Wiki Tunnel Builder

[0brand]

Will be starting to create new tunnel pages as per:

Long Wiki Edits Thread

Patrick

I think users don’t like documentation for the thing they want to work on split among multiple pages. They want the exact thing they want to do all on one coherent page. This however would require a ton of new wiki templates which then get reused for the many combinations before/after Tor vs VPN vs proxy vs ssh. Perhaps not realistic? Too much work? That’s why above’s quote is stressed.

If you would like me to spend the time on this, i can do that. Might be worth it.

• Easier to follow instruction = Less support requests.
• Pages would be shorter. Maybe users would actually read the documentation?
  • Users might not even use a VPN? But not likely, it took me a while before I realized they were not required / not always necessary.

Needs to be done eventually why not start now?

Looks like this will be quite a bit of work so this thread will be used for keeping track of tunnel page/chapter/template creation. Otherwise this could get a little confusing.

Feel free to edit this post if anything needs to be added.

---

New wiki

When templates are created they will be added under the corresponding pages. There may end up being more pages than what is listed. Once everything is in place the pages will be created. Will also have to fix any broken wiki links and maybe some of the high traffic forum links if needed. It might be worth it to fix as many forum links a possible so there are not more deprecated pages in the wiki

Tunnel-link before Tor.

---

• VPN before Tor. ( User -> VPN -> Tor -> Internet )

  • Template:Tunnel_Introduction
  • Template:Tunnel_Introduction/Tunnel-link_before_Tor
  • Template:Tunnel-link_Warnings/Common
  • Template:Tunnels/Challenges_in_Provider_Location_Selection

---

• Proxy before Tor. ( User -> proxy -> Tor -> Internet )

  • Template:Tunnel_Introduction

  • Template:Tunnel_Introduction/Tunnel-link_before_Tor

  • Template:Tunnel-link_Warnings/Common

  • Template:Tunnels/Challenges_in_Provider_Location_Selection

    • Add content to page as per Patrick.

      Connections to proxies are unencrypted and therefore should not be used to hide Tor use. Proxies are a type of tunnel-links which are not VPNs or SSH. Proxies are ok for circumvention of censorship if that works for the user but are unsuitable for hiding Tor due to lack of encryption.

---

• SSH before Tor .( User -> SSH -> Tor -> Internet )
  • Template:Tunnel_Introduction
  • Template:Tunnel_Introduction/Tunnel-link_before_Tor
  • Template:Tunnel-link_Warnings/Common
  • Template:Tunnels/Challenges_in_Provider_Location_Selection

---

• JonDonym before Tor. ( User -> JonDonym -> Tor -> Internet )

  • Template:Tunnel_Introduction (Collapse)
  • Template:Tunnel_Introduction/Tunnel-link_before_Tor (Collapse)
  • Template:Tunnel-link_Warnings/Common (Collapse)
  • Template:Tunnel/JonDonym_Analysis_by_an_Advanced_Adversary
  • Template:Tunnel/Whonix_Developer’s_view_of_JonDonym

---

• Lantern before Tor. ( User -> Lantern -> Tor -> Internet )
  • Template:Tunnel_Introduction (Collapse)
  • Template:Tunnel_Introduction/Tunnel-link_before_Tor (Collapse)
  • Template:Tunnel-link_Warnings/Common (Collapse)

---

Tor before tunnel-link.

---

• Tor before VPN. ( User -> Tor -> VPN -> Internet )

  • Template:Tunnel_Introduction
  • Template:Tunnel_Introduction/Tor_before_Tunnel-link
  • Template:Tunnel-link_Warnings/Common
  • Template:Tunnels/Challenges_in_Provider_Location_Selection

---

• Tor before proxy. ( User -> Tor -> proxy -> Internet )

  • Template:Tunnel_Introduction
  • Template:Tunnel_Introduction/Tor_before_Tunnel-link
  • Template:Tunnel-link_Warnings/Common
  • Template:Tunnels/Challenges_in_Provider_Location_Selection

---

• Tor before SSH. ( User -> Tor -> SSH -> Internet )

  • Template:Tunnel_Introduction
  • Template:Tunnel_Introduction/Tor_before_Tunnel-link
  • Template:Tunnel-link_Warnings/Common
  • Template:Tunnels/Challenges_in_Provider_Location_Selection

