local item
Jul 21 19:12:31 host mount-dirs.sh[484]: + for item in '/rw/srv/qubes-whonix/*' '/rw/srv/whonix/*'
Jul 21 19:12:31 host mount-dirs.sh[484]: + mv /rw/srv/qubes-whonix/var /rw/bind-dirs/
Jul 21 19:12:31 host mount-dirs.sh[484]: + for item in '/rw/srv/qubes-whonix/*' '/rw/srv/whonix/*'
Jul 21 19:12:31 host mount-dirs.sh[484]: + mv /rw/srv/whonix/etc /rw/bind-dirs/
Jul 21 19:12:31 host mount-dirs.sh[484]: + for item in '/rw/srv/qubes-whonix/*' '/rw/srv/whonix/*'
Jul 21 19:12:31 host mount-dirs.sh[484]: + mv /rw/srv/whonix/var /rw/bind-dirs/
Jul 21 19:12:31 host mount-dirs.sh[484]: mv: cannot move ‘/rw/srv/whonix/var’ to ‘/rw/bind-dirs/var’: Directory not empty
Jul 21 19:12:31 host mount-dirs.sh[484]: + true
Jul 21 19:12:31 host mount-dirs.sh[484]: + for item in /rw/srv/qubes-whonix /rw/srv/whonix
Jul 21 19:12:31 host mount-dirs.sh[484]: + '[' -d /rw/srv/qubes-whonix ']'
Jul 21 19:12:31 host mount-dirs.sh[484]: + rmdir /rw/srv/qubes-whonix
Jul 21 19:12:31 host mount-dirs.sh[484]: + for item in /rw/srv/qubes-whonix /rw/srv/whonix
Jul 21 19:12:31 host mount-dirs.sh[484]: + '[' -d /rw/srv/whonix ']'
Jul 21 19:12:31 host mount-dirs.sh[484]: + rmdir /rw/srv/whonix
Jul 21 19:12:31 host mount-dirs.sh[484]: rmdir: failed to remove ‘/rw/srv/whonix’: Directory not empty
Jul 21 19:12:31 host mount-dirs.sh[484]: + true
Jul 21 19:12:31 host mount-dirs.sh[484]: + bind_dirs
Jul 21 19:12:31 host mount-dirs.sh[484]: + for fso_ro in '${binds[@]}'
Jul 21 19:12:31 host mount-dirs.sh[484]: + local symlink_level_counter
Jul 21 19:12:31 host mount-dirs.sh[484]: + symlink_level_counter=0
Jul 21 19:12:31 host mount-dirs.sh[484]: + true
Jul 21 19:12:31 host mount-dirs.sh[484]: + '[' -h /var/lib/tor ']'
Jul 21 19:12:31 host mount-dirs.sh[484]: + true '/var/lib/tor is not a symlink'
Jul 21 19:12:31 host mount-dirs.sh[484]: + break
Jul 21 19:12:31 host mount-dirs.sh[484]: + true 'fso_ro: /var/lib/tor'
Jul 21 19:12:31 host mount-dirs.sh[484]: + fso_rw=/rw/bind-dirs/var/lib/tor
Jul 21 19:12:31 host mount-dirs.sh[484]: + umount /var/lib/tor
Jul 21 19:12:31 host mount-dirs.sh[484]: + true
Jul 21 19:12:31 host mount-dirs.sh[484]: + '[' -n '' ']'
Jul 21 19:12:31 host mount-dirs.sh[484]: + '[' -d /var/lib/tor ']'
Jul 21 19:12:31 host mount-dirs.sh[484]: + cp --verbose --no-clobber --archive --recursive --parents /var/lib/tor /rw/bind-dirs
Jul 21 19:12:31 host mount-dirs.sh[484]: /var/lib -> /rw/bind-dirs/var/lib
Jul 21 19:12:31 host mount-dirs.sh[484]: ‘/var/lib/tor’ -> ‘/rw/bind-dirs/var/lib/tor’
Jul 21 19:12:31 host mount-dirs.sh[484]: ‘/var/lib/tor/state’ -> ‘/rw/bind-dirs/var/lib/tor/state’
Jul 21 19:12:31 host mount-dirs.sh[484]: ‘/var/lib/tor/lock’ -> ‘/rw/bind-dirs/var/lib/tor/lock’
