whonix-ws-firewall needs a VPN_FIREWALL feature

[phabricator-migrator]

Information

ID: 158
PHID: PHID-TASK-lqcv43rwjmjw3vfpufwi
Author: Patrick
Status at Migration Time: resolved
Priority at Migration Time: Normal

Description

bug report:

VPN Firewall doesn't work

I’m tunneling VPN through TOR. user → TOR → VPN Everything is working fine, but I’ve decided to use your Fail Closed Mechanism. I start it before OpenVPN, then start OpenVPN and it shows me “Initialization Sequence Completed” But I can’t get access to the internet. Here is my openvpn config: client dev tun auth-user-pass /home/user/Desktop/auth.txt #remote vpn.riseup.net 1194 remote 198.252.153.26 1194 ca /home/user/Desktop/RiseupCA.pem remote-cert-tls server script-security 1 #user nobody…

design discussion for this feature:

Whonix-Workstation Firewall - VPN_FIREWALL feature - design discussion

It somewhat clashes with Whonix’s stream isolation design. (Stream Isolation) The issue is documented here: Combining Tunnels with Tor There is an idea to simplify this: https://phabricator.whonix.org/T142 I got a local git branch, that implements the VPN_FIREWALL feature in Whonix-Workstation Firewall. But it currently breaks applications, that are configured to use a SocksPort. Let’s take for example XChat. How should XChat connect when VPN_FIREWALL has been enabled on Whonix-Workstation…

Comments

---

Patrick

2016-01-08 21:07:53 UTC

work on Whonix-Workstation VPN_FIREWALL feature:
https://github.com/Whonix/whonix-ws-firewall/commit/10a5366cb5ea32928a4b0d945621d291da43cdcc

---

Patrick

2016-01-09 20:48:28 UTC

https://github.com/Whonix/whonix-ws-firewall/commit/057cafbca9f44c43dad47c2320840bd176d2f45c

---

Patrick

2016-01-17 20:24:32 UTC

https://github.com/Whonix/whonix-ws-firewall/commit/d065fab590b4793791d6ee0424f40d6e6d2321ea

---

Patrick

2016-04-30 02:33:44 UTC

Apr 20 03:50:45 host systemd-tmpfiles[281]: Two or more conflicting lines for /run/openvpn configured, ignoring.

But since user tunnel has access to /var/run/openvpn, it should be alright.

---

Patrick

2016-05-04 16:56:49 UTC

This is now documented including a fix for T460.

Connecting to Tor before a VPN

And tested.

However, the documentation doing this with openvpn including a fix for T460 ridiculously difficult. Perhaps bitmask would do a bettter job than openvpn, created T506 to figure that out.