---

• Tor before I2P. ( User -> Tor -> I2P -> Internet )

  • Template:Tunnel_Introduction (Collapse)
  • Template:Tunnel_Introduction/Tor_before_Tunnel-link (Collapse)
  • Template:Tunnel-link_Warnings/Common (Collapse)

---

• Tor before JonDonym. ( User -> Tor -> JonDonym -> Internet )

  • Template:Tunnel_Introduction (Collapse)
  • Template:Tunnel_Introduction/Tor_before_Tunnel-link (Collapse)
  • Template:Tunnel-link_Warnings/Common (Collapse)
  • Template:Tunnel/JonDonym_Analysis_by_an_Advanced_Adversary
  • Template:Tunnel/Whonix_Developer’s_view_of_JonDonym

---

Edits To Do:

• Remove the reference to the variable used in Whonix 12
• Instructions to edit with root rights mentioned once. Then use simple edit file instruction for all step afterwords.
• Don’t use “;” for comments can be cleaned up a bit. Better wording.
• Change subheading “Setup Time” to more appropriate heading.
• Reword/simplfy Preperation step
• Move each chapter to its own temp wiki page.
• Remove Hiding Tor Usage from ISPs Warninga from Template:Warings/Common . Add to each Connecting to tunnel-link before Tor page.
• Note to self. Add sheep's suggestions (bookmarked post)

[0brand]

Created 2 templates.

Note: Template:Tunnel_Introduction should not be confused with Template:Tunnels_Introduction. The latter (currently used) Template will be removed when the new Tunnel pages are created.

• https://whonix.org/wiki/Template:Tunnel_Introduction

• https://whonix.org/wiki/Template:VPN_Warnings/Common

JonDonym and I2P pages will have the above templates collapsed.

---

The templates are going to be used in many pages so they will have to use either VPN/proxy/SSH or tunnel-link naming convention.

Example:

User -> Tor -> VPN/proxy/SSH -> Internet

Or

User -> Tor -> tunnel-link -> Internet

Input on this? Better idea?

[Patrick]

0brand:

User -> Tor -> tunnel-link -> Internet

Better. Otherwise too many / which mean something else (sub page).

[0brand]

New templates:

• https://whonix.org/wiki/Template:Tunnel_Introduction/Tunnel-link_before_Tor
• https://whonix.org/wiki/Template:Tunnel_Introduction/Tor_before_Tunnel-link
• https://whonix.org/wiki/Template:Tunnels/Challenges_in_Provider_Location_Selection

[Patrick]

https://whonix.org/wiki/Template:VPN_Warnings/Common

Not VPN specific. Should apply to most combinations.

https://www.whonix.org/wiki/Template:Tunnel_Introduction/Tunnel-link_before_Tor

Proxies do not provide encryption and should not be used to hide Tor use. rewritten to just now Connections to proxies are unencrypted and therefore should not be used to hide Tor use. Proxies are a type of tunnel-links which are not VPNs or SSH. Proxies are ok for circumvention of censorship if that works for the user but are unsuitable for hiding Tor due to lack of encryption.. Could you please move to

• proxies before Tor, and
• introduction

?

Also do we mention the unencrypted nature of proxies for proxies before Tor results in them to make them unsuitable to hide Tor from destination websites also? For simple IP logging / IP detection they might work - unless they’re http(s) proxies send the "http forwarded for" header. (http forwarded for" header mentioned here https://www.whonix.org/wiki/Comparison_Of_Tor_with_CGI_Proxies,_Proxy_Chains,_and_VPN_Services but not well connected to other pages.) But for anyone doing package inspection a proxy before Tor doesn’t even hide Tor from destination websites.

[0brand]

No problem. Have this done a title later. Fixed the bad Template links. Not checking to make sure links are correct is a bad habit of mine. As I’m sure you already know.

[0brand]

Proxies do not provide encryption and should not be used to hide Tor use. rewritten to just now Connections to proxies are unencrypted and therefore should not be used to hide Tor use. Proxies are a type of tunnel-links which are not VPNs or SSH. Proxies are ok for circumvention of censorship if that works for the user but are unsuitable for hiding Tor due to lack of encryption. . Could you please move to

• proxies before Tor, and
• introduction

Moved content to Introduction.