Jul 21 19:12:31 host mount-dirs.sh[484]: + mount --bind /rw/bind-dirs/var/lib/tor /var/lib/tor
Jul 21 19:12:31 host mount-dirs.sh[484]: + for fso_ro in '${binds[@]}'
Jul 21 19:12:31 host mount-dirs.sh[484]: + local symlink_level_counter
Jul 21 19:12:31 host mount-dirs.sh[484]: + symlink_level_counter=0
Jul 21 19:12:31 host mount-dirs.sh[484]: + true
Jul 21 19:12:31 host mount-dirs.sh[484]: + '[' -h /var/lib/whonix ']'
Jul 21 19:12:31 host mount-dirs.sh[484]: + true '/var/lib/whonix is not a symlink'
Jul 21 19:12:31 host mount-dirs.sh[484]: + break
Jul 21 19:12:31 host mount-dirs.sh[484]: + true 'fso_ro: /var/lib/whonix'
Jul 21 19:12:31 host mount-dirs.sh[484]: + fso_rw=/rw/bind-dirs/var/lib/whonix
Jul 21 19:12:31 host mount-dirs.sh[484]: + umount /var/lib/whonix
Jul 21 19:12:31 host mount-dirs.sh[484]: + true
Jul 21 19:12:31 host mount-dirs.sh[484]: + '[' -n '' ']'
Jul 21 19:12:31 host mount-dirs.sh[484]: + '[' -d /var/lib/whonix ']'
Jul 21 19:12:31 host mount-dirs.sh[484]: + cp --verbose --no-clobber --archive --recursive --parents /var/lib/whonix /rw/bind-dirs
Jul 21 19:12:31 host mount-dirs.sh[484]: ‘/var/lib/whonix’ -> ‘/rw/bind-dirs/var/lib/whonix’
Jul 21 19:12:31 host mount-dirs.sh[484]: ‘/var/lib/whonix/initial-packages’ -> ‘/rw/bind-dirs/var/lib/whonix/initial-packages’
Jul 21 19:12:31 host mount-dirs.sh[484]: ‘/var/lib/whonix/whonixblog’ -> ‘/rw/bind-dirs/var/lib/whonix/whonixblog’
Jul 21 19:12:31 host mount-dirs.sh[484]: ‘/var/lib/whonix/sources_temp_list.d’ -> ‘/rw/bind-dirs/var/lib/whonix/sources_temp_list.d’
Jul 21 19:12:31 host mount-dirs.sh[484]: ‘/var/lib/whonix/do_once’ -> ‘/rw/bind-dirs/var/lib/whonix/do_once’
Jul 21 19:12:31 host mount-dirs.sh[484]: ‘/var/lib/whonix/do_once/twelve_dot_x_to_thirteen_dot_x_version_6’ -> ‘/rw/bind-dirs/var/lib/whonix/do_once/twelve_dot_x_to_thirteen_dot_x_version_6’
Jul 21 19:12:31 host mount-dirs.sh[484]: ‘/var/lib/whonix/do_once/timesync_apparmor_profile_delete’ -> ‘/rw/bind-dirs/var/lib/whonix/do_once/timesync_apparmor_profile_delete’
Jul 21 19:12:31 host mount-dirs.sh[484]: + mount --bind /rw/bind-dirs/var/lib/whonix /var/lib/whonix
Jul 21 19:12:31 host mount-dirs.sh[484]: + for fso_ro in '${binds[@]}'
Jul 21 19:12:31 host mount-dirs.sh[484]: + local symlink_level_counter
Jul 21 19:12:31 host mount-dirs.sh[484]: + symlink_level_counter=0
Jul 21 19:12:31 host mount-dirs.sh[484]: + true
Jul 21 19:12:31 host mount-dirs.sh[484]: + '[' -h /var/lib/whonixcheck ']'
Jul 21 19:12:31 host mount-dirs.sh[484]: + true '/var/lib/whonixcheck is not a symlink'
Jul 21 19:12:31 host mount-dirs.sh[484]: + break
Jul 21 19:12:31 host mount-dirs.sh[484]: + true 'fso_ro: /var/lib/whonixcheck'
Jul 21 19:12:31 host mount-dirs.sh[484]: + fso_rw=/rw/bind-dirs/var/lib/whonixcheck
Jul 21 19:12:31 host mount-dirs.sh[484]: + umount /var/lib/whonixcheck
Jul 21 19:12:31 host mount-dirs.sh[484]: + true
Jul 21 19:12:31 host mount-dirs.sh[484]: + '[' -n '' ']'
Jul 21 19:12:31 host mount-dirs.sh[484]: + '[' -d /var/lib/whonixcheck ']'
Jul 21 19:12:31 host mount-dirs.sh[484]: + cp --verbose --no-clobber --archive --recursive --parents /var/lib/whonixcheck /rw/bind-dirs
Jul 21 19:12:32 host mount-dirs.sh[484]: ‘/var/lib/whonixcheck’ -> ‘/rw/bind-dirs/var/lib/whonixcheck’
Jul 21 19:12:32 host mount-dirs.sh[484]: ‘/var/lib/whonixcheck/write_lock’ -> ‘/rw/bind-dirs/var/lib/whonixcheck/write_lock’
Jul 21 19:12:32 host mount-dirs.sh[484]: + mount --bind /rw/bind-dirs/var/lib/whonixcheck /var/lib/whonixcheck
Jul 21 19:12:32 host mount-dirs.sh[484]: + for fso_ro in '${binds[@]}'
Jul 21 19:12:32 host mount-dirs.sh[484]: + local symlink_level_counter
Jul 21 19:12:32 host mount-dirs.sh[484]: + symlink_level_counter=0
Jul 21 19:12:32 host mount-dirs.sh[484]: + true
Jul 21 19:12:32 host mount-dirs.sh[484]: + '[' -h /var/cache/whonix-setup-wizard ']'
Jul 21 19:12:32 host mount-dirs.sh[484]: + true '/var/cache/whonix-setup-wizard is not a symlink'
Jul 21 19:12:32 host mount-dirs.sh[484]: + break
Jul 21 19:12:32 host mount-dirs.sh[484]: + true 'fso_ro: /var/cache/whonix-setup-wizard'
Jul 21 19:12:32 host mount-dirs.sh[484]: + fso_rw=/rw/bind-dirs/var/cache/whonix-setup-wizard
Jul 21 19:12:32 host mount-dirs.sh[484]: + umount /var/cache/whonix-setup-wizard
Jul 21 19:12:32 host mount-dirs.sh[484]: + true
Jul 21 19:12:32 host mount-dirs.sh[484]: + '[' -n '' ']'
Jul 21 19:12:32 host mount-dirs.sh[484]: + '[' -d /var/cache/whonix-setup-wizard ']'
Jul 21 19:12:32 host mount-dirs.sh[484]: + cp --verbose --no-clobber --archive --recursive --parents /var/cache/whonix-setup-wizard /rw/bind-dirs
Jul 21 19:12:32 host mount-dirs.sh[484]: ‘/var/cache/whonix-setup-wizard’ -> ‘/rw/bind-dirs/var/cache/whonix-setup-wizard’
Jul 21 19:12:32 host mount-dirs.sh[484]: ‘/var/cache/whonix-setup-wizard/status-files’ -> ‘/rw/bind-dirs/var/cache/whonix-setup-wizard/status-files’
Jul 21 19:12:32 host mount-dirs.sh[484]: ‘/var/cache/whonix-setup-wizard/status-files/whonix_repository.skip’ -> ‘/rw/bind-dirs/var/cache/whonix-setup-wizard/status-files/whonix_repository.skip’
Jul 21 19:12:32 host mount-dirs.sh[484]: ‘/var/cache/whonix-setup-wizard/status-files/first_use_check.skip’ -> ‘/rw/bind-dirs/var/cache/whonix-setup-wizard/status-files/first_use_check.skip’
Jul 21 19:12:32 host mount-dirs.sh[484]: ‘/var/cache/whonix-setup-wizard/status-files/disclaimer.skip’ -> ‘/rw/bind-dirs/var/cache/whonix-setup-wizard/status-files/disclaimer.skip’
Jul 21 19:12:32 host mount-dirs.sh[484]: ‘/var/cache/whonix-setup-wizard/status-files/whonixsetup.skip’ -> ‘/rw/bind-dirs/var/cache/whonix-setup-wizard/status-files/whonixsetup.skip’
