Using corridor, a Tor traffic whitelisting gateway with Whonix ™
From Whonix
Introduction[edit]
corridor is a Tor traffic whitelisting gateway. It is a filtering gateway, not a proxying gateway and can also be configured as a BridgeFirewall.
Connecting to corridor before Tor[edit]
Introduction[edit]
corridor configurations are only possible in Qubes-Whonix ™. Non-Qubes-Whonix ™ is unsupported at present. [1] [2]
It is possible to configure Whonix-Gateway ™ (sys-whonix) to use corridor as a local proxy to establish the following tunnel:
User → corridor → Tor > Internet
This is not necessarily more anonymous, but it does provide an additional fail-safe -- a Tor traffic whitelisting firewall that helps protect against accidental clearnet leaks (hypothetical clearnet leak bugs in Whonix ™). As corridor's project description states: "... it cannot prevent malware on a client computer from finding out your clearnet IP address."
corridor is mostly useful for developers and auditors of Whonix ™, along with advanced users who would like to have an additional safety net. Note that it cannot protect from hypothetical bugs affecting Qubes' ProxyVM; a physically-isolated, standalone corridor-Gateway is necessary to cover that leak vector.
corridor does not increase the tunnel length, meaning no more relays are added between a user and the destination. Users interested in this configuration should read Tunnels/Introduction.
Warning[edit]
By default, the following instructions will result in:
- The Debian tor package being installed.
- Thereby automatically connecting to the Tor public network.
- Downloading of corridor from Whonix-APT-Repository.
This behavior might be dangerous if users need / want to hide Tor and Whonix ™ from the ISP.
If Whonix ™ is already in use, then configuring a second running instance of Tor will ensure that it is independent of the one running inside Whonix-Gateway ™ (sys-whonix). From the ISP's perspective, the user will have a different network Fingerprint. The anonymity impact should be no worse than running Tor Browser, or system-tor and Whonix ™ at the same time.
dom0 Setup[edit]
Create a new standalone ProxyVM called sys-corridor based on the Debian-9 template:
Qube Manager → Create new Qube → enable 'Standalone qube based on a template' → name: sys-corridor → template: debian-9 → OK
Enable the corridor qvm service:
Qube Manager → left-click sys-corridor → right-click → Qube settings → services → type in the field → corridor → press + → press OK
sys-corridor Setup[edit]
If a BridgeFirewall is required, first configure Tor to use bridges before installing corridor. All the following steps should be applied in Qubes' Debian template.
Install corridor[edit]
Start sys-corridor and open a terminal using Qubes start menu.
Complete the following steps to add the Whonix Signing Key to the system's APT keyring. [3]
Open a terminal.
Install curl.
Update the package lists.
sudo apt-get update
Upgrade the system.
sudo apt-get dist-upgrade
Install the curl package.
sudo apt-get install curl
The procedure is complete.
Download Whonix signing key.
If you are using a Qubes TemplateVM, run.
curl --proxy http://127.0.0.1:8082/ --tlsv1.2 --proto =https --max-time 180 --output ~/patrick.asc https://www.whonix.org/patrick.asc
If you are using Debian, run.
curl --tlsv1.2 --proto =https --max-time 180 --output ~/patrick.asc https://www.whonix.org/patrick.asc
Users can check Whonix Signing Key for better security.
Add Whonix signing key to APT trusted keys.
sudo apt-key --keyring /etc/apt/trusted.gpg.d/whonix.gpg add ~/patrick.asc
The procedure of adding Whonix signing key is now complete.
Add Whonix ™ Repository.
Choose either, Option A, Option B, OR Option C.
Option A: Add Whonix ™ Onion Repository.
To add Whonix ™ Repository over Onion please press on expand on the right.
Install apt-transport-tor from the Debian repository.
sudo apt-get install apt-transport-tor
Add Whonix's APT repository for default Whonix using Debian stable. At the time of writing this was stretch.
echo "deb tor+http://deb.Whonix.org stretch main contrib non-free" | sudo tee /etc/apt/sources.list.d/whonix.list
Option B: Add Whonix ™ Clearnet Repository over Tor.