• https://whonix.org/w/index.php?title=Template:Tunnel_Introduction&oldid=40614&diff=cur

Made a notation in Tunnel builder “Proxy before Tor” to add that connect. No suitable place to put it… yet .

Also do we mention the unencrypted nature of proxies for proxies before Tor results in them to make them unsuitable to hide Tor from destination websites also? For simple IP logging / IP detection they might work - unless they’re http(s) proxies send the "http forwarded for" header . ( http forwarded for" header mentioned here https://www.whonix.org/wiki/Comparison_Of_Tor_with_CGI_Proxies,_Proxy_Chains,_and_VPN_Services but not well connected to other pages.) But for anyone doing package inspection a proxy before Tor doesn’t even hide Tor from destination websites.

Could that table be made into a Template: and added to relevant proxy pages? And add warning:

…unencrypted nature of proxies for proxies before Tor results in them to make them unsuitable to hide Tor from destination websites also…

[Patrick]

0brand:

Could that table be made into a Template: and added to relevant proxy pages? And add warning:

Sure. Depends on how specific we make the text. If these works for both
proxy positions or just one position. (before or after Tor)

[0anon]

Proxies do not provide encryption and should not be used to hide Tor use. rewritten to just now Connections to proxies are unencrypted and therefore should not be used to hide Tor use. Proxies are a type of tunnel-links which are not VPNs or SSH. Proxies are ok for circumvention of censorship if that works for the user but are unsuitable for hiding Tor due to lack of encryption. . Could you please move to

• proxies before Tor

Also do we mention the unencrypted nature of proxies for proxies before Tor results in them to make them unsuitable to hide Tor from destination websites also? For simple IP logging / IP detection they might work - unless they’re http(s) proxies send the "http forwarded for" header .

Done.

https://www.whonix.org/w/index.php?title=Tunnels/Connecting_to_a_proxy_before_Tor&oldid=35486&diff=cur

[0brand]

Created a Staging and Testing Wiki page and added the upcoming VPN before Tor page. Think it will be easier to create pages one at at time like this since it will just be a matter of moving the chapters around when all of them are complete. Still have to move things around on this one.

https://whonix.org/wiki/Wiki_Edits_Staging_and_Testing_Page

Feedback (VPN befor Tor)

• Should tunnel warnings have heading like the Qubes DisposableVM Warnings chapter?
• Any templates that should be moved around or combined?
• New content needed?
• Duplicate or redundant content that should be removed?
• Any sections that may be confusing for inexperienced users? (needs to be rewritten)
• Simplified formatting??

[0brand]

Created new Proxy before Tor Warnings Template.

https://whonix.org/wiki/Template:Tunnel/Proxy_before_Tor_Warnings

Added heading to one of the Warnings/Common template. Opinion?

https://whonix.org/w/index.php?title=Template:Tunnel-link_Warnings/Common&oldid=40629&diff=cur

New Proxy before Tor chapter added to testing/staging page.

https://whonix.org/w/index.php?title=Wiki_Edits_Staging_and_Testing_Page&oldid=41049&diff=cur

[sheep]

For better flow and practicality for users trying to follow the guide step by step, separate warnings, required knowledge to follow instructions, and keep any non vital to the minimum (throughout the specific instructions section that is). Also, I noticed a title that may need to be revised.

Specifically:

• Remove the “Preparation” section. Alternatively, place it at an earlier, introductory stage, perhaps as a link “Required knowledge to use this page”.
• In any case remove the reference to the variable used in Whonix 12. This perhaps was reasonable to include during the first months after the release of Whonix 13, quite outdated now.
• Instead of detailing the different ways to edit a text document, write “edit the following file” / “add the following content to …” / or “make sure the following file includes only”. Users who do not know how to edit a text document in Linux will probably not get to attempt such a complex setting anyway. If deemed important, have a general section about the different ways to do it in the “required knowledge” section I mentioned above (although I think this will be redundant there as well). I am aware that this point is consistent throughout the wiki. One step at a time
• Remove redundant information such as “don’t use ; for comments”. If users wish to deviate from the instructions they could do it in many different ways that we cannot anticipate, I don’t see a reason for this specific warning to appear here and not for others.
• I’m not clear why the section that directs the reader to “Hide Tor and Whonix from your ISP” was named “Setup time”.

[Patrick]

sheep via Whonix Forum:

For better flow and practicality for users trying to follow the guide step by step, separate warnings, required knowledge to follow instructions, and keep any non vital to the minimum (throughout the specific instructions section that is). Also, I noticed a title that may need to be revised.