Jul 21 19:12:32 host mount-dirs.sh[484]: + mount --bind /rw/bind-dirs/var/cache/whonix-setup-wizard /var/cache/whonix-setup-wizard
Jul 21 19:12:32 host mount-dirs.sh[484]: + for fso_ro in '${binds[@]}'
Jul 21 19:12:32 host mount-dirs.sh[484]: + local symlink_level_counter
Jul 21 19:12:32 host mount-dirs.sh[484]: + symlink_level_counter=0
Jul 21 19:12:32 host mount-dirs.sh[484]: + true
Jul 21 19:12:32 host mount-dirs.sh[484]: + '[' -h /var/cache/anon-base-files ']'
Jul 21 19:12:32 host mount-dirs.sh[484]: + true '/var/cache/anon-base-files is not a symlink'
Jul 21 19:12:32 host mount-dirs.sh[484]: + break
Jul 21 19:12:32 host mount-dirs.sh[484]: + true 'fso_ro: /var/cache/anon-base-files'
Jul 21 19:12:32 host mount-dirs.sh[484]: + fso_rw=/rw/bind-dirs/var/cache/anon-base-files
Jul 21 19:12:32 host mount-dirs.sh[484]: + umount /var/cache/anon-base-files
Jul 21 19:12:32 host mount-dirs.sh[484]: + true
Jul 21 19:12:32 host mount-dirs.sh[484]: + '[' -n '' ']'
Jul 21 19:12:32 host mount-dirs.sh[484]: + '[' -d /var/cache/anon-base-files ']'
Jul 21 19:12:32 host mount-dirs.sh[484]: + cp --verbose --no-clobber --archive --recursive --parents /var/cache/anon-base-files /rw/bind-dirs
Jul 21 19:12:32 host mount-dirs.sh[484]: ‘/var/cache/anon-base-files’ -> ‘/rw/bind-dirs/var/cache/anon-base-files’
Jul 21 19:12:32 host mount-dirs.sh[484]: ‘/var/cache/anon-base-files/first-boot-skel.TemplateVM.done’ -> ‘/rw/bind-dirs/var/cache/anon-base-files/first-boot-skel.TemplateVM.done’
Jul 21 19:12:32 host mount-dirs.sh[484]: + mount --bind /rw/bind-dirs/var/cache/anon-base-files /var/cache/anon-base-files
Jul 21 19:12:32 host mount-dirs.sh[484]: + for fso_ro in '${binds[@]}'
Jul 21 19:12:32 host mount-dirs.sh[484]: + local symlink_level_counter
Jul 21 19:12:32 host mount-dirs.sh[484]: + symlink_level_counter=0
Jul 21 19:12:32 host mount-dirs.sh[484]: + true
Jul 21 19:12:32 host mount-dirs.sh[484]: + '[' -h /var/cache/qubes-whonix ']'
Jul 21 19:12:32 host mount-dirs.sh[484]: + true '/var/cache/qubes-whonix is not a symlink'
Jul 21 19:12:32 host mount-dirs.sh[484]: + break
Jul 21 19:12:32 host mount-dirs.sh[484]: + true 'fso_ro: /var/cache/qubes-whonix'
Jul 21 19:12:32 host mount-dirs.sh[484]: + fso_rw=/rw/bind-dirs/var/cache/qubes-whonix
Jul 21 19:12:32 host mount-dirs.sh[484]: + umount /var/cache/qubes-whonix
Jul 21 19:12:32 host mount-dirs.sh[484]: + true
Jul 21 19:12:32 host mount-dirs.sh[484]: + '[' -n '' ']'
Jul 21 19:12:32 host mount-dirs.sh[484]: + '[' -d /var/cache/qubes-whonix ']'
Jul 21 19:12:32 host mount-dirs.sh[484]: + '[' -f /var/cache/qubes-whonix ']'
Jul 21 19:12:32 host mount-dirs.sh[484]: + true '/var/cache/qubes-whonix is neither a directory nor a file or does not exist, skipping.'
