Actions

Using corridor, a Tor traffic whitelisting gateway with Whonix ™

From Whonix



Corridor.jpg

Introduction[edit]

corridor [archive] is a Tor traffic whitelisting gateway. It is a filtering gateway, not a proxying gateway and can also be configured as a BridgeFirewall [archive].

Connecting to corridor before Tor[edit]

Introduction[edit]

Info corridor configurations are only possible in Qubes-Whonix ™. Non-Qubes-Whonix ™ is unsupported at present. [1] [2]

It is possible to configure Whonix-Gateway ™ (sys-whonix) to use corridor as a local proxy to establish the following tunnel:
User → corridor → Tor → Internet

This is not necessarily more anonymous, but it does provide an additional fail-safe -- a Tor traffic whitelisting firewall that helps protect against accidental clearnet leaks (hypothetical clearnet leak bugs in Whonix ™). As corridor's project description [archive] states: "... it cannot prevent malware on a client computer from finding out your clearnet IP address."

corridor is mostly useful for developers and auditors of Whonix ™, along with advanced users who would like to have an additional safety net. Note that it cannot protect from hypothetical bugs affecting Qubes' ProxyVM; a physically-isolated, standalone corridor-Gateway [archive] is necessary to cover that leak vector.

corridor does not increase the tunnel length, meaning no more relays are added between a user and the destination. Users interested in this configuration should read Tunnels/Introduction.

Warning[edit]

Ambox warning pn.svg.png By default, the following instructions will result in:

  1. The Debian tor package [archive] being installed.
  2. Thereby automatically connecting to the Tor [archive] public network.
  3. Downloading of corridor from Project-APT-Repository.

This behavior might be dangerous if users need / want to hide Tor and Whonix ™ from the ISP.

If Whonix ™ is already in use, then configuring a second running instance of Tor will ensure that it is independent of the one running inside Whonix-Gateway ™ (sys-whonix). From the ISP's perspective, the user will have a different network Fingerprint. The anonymity impact should be no worse than running Tor Browser, or system-tor and Whonix ™ at the same time.

dom0 Setup[edit]

Create a new standalone ProxyVM called sys-corridor based on the Debian buster template:

Qube Manager → Create new Qube → enable 'Standalone qube based on a template' → name: sys-corridor → template: debian → OK

Enable the corridor qvm service:

Qube Manager → left-click sys-corridor → right-click → Qube settings → services → type in the field → corridor → press + → press OK

sys-corridor Setup[edit]

If a BridgeFirewall is required, first configure Tor to use bridges before installing corridor. All the following steps should be applied in Qubes' [archive] Debian template [archive].

Install corridor[edit]

Start sys-corridor and open a terminal using Qubes start menu.

Complete the following steps to add the Whonix ™ Signing Key to the system's APT keyring.

Open a terminal.

Install curl, gpg, gpg-agent. [3]

Install curl gpg gpg-agent.

1. Update the package lists. 

sudo apt-get update

2. Upgrade the system. 

sudo apt-get dist-upgrade

3. Install the curl gpg gpg-agent package.

Using apt-get command line parameter --no-install-recommends is in most cases optional. 

sudo apt-get install --no-install-recommends curl gpg gpg-agent

The procedure of installing curl gpg gpg-agent is complete.

Download Whonix ™ Signing Key. [4]

If you are using a Qubes TemplateVM, run. 

curl --proxy http://127.0.0.1:8082/ --tlsv1.3 --proto =https --max-time 180 --output ~/patrick.asc https://www.whonix.org/patrick.asc

If you are using Debian, run. 

curl --tlsv1.3 --proto =https --max-time 180 --output ~/patrick.asc https://www.whonix.org/patrick.asc

Users can check Whonix ™ Signing Key for better security.

Add Whonix ™ signing key to APT trusted keys. 

sudo apt-key --keyring /etc/apt/trusted.gpg.d/derivative.gpg add ~/patrick.asc

The procedure of adding Whonix ™ signing key is now complete.

Add Whonix ™ Repository.

Choose either: Option A, Option B OR Option C.

Option A: Add Whonix ™ Onion Repository.

To add Whonix ™ Repository over Onion please press on expand on the right.

Install apt-transport-tor from the Debian repository. 

sudo apt-get install apt-transport-tor

Add Whonix's APT repository for default Whonix using Debian stable. At the time of writing this was buster. 

echo "deb tor+http://deb.dds6qkxpwdeubwucdiaord2xgbbeyds25rbsgr73tbfpqpt4a6vjwsyd.onion buster main contrib non-free" | sudo tee /etc/apt/sources.list.d/derivative.list

Option B: Add Whonix ™ Clearnet Repository over Tor.

To add Whonix ™ Repository over torified clearnet please press on expand on the right.

Install apt-transport-tor from the Debian repository. 

sudo apt-get install apt-transport-tor

Add Whonix's APT repository for default Whonix using Debian stable. At the time of writing this was buster. 

echo "deb tor+https://deb.Whonix.org buster main contrib non-free" | sudo tee /etc/apt/sources.list.d/derivative.list

Option C: Add Whonix Clearnet Repository over clearnet.

To add Whonix ™ Repository over clearnet please press on expand on the right.

Add Whonix's APT repository for default Whonