Whonix-Firewall firewall_mode=

Thanks Patrick! That works! It was working without quotes on Whonix 17 with Qubes 4.2. Another issue is that to block all network until timesync is done before you could edit /etc/whonix_firewall.d/50_user.conf and add firewall_mode= but this is not working anymore. I see the same file now in /usr/local/etc/torrc.d/50_user.conf should I add firewall_mode= here?

1 Like

Try:

firewall_mode="timesync-fail-closed"

For reference:
Block Networking until sdwdate Finishes

2 Likes

Tried that in gw and ws. It does prevent network until timesync, but even with the flag set only in gw (I have tried it set in both too), the workstation will not attempt to timesync and so the network never becomes available because timesync never completes. Here’s log from workstation

tor_bootstrap_timeout_type:
tor_circuit_established_check_exit_code: 124
__ ### END: ### Exiting with exit_code ‘1’ indicating ‘wait, show error icon and retry.’.
2026-02-14 redacted - sdwdate - INFO - PREPARATION RESULT: onion-time-pre-script detected a known permanent (until the user fixes it) error status. Consider running systemcheck for more information.
2026-02-14 redacted sdwdate - INFO -

1 Like

This feature is broken. Requires code changes to be fixed.

2 Likes