Tor traffic whitelisting gateway

Support
1

Hi

I stumbled accross the same issue as Wh0p5 : stucked with VirtualBox Whonix Gateway because no internet on host and therefore, no internet through NAT.

As Patrick stated it seems there is currently no official way to make Whonix Gateway work on bridge mode.

So, this is what I finally settled for… you’ll need a firewall, ideally an external one, with support for dynamic IPs lists. I use OpnSense but I’m sure there’s plenty of other software out there supporting this.

Create a new rule allowing all IPs in the following list to be accessed from the host : https[DOUBLEDOT]//www[DOT]dan[DOT]me[DOT]uk/torlist/?full

Configure an automatic refresh to ensure the nodes list keeps up to date - daily should be enough.

If you’re worried about your ISP or tierce parties knowing about you using Tor, all this traffic can be routed through a VPN, thus allowing for Tor-over-VPN configuration.

This is less than ideal (host actually can get limited access to the internet) but I guess it’s still a good compromise. Traffic is tightly restricted to the Tor network ; and the additional VPN fills up for IP leaks that could come from malicious nodes (by monitoring the traffic or accepting non-Tor connections).

This approach is adequate for my security profile, as I’m mostly looking to avoid any data leaking from my host without me knowing about it, while keeping my Tor traffic discrete. However this could be unsufficient for more elaborate OPSEC scenarios, and I would suggest anybody looking for more to switch to Qubes, who supports offline Dom0 and Whonix VMs.

Cheers :slight_smile:

2

Seems kinda different use case? Seems similar to a “Bridge Firewall”.

Or a Tor traffic whitelisting gateway. Example: Using corridor, a Tor traffic whitelisting gateway with Whonix ™

3

Absolutely :slight_smile: what I describe is a completely different use case. I suggested it as an alternative answer to the “no internet host” dilemna, but it has nothing to do with bridge networking on the gateway VM.

I didn’t know about corridor tho :hugs: seems like it could be a - better - way to achieve the same thing, I will surely take a look. Thanks for bringing this up.