Jul 21 19:12:32 host mount-dirs.sh[484]: + continue
Jul 21 19:12:32 host mount-dirs.sh[484]: + for fso_ro in '${binds[@]}'
Jul 21 19:12:32 host mount-dirs.sh[484]: + local symlink_level_counter
Jul 21 19:12:32 host mount-dirs.sh[484]: + symlink_level_counter=0
Jul 21 19:12:32 host mount-dirs.sh[484]: + true
Jul 21 19:12:32 host mount-dirs.sh[484]: + '[' -h /var/cache/tb-updater ']'
Jul 21 19:12:32 host mount-dirs.sh[484]: + true '/var/cache/tb-updater is not a symlink'
Jul 21 19:12:32 host mount-dirs.sh[484]: + break
Jul 21 19:12:32 host mount-dirs.sh[484]: + true 'fso_ro: /var/cache/tb-updater'
Jul 21 19:12:32 host mount-dirs.sh[484]: + fso_rw=/rw/bind-dirs/var/cache/tb-updater
Jul 21 19:12:32 host mount-dirs.sh[484]: + umount /var/cache/tb-updater
Jul 21 19:12:32 host mount-dirs.sh[484]: + true
Jul 21 19:12:32 host mount-dirs.sh[484]: + '[' -n '' ']'
Jul 21 19:12:32 host mount-dirs.sh[484]: + '[' -d /var/cache/tb-updater ']'
Jul 21 19:12:32 host mount-dirs.sh[484]: + '[' -f /var/cache/tb-updater ']'
Jul 21 19:12:32 host mount-dirs.sh[484]: + true '/var/cache/tb-updater is neither a directory nor a file or does not exist, skipping.'
Jul 21 19:12:32 host mount-dirs.sh[484]: + continue
Jul 21 19:12:32 host mount-dirs.sh[484]: + for fso_ro in '${binds[@]}'
Jul 21 19:12:32 host mount-dirs.sh[484]: + local symlink_level_counter
Jul 21 19:12:32 host mount-dirs.sh[484]: + symlink_level_counter=0
Jul 21 19:12:32 host mount-dirs.sh[484]: + true
Jul 21 19:12:32 host mount-dirs.sh[484]: + '[' -h /etc/tor ']'
Jul 21 19:12:32 host mount-dirs.sh[484]: + true '/etc/tor is not a symlink'
Jul 21 19:12:32 host mount-dirs.sh[484]: + break
Jul 21 19:12:32 host mount-dirs.sh[484]: + true 'fso_ro: /etc/tor'
Jul 21 19:12:32 host mount-dirs.sh[484]: + fso_rw=/rw/bind-dirs/etc/tor
Jul 21 19:12:32 host mount-dirs.sh[484]: + umount /etc/tor
Jul 21 19:12:32 host mount-dirs.sh[484]: + true
Jul 21 19:12:32 host mount-dirs.sh[484]: + '[' -n '' ']'
Jul 21 19:12:32 host mount-dirs.sh[484]: + '[' -d /etc/tor ']'
Jul 21 19:12:32 host mount-dirs.sh[484]: + cp --verbose --no-clobber --archive --recursive --parents /etc/tor /rw/bind-dirs
Jul 21 19:12:32 host mount-dirs.sh[484]: + mount --bind /rw/bind-dirs/etc/tor /etc/tor
Jul 21 19:12:32 host mount-dirs.sh[484]: + true 'OK: END.'
Jul 21 19:12:32 host systemd[1]: Started Initialize and mount /rw and /home.
```
Do you know how to properly merge/move these folders?
Perhaps I should just abandon the generic approach and do it manually for the 8 legacy folders? I.e.
```
mv /rw/srv/whonix/var/lib/tor /rw/bind-dirs/var/lib/tor
```
etc.?
It is fixed in Qubes R3.2rc2 and qubes-whonix 5.7-1 (currently only in Whonix jessie-proposed-updates and testers repository).
Thanks Patrick.
Any idea why it works for everyone else but me?
I could try eliminating the iptables rules for the buggy line, but it still bugs me why it happens only to me…
No. Could perhaps be hardware related.
Thank you a lot for your patience and persistence!
