Qubes-Whonix Whonix-Workstation TemplateVMs block access to (torified) open internet

[phabricator-migrator]

Information

ID: 372
PHID: PHID-TASK-u453s6e54ozazlvkpeu6
Author: Patrick
Status at Migration Time: invalid
Priority at Migration Time: Normal

Description

As of Qubes-Whonix 10, Qubes-Whonix Whonix-Workstation TemplateVMs are capable to connect to open internet (over Tor).

Is it a bug or feature?

I guess we should keep connections to torproject.org (Tor Browser updates, perhaps anonymity/connectivity check), Debian, Whonix and Qubes repository allowed, but block the rest? Similar to Qubes’ default Fedora TemplateVM?

Comments

---

Patrick

2015-07-25 15:25:54 UTC

See also this post by @marmarek:
https://groups.google.com/d/msg/qubes-users/l71lkxWc1c0/q214W9prb3QJ

---

Patrick

2016-08-14 20:34:19 UTC

As discussed in sys-whonix does not yet function was Qubes FirewallVM, in future TemplateVMs will not be needing their own NetVM anymore.

Rather than implementing this ticket Qubes-Whonix Whonix-Workstation TemplateVMs block access to (torified) open internet, the solution to this ticket is to wait for Qubes to implement the following tickets:

• implement qrexec based updates proxy
• set NetVM of TemplateVMs to none by default / make TemplateVMs non-networked by default

---

Patrick

2016-08-15 22:38:24 UTC

Duplicate of T466.