From Template:Firewall_Settings:
``> sudo nano /etc/whonix_firewall.d/50_user.conf
Content duplicated at both Connecting_to_a_VPN_before_Tor and Using_Tunnels_with_Whonix:
> 2. Add the following settings. ...
> ###########################
> ## VPN-Firewall Settings ##
> ###########################
``- de-dup content by making it into a wiki template section as Template:Firewall_Settings is?
Having made a 50_user.conf file as per wiki / text contents, with the following (active content) changed / lines:
VPN_FIREWALL=0
VPN_SERVERS=“198.252.153.26”
VPN_INTERFACE=tun0
; LOCAL_NET=“192.168.1.0/24 192.168.0.0/24 127.0.0.0/8 10.152.152.0/24 10.0.2.2/24”
… result … no -gateway network / tor at reboot.
Move file up a level temporarily, reboot, network / tor functional again.
Apparently
``> VPN_FIREWALL=0
isn’t being adhered to, despite wiki article’s comments indicating 0 = disable vpn firewall. i.e. Same default as if not set / file not present.
``- feels like a bug.
Note:
VPN_SERVERS="198.252.153.26"
VPN_INTERFACE=tun0
``- left unchanged from wiki text. Since VPN_FIREWALL=0 set, settings weren’t expected to be adhered to / impact anything.
; LOCAL_NET="192.168.1.0/24 192.168.0.0/24 127.0.0.0/8 10.152.152.0/24 10.0.2.2/24"
- is the wiki text with a comment (;)
character in front.
Could the wiki text be updated to indicate that ‘;’ is/n’t (also?) a valid commenting character?
e.g. '```## ; may also|not be used as a comment indicator
’`
In any case, perhaps something after the
``VPN_FIREWALL=0
line above is being processed when it shouldn’t be. Either code is not checking for VPN_FIREWALL=0 at each setting, or lines post VPN_FIREWALL=0 are not being turfed unless/until a VPN_FIREWALL=1 entry is encountered.
How I got here: Having come across the code in reading through the wiki, I popped the file in (‘neutered’) in preparation for attempting vpn at some later time. I expected VPN_FIREWALL=0 to render all to defaults per wiki coded comments, as though the file were not present at all.
(Being somewhat familiar with OpenVPN), I do expect VPN_INTERFACE=tun0 will be accurate, so left it alone. The need to change VPN_SERVERS would be intuitively obvious to change when I got to the point of going back in to turn VPN on. I commented out (with ‘;’) LOCAL_NET … knowing I would have to figure out entries correct for my particular environment when I got that far. Not being certain that the example line would be 100% accurate then, I just commented the line out.
Summary:
VPN_FIREWALL=0
- breaks networking / doesn’t do the expected (at least per wiki comments).
Arguably, someone making such a change and rebooting would be able to correlate cause and effect, reverse, and reboot - however, if one made more than one change before rebooting, they could spend a great deal of time playing hunt the wumpus before cottoning on to the specific cause and effective impact. With the net (and thus ability to peruse the wiki) down at the time. And, if they thought to reboot to effect the change, upon reversal.
Thus, additional suggestion: add to the wiki how to effect/reverse the change without rebooting (in the wiki affected articles).
``- firewall restart of #whonix_firewall (as per Dev/Build_Documentation/0.3.0 didn’t do it.