The upcoming version of Qubes-Whonix stable maintenance release will be much more robust against race conditions. When it is out, please try it. (Might be a few days.)
opened 08:23PM - 04 Aug 16 UTC
closed 08:40PM - 11 Aug 16 UTC
T: task
C: Whonix
Please build Qubes-Whonix 13.0.0.1.0 templates for R3.2 final (or next RC should… there be also R3.2r3).
qubes-template-whonix tag 13.0.0.1.0
It's supposed to be a stable upgrade. Containing all upgrades mentioned in https://www.whonix.org/blog/testers-wanted-repo-upgrades and would also come without any #2191 issues.
After it has been build, I need to verify it's working fine before it can become the new latest stable.
I installed the same Qubes in a different machine, but behind the same router, and had the same problem. Does it mean the router could be causing this somehow? When I clear the iptables rules it works, so this is odd.
Maybe. I once heard such a report that it was all the router’s fault but that reporter did not go into details.
Should I just flush the iptables and allow everything considering I’m behind a router (with NAT)?
Which rules should I include?
I’d like to debug this further, but I have to use a usb wifi adapter. I couldn’t find any instructions on how to use a usb wifi in Qubes - do you have any links to help with that?
Thanks
No, never tried that myself. Please try the Qubes help (probably mailing list).
The Qubes community is here to help! Since Qubes is a security-oriented operating system, we want to make sure you stay safe as you get the support you need, and we want to make sure our community remains a friendly and productive place by ensuring...
Found something that could help.
OK. When I used a different modem it connected.
This is bewildering, I don’t have any such problems with VritualBox Whonix.
What could possibly be causing this?
That is very strange indeed.
No idea. Can only speculate.
A simple modem? Or a more sophisticated device with many (firewall)
settings or router?
Perhaps any firewall settings blocking some outgoing ports? Perhaps deep
package inspection (DPI) or other stuff such as intrusion prevention
system (IDS IPS) that is detecting a false positive and blocking it?
It’s a modem-router. I can’t see any DPI or IDS IPS options in the router’s interface. For clarification I didn’t use the same ISP when tested Qubes with another modem (modem+ISP were different, not only modem).
EDIT: I’d venture to say it has to do with the country where I live in, which is notorious for surveillance by the government, if Tor standalone failed to work on the same Qubes OS too.
I tried something else. This time I set the Socks5Proxy directive to make it connect through a proxy in an attempt to circumvent any possible DPI on the ISP’s side, yet it’s still not working.
I tested the same directive in a non-Qubes-Whonix Tor and it worked fine.
Socks does not necessarily beat DPI. What would be interesting would be
connecting though a socks proxy service that is both encrypted (such as
Tor, JonDo) that is already working on the host.
Tor would lead to Tor over Tor, but perhaps JonDo https proxy in another
VM would work? As per:
Combining Whonix ™ with JonDonym
Hi Patrick,
I was of the impression Socks is an encrypted tunnel.
In any case, I tried Tor over JonDo, and it took some time, but it worked, and I’m even more puzzled than before…
the local connection from ws to gw (any socks) is unencrypted
once Tor accepted the socks connection and forwards it to the Tor network it will be encrypted with 3 layers (onion layers)
however, Tor traffic is not that difficult to detect. Encrypted does not mean hard to block by DPI. That requires traffic obfuscation. (documented here: Configure (Private) (Obfuscated) Tor Bridges )
other and “regular” socks proxies are unencrypted (more info: Whonix versus Proxies )
Possiblities:
a) some DPI is blocking Tor but not JonDo (much less popular), not so likely
b) port blocking
Tor in the Debian VM happened to pick ports for entry guards that are not blocked
Tor in Whonix-Gateway VM happened to pick ports for entry guards that are blocked
JonDo uses ports not blocked
and when tunneling Tor through JonDo, it does no longer matter that the ports of your entry guards are blocked by your router (which might be happening)
To strengthen the b) hypothesis, I propose the following.
I added to torrc ReachableAddresses accept *:9001 and it bootstrapped fine, and circuits were shown in arm, but it took at least an hour to get browsing in the WS. On the other hand, iirc sometimes after I got Qubes-Whonix-GW to bootstrap, either by flushing iptables rules, or by bypassing going through the network normally, it worked normally for a while right after. I never have issues connecting to Tor in non-Qubes-Whonix, so how can it be only a port change made a difference?