To add Whonix ™ Repository over torified clearnet please press on expand on the right.
Install apt-transport-tor from the Debian repository.
sudo apt-get install apt-transport-tor
Add Whonix's APT repository for default Whonix using Debian stable. At the time of writing this was stretch.
echo "deb tor+http://deb.dds6qkxpwdeubwucdiaord2xgbbeyds25rbsgr73tbfpqpt4a6vjwsyd.onion stretch main contrib non-free" | sudo tee /etc/apt/sources.list.d/whonix.list
Option C: Add Whonix ™ Clearnet Repository over clearnet.
To add Whonix ™ Repository over clearnet please press on expand on the right.
Add Whonix's APT repository for default Whonix using Debian stable. At the time of writing this was stretch.
echo "deb http://deb.Whonix.org stretch main contrib non-free" | sudo tee /etc/apt/sources.list.d/whonix.list
Install corridor.
Update the package lists.
sudo apt-get update
Upgrade the system.
sudo apt-get dist-upgrade
Install the corridor package.
sudo apt-get install corridor
The procedure is complete.
While these instructions remain experimental, it is advised to run the following systemctl commands to check everything is functioning correctly.
sudo systemctl --no-pager status corridor-data sudo systemctl --no-pager status corridor-init-forwarding sudo systemctl --no-pager status corridor-init-logged sudo systemctl --no-pager status corridor-init-snat
Reboot sys-corridor.
Optional: BridgeFirewall corridor Configuration[edit]
"Bridges are less reliable and tend to have lower performance than other entry points. If you live in a uncensored area, they are not necessarily more secure than entry guards." [4]
In order to use corridor as a BridgeFirewall, configure Tor to use bridges before installing corridor. [5]
1. Start sys-corridor and open a terminal using Qubes start menu.
2. Create folder /etc/corridor.d and configuration file /etc/corridor.d/21-bridges-user.conf first. [6]
3. Create a bridges configuration file.
Open /etc/corridor.d/21-bridges-user.conf in an editor with root rights.
If you are using a graphical Whonix or Qubes-Whonix ™ with KDE, run.
kdesudo kwrite /etc/corridor.d/21-bridges-user.conf
If you are using a graphical Whonix or Qubes-Whonix ™ with XFCE, run.
kdesudo mousepad /etc/corridor.d/21-bridges-user.conf
If you are using a terminal-only Whonix, run.
sudo nano /etc/corridor.d/21-bridges-user.conf
4. Add the following text. (Syntax: like torrc) [7]
TODO: This step is currently untested.
BRIDGES="\ Bridge 1.2.3.4:443 Bridge 2.3.4.5:443 "
Save.
Test corridor[edit]
Test Preparation[edit]
- Run the above systemctl commands again.
- Create or use an appropriate existing AppVM named
corridor-client(or similar). - Install / run either system-tor (from Debian or Fedora package sources) or Tor Browser.
- Set the NetVM of
corridor-clienttosys-corridor. Tor should be still able to connect.
Testing Steps[edit]
To test system-tor, start watching Tor's log.
sudo tail -f /var/log/tor/log
Check if it made an initial, successful connection.
Then restart Tor.
sudo service tor restart
Check if Tor is still able to connect.
To test Tor Browser:
- First check Tor Browser can make an initial connection to the Internet while the NetVM is still set to
sys-firewall. - Next set the NetVM to
sys-corridorand confirm it is still able to connect. If so, that is a positive sign. - Finally attempt an untorified connection by using an application like Chromium or Firefox browser. Untorified applications should fail to connect to the Internet.
Test Logging[edit]
Whenever corridor blocks attempted actions (like the tests above), a message will appear in syslog. To inspect /var/log/syslog
Open /var/log/syslog in an editor.
If you are using a graphical environment, run.
kwrite /var/log/syslog
If you are using a terminal (Konsole), run.
nano /var/log/syslog
To check for blocks inside sys-corridor, run.
sudo tail -f /var/log/syslog
If corridor blocks anything, the output will be similar to this.