Specifically:

• Remove the “Preparation” section. Alternatively, place it at an earlier, introductory stage, perhaps as a link “Required knowledge to use this page”.

Not sure I am getting this wrong. Let’s see. An “Required knowledge to
use this page” we wanted to avoid. Pages should be written with the user
in mind. As little to none “but look this other page first” as possible.
Each page would be standalone which a user can follow from top to bottom.

• In any case remove the reference to the variable used in Whonix 12. This perhaps was reasonable to include during the first months after the release of Whonix 13, quite outdated now.

Sounds good.

• Instead of detailing the different ways to edit a text document, write “edit the following file” / “add the following content to …” / or “make sure the following file includes only”.

I am sure by not using our templates on how to do that we’ll have users
who are going to ask how to do that. The fewest support requests are
received by giving users as much as copy/paste as possible.

Users who do not know how to edit a text document in Linux will probably not get to attempt such a complex setting anyway.

They do… A number of users make their first experiences with Linux by
using Whonix.

If deemed important, have a general section about the different ways to do it in the “required knowledge” section I mentioned above (although I think this will be redundant there as well). I am aware that this point is consistent throughout the wiki. One step at a time

Hm, I see the point. A million times
https://www.whonix.org/wiki/Template:Open_with_root_rights on the some
page could be handled in better ways. Perhaps just once and then a
simpler version that assumes that knowledge for subsequent use.

Opinions?

• Remove redundant information such as “don’t use ; for comments”.

I remember there was a user who did exactly that and then complained we
didn’t have that documented.

If users wish to deviate from the instructions they could do it in many different ways that we cannot anticipate,

Indeed.

I don’t see a reason for this specific warning to appear here and not for others.

Yes. A single user’s mistake doesn’t need to be carried forward as
legacy until doomsday.

• I’m not clear why the section that directs the reader to “Hide Tor and Whonix from your ISP” was named “Setup time”.

Indeed.

[0brand]

• In any case remove the reference to the variable used in Whonix 12. This perhaps was reasonable to include during the first months after the release of Whonix 13, quite outdated now.

Sounds good.

Will be removed.

If deemed important, have a general section about the different ways to do it in the “required knowledge” section I mentioned above (although I think this will be redundant there as well). I am aware that this point is consistent throughout the wiki. One step at a time

Hm, I see the point. A million times
https://www.whonix.org/wiki/Template:Open_with_root_rights on the some
page could be handled in better ways. Perhaps just once and then a
simpler version that assumes that knowledge for subsequent use.

Opinions?

Its a good idea. Make sure the users know that unless instructed otherwise “edit with root rights” is needed when editing files.

• Remove redundant information such as “don’t use ; for comments”.

I remember there was a user who did exactly that and then complained we
didn’t have that documented.

A few users IIRC. Uness otherwise instructed I’ll keep that part and clean the language up a bit i.e. compromise

• I’m not clear why the section that directs the reader to “Hide Tor and Whonix from your ISP” was named “Setup time”.

Indeed.

I’ll rename

---

Added to top of this thread (my to dos’)

Edits To Do:

• Remove the reference to the variable used in Whonix 12.
• Instructions to edit with root rights mentioned once. Then use simple edit file instruction for all step afterwords.
• Don’t use “;” for comments can be cleaned up a bit. Better wording.
• Change subheading “Setup Time” to more appropriate heading.

Thanks for the feed back sheep! More please!

[sheep]

Each page would be standalone which a user can follow from top to bottom.

I think that’s a good principle. But is the “Preparation” section consistent with this approach?

First, it asks the user who arrived to the page with the intention of performing this setup to actually stop what he’s doing, and move to a learning / research task, not even within Whonix.

Second, some information there is very specific while the rest is more general. For example, point 2 is:

2. Install the Debian OpenVPN package: sudo apt-get install openvpn

Should the user run sudo apt-get update first? if we are dealing with a non-technical user, should we mention the above it typed in a terminal window? Doesn’t this point already included in point 3 anyway (“research how to setup a VPN using OpenVPN on the command line”).

