VPN KILLSWITCH & Parallel traffic

KVM
1

Greetings to all you guys and also Whonix ™ KVM Maintainer!

My topic is specific to this connection method: User → VPN → Tor → Internet

It all started with the need for VPN ----> Whonix (Gateway) to hide the fact of using the TOR from the ISP.

I began to look for a solution, and found out that with such a connection scheme as VPN----->WHONIX (Gateway), the traffic goes not consistently, but in parallel way! As a result, Tor traffic is not encapsulated in VPN. And there is a leak.

I have a few questions:

  1. Can I create an additional virtual machine that will act as VPN-Gateway which then will be connected to Whonix-Gateway? Thus, the traffic will be consistent(But in this case, you will have to change the connection with NAT to the isolated network in Whonix -gateway, which can be discouraged and can make leaks );

https://www.whonix.org/wiki/Tunnels/Connecting_to_a_VPN_before_Tor#KVM_VPN_Killswitch

> <network>
>   <name>Whonix-External</name>
>   <forward dev='tun0' mode='nat'/>
>   <bridge name='virbr1' stp='on' delay='0'/>
>   <ip address='10.0.2.2' netmask='255.255.255.0'>
>   </ip>
> </network>

This method of the VPN-killswitch was presented in official article. The question is how much this method is reliable from leaks and this method does consistent connection or parallel?

Either configure VPN-Router, or make VPN Tethering Via Android Device. In order not to discount the Whonix settings. Since I believe that digging in the settings of Whonix Firewall or other configs can easily be broken something, especially if you don’t know how does unix routing works.

  1. What method of connection according to my requirements is more optimal and reliable, perhaps which I do not know?

As I understand a lot of people do this way and this is stupidity, because they think that traffic is a consistent.

I would like to hear the detailed answers. Thanks to everyone!

1 Like
2

Before combining Tor with other tunnels, be sure to read and understand the risks!

  • It is not simple to configure VPNs, SSH or proxies in a foolproof, leak-free manner. However, in the case of Whonix it is impossible for traffic to bypass Tor, even if the VPN or proxy is misconfigured. [26]

It’s a challenging setup, and I appreciate the detailed questions and the effort you’ve already put into researching this.

To address the broader issue of setting up User → VPN → Tor → Internet securely and reliably: this configuration requires deep technical expertise in networking, virtual machines, and security principles. While it is possible to achieve, implementing this correctly without leaks and ensuring reliability is not a straightforward task.

Thank you again for raising this discussion. Your curiosity and initiative are admirable, and I hope this perspective helps clarify the challenges and potential solutions.

1 Like