Jul 19 00:58:27 localhost kernel: [ 954.706833] corridor:
Interpreting the Results[edit]
The safest configuration is only setting sys-whonix to use sys-corridor as a NetVM. The reason is the qubes-update-check.service will try to use the Internet without Tor, and other programs may also try to use clearnet. Therefore, always shut down corridor-client.
Configure sys-whonix[edit]
To set the NetVM of sys-whonix to sys-corridor:
Qube Manager → left-click sys-whonix → right-click → Qube settings → NetVM → sys-corridor → OK
The procedure is now complete.
Debugging[edit]
If problems are encountered, this section provides tips on gathering useful information for debugging.
Check if the corridor_relays ipset gets populated.
sudo ipset list corridor_relays
It is recommended to also install the usability-misc package from Whonix ™ repository, since it provides the iptables-save-deterministic command. Alternatively, retrieve the package from elsewhere.
sudo apt-get install usability-misc
Run iptables-save-deterministic.
sudo iptables-save-deterministic
In Qubes, the output should be similar to the following.
*nat :PREROUTING ACCEPT [0,0] :INPUT ACCEPT [0,0] :OUTPUT ACCEPT [0,0] :POSTROUTING ACCEPT [0,0] :CORRIDOR_SNAT - [0,0] -A POSTROUTING -j CORRIDOR_SNAT -A CORRIDOR_SNAT -s 10.137.0.0/16 ! -d 10.137.0.0/16 -j MASQUERADE COMMIT *filter :INPUT ACCEPT [0,0] :FORWARD ACCEPT [0,0] :OUTPUT ACCEPT [0,0] :CORRIDOR_FILTER - [0,0] -A FORWARD -j CORRIDOR_FILTER -A CORRIDOR_FILTER -m conntrack --ctstate RELATED,ESTABLISHED -j RETURN -A CORRIDOR_FILTER -m set --match-set corridor_relays dst,dst -j RETURN -A CORRIDOR_FILTER -m set --match-set corridor_logged src -j LOG --log-prefix "corridor: reject " --log-macdecode -A CORRIDOR_FILTER -j REJECT --reject-with icmp-host-prohibited COMMIT
Credits[edit]
The author of corridor is rustybird. Patrick Schleizer is the author of the corridor for Debian fork used in these Whonix ™ instructions.
Footnotes[edit]
- ↑ Corridor for Whonix ™ KVM ticket.
- ↑ Without third party contributions to corridor, Non-Qubes-Whonix ™ is unlikely to be supported in the near future.
- ↑
The following is unreliable due to gpg connectivity bugs.
This will hopefully be fixed in Debian buster.
sudo apt-key --keyring /etc/apt/trusted.gpg.d/whonix.gpg adv --keyserver hkp://ipv4.pool.sks-keyservers.net:80 --recv-keys 916B8D99C38EAF5E8ADC7A2A8D66066A2EEACCDA
- ↑ bridge vs non-bridge users anonymity.
- ↑ The Whonix ™ Bridges page can help, but the steps do not apply one-to-one.
- ↑ This skip is stepped if Tor entry guards are preferred.
- ↑ https://github.com/rustybird/corridor/issues/42
No comments for now due to spam. Use Whonix forums instead.
Want to make Whonix safer and more usable? We're looking for helping hands. Check out the Open Issues and development forum.
This is a wiki. Want to improve this page? Help is welcome and volunteer contributions are happily considered! Read, understand and agree to Conditions for Contributions to Whonix ™, then Edit! Edits are held for moderation.
Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP. Whonix ™ is a trademark. Whonix ™ is a licensee of the Open Invention Network. Unless otherwise noted, the content of this page is copyrighted and licensed under the same Freedom Software license as Whonix ™ itself. (Why?)
Whonix ™ is a derivative of and not affiliated with Debian. Debian is a registered trademark owned by Software in the Public Interest, Inc.
Whonix ™ is produced independently from the Tor® anonymity software and carries no guarantee from The Tor Project about quality, suitability or anything else.
By using our website, you acknowledge that you have read, understood and agreed to our Privacy Policy, Cookie Policy, Terms of Service, and E-Sign Consent. Whonix ™ is provided by ENCRYPTED SUPPORT LP. See Imprint.