Finally, while I agree this knowledge is required and the exercise can be very helpful to a user, I don’t think it should be recommended here, if only because it can introduce new issues. Setting up and testing a separate Debian VM with a connection that doesn’t go through Tor may defeat the purpose of the tunneling (admittedly this remark is more valid for the case of Tor before VPN, where the VPN is possibly never accessed without Tor, and doesn’t possess the IP of the user at any point).

I would either remove this section completely or reduce it to a one-liner in the introduction, for example: “Before attempting this setup, it is strongly recommended to learn how to set up OpenVPN on Debian stable (currently stretch)”.

[0brand]

Hi sheep

Each page would be standalone which a user can follow from top to bottom.

I think that’s a good principle. But is the “Preparation” section consistent with this approach?

Yes and No. Its not ideal but it (hopefully) makes the user stop for a second and think about what they are doing.

1. Do I know what I’m doing?
2. Should I research this a little more before preceding i.e. test in a Debian VM before going any further.

Plus the prep instructions are not to install in Whonix so every step is not needed.

2. Install the Debian OpenVPN package: sudo apt-get install openvpn

Should the user run sudo apt-get update first? if we are dealing with a non-technical user, should we mention the above it typed in a terminal window? Doesn’t this point already included in point 3 anyway (“research how to setup a VPN using OpenVPN on the command line”).

We are not giving full instructions to update/upgrade and install openvpn in Debian. Just a little guidance. To me these steps seem to be in logical order so I don’t see a problem.

Finally, while I agree this knowledge is required and the exercise can be very helpful to a user, I don’t think it should be recommended here, if only because it can introduce new issues. Setting up and testing a separate Debian VM with a connection that doesn’t go through Tor may defeat the purpose of the tunneling (admittedly this remark is more valid for the case of Tor before VPN, where the VPN is possibly never accessed without Tor, and doesn’t possess the IP of the user at any point).

Agreed, That is why that its mentioned in the Warings section.

• https://whonix.org/wiki/Wiki_Edits_Staging_and_Testing_Page#Reusing_Tunnel-links

I would either remove this section completely or reduce it to a one-liner in the introduction, for example: “Before attempting this setup, it is strongly recommended to learn how to set up OpenVPN on Debian stable (currently stretch)”.

It could use a little better wording. I’ll see what I can do.

Added to “Edits to do”

• Reword/simplfy Preparation step.

[0brand]

Connecting to SSH before Tor

https://whonix.org/w/index.php?title=Wiki_Edits_Staging_and_Testing_Page&oldid=41391&diff=cur

---

Also migrated all warning from Template:Tunnel_Introduction/Tunnel-link_before_Tor

htttps://whonix.org/w/index.php?title=Template:Tunnel_Introduction/Tunnel-link_before_Tor&stable=0

And moved them to Template:Tunnel-link_Warnings/Common.

https://whonix.org/w/index.php?title=Template:Tunnel-link_Warnings/Common&oldid=41359&diff=cur

[Patrick]

I was wondering about the page name. Why Wiki_Edits_Staging_and_Testing_Page?

Why not usual-page-name/staging (or even /testing for consistency with some other of our wiki pages)? I.e. https://www.whonix.org/wiki/Tunnels/Connecting_to_Tor_before_a_VPN/Testing?

Just a small point. Whatever enables you to work on this best. (Just wanted to mention: no worries about X extra (temporary) wiki pages.)

[Patrick]

https://www.whonix.org/wiki/Template:Tunnel-link_Warnings/Common#Hiding_Tor_Usage_from_ISPs applies to user -> tunnel-link -> Tor -> destination only.

[0brand]

Why not usual-page-name/staging (or even /testing for consistency with some other of our wiki pages)? I.e. https://www.whonix.org/wiki/Tunnels/Connecting_to_Tor_before_a_VPN/Testing ?

That would make more sense. Was only done like that to not create many temp wiki pages

I’ll move each chapter to its own wiki page.

https://www.whonix.org/wiki/Template:Tunnel-link_Warnings/Common#Hiding_Tor_Usage_from_ISPs applies to user -> tunnel-link -> Tor -> destination only.

Oopps. Thanks for pointing that out. I’ll find a new place for that. Maybe just add by itself to each Connect to tunnel-link before Tor page.

Added to Edits to Do

• Move each chapter to its own temp wiki page.
• Remove Hiding Tor Usage from ISPs Warninga from Template:Warings/Common. Add to each Connecting to tunnel-link before Tor page.