NO_NAT_USERS clearnet / tunnel

[singsong]

I didn’t notice the tunnel user in Whonix 12. New in v13?
What is that user used for? Only if VPN is used? Is it safe to comment that line in /usr/bin/whonix_firewall if I don’t use VPN?
Is it also safe to comment the line above where clearnet user gets non-tor-outgoing access?
Because I can’t see when I’ll ever need that and it’s an unnecessary risk IMO.
Also speeds up performance with less rules.
Thx

ps. if it’s fine to disable their access without breaking anything, then it would be nice to have an option in /etc/whonix_firewall.d/30_default.conf that we could change in 50_user.conf to make the change persistent.

[Patrick]

@singsong

I didn’t notice the tunnel user in Whonix 12. New in v13?

Yes.

@singsong

What is that user used for? Only if VPN is used?

Only active when using TUNNEL_FIREWALL setting.

@singsong

Is it safe to comment that line in /usr/bin/whonix_firewall if I don’t use VPN?

It’s not required and manual edits are unsupported. ( Frequently Asked Questions - Whonix FAQ )

@singsong

Is it also safe to comment the line above where clearnet user gets non-tor-outgoing access?

Same as above.

@singsong

Also speeds up performance with less rules.

I wonder if that has any significance, is measurable…

@singsong

Because I can’t see when I’ll ever need that and it’s an unnecessary risk IMO.

The risk of something somehow magically appearing under the clearnet user is as likely as under the debian-tor user. The latter cannot be abolished.