Whonix 18 (Qubes): Excluding Tor exit countries – is it still possible and does it make sense security-wise?

Qubes-Whonix
1

Hello,

I’m using Qubes OS with Whonix 18 (sys-whonix) and noticed that the Tor configuration workflow has changed compared to older Whonix versions.

Currently, Tor is configured mainly through Anon Connection Wizard, and manual editing of torrc / torrc.d is strongly discouraged or effectively blocked in Qubes-Whonix.

I have two related questions:

:one: Is it still possible (and supported) to exclude specific Tor exit countries?

In the past, this could be done using options like:

ExcludeExitNodes {xx},{yy}
StrictNodes 1

However, in Whonix 18:

  • Anon Connection Wizard does not expose any option for exit country selection or exclusion

  • Tor User Config GUI seems non-functional or deprecated

  • Manual torrc editing is discouraged and overwritten by the wizard

Is there any supported or recommended way to exclude exit countries in the current Whonix 18 + Qubes setup?

:two: Does excluding exit countries meaningfully impact security/anonymity?

I understand that:

  • restricting exit nodes can reduce the anonymity set

  • it may increase fingerprintability

  • Whonix intentionally avoids exposing this option

But I’m trying to understand the actual threat model trade-off:

  • Is excluding a small set of countries (e.g. 1–2) considered significantly harmful?

  • Or is the risk mostly theoretical unless very strict constraints are used?

  • Are there scenarios where exit country exclusion makes sense (legal, compliance, testing, reliability), or is it generally discouraged in all cases?

:three: Design intent question

Am I correct in assuming that:

  • Whonix 18 intentionally removes or hides exit country controls

  • to prevent users from weakening anonymity unintentionally?

If so, is this documented somewhere as an explicit design decision?

I’m not looking to bypass Whonix security mechanisms, just to better understand whether exit country control is still compatible with Whonix’s security model, or if it’s fundamentally at odds with it.

Thanks in advance for any clarification.

1 Like
2

I previously answered the second question on the Tor Project Forum:

Technically the remaining related questions are more relevant to the Tor Project Forum, but I will still address them here on the Whonix Forum:

It depends on the countries being excluded. Some countries are considered high-impact and will have major tradeoffs in performance and anonymity. You can take a look at what countries have the most consensus weight, along with the probabilities of their relays being used to generate a Tor circuit, using Tor Metrics:

Right now, Germany, the Netherlands, and the US are the top three high-impact countries, so excluding them will dramatically affect your Tor circuit, especially the Tor exit relay.

In most cases it is generally discouraged in order to maintain strong anonymity. It would make more sense to avoid using the same autonomous system in a Tor circuit (hosted in multiple countries) in order to improve network diversity and resilience[1], like OVHcloud[2], but that comes with raw performance tradeoffs.

  1. Tor Project | Technical considerations ↩︎

  2. Relay Search (currently 19 countries) ↩︎

3

It never had this functionality.

Use
Edit Tor Configuration.

sudoedit /usr/local/etc/torrc.d/50_user.conf

Note: sysmaint - System Maintenance User

Absolutely not.

Related: No Intentional User Freedom Restrictions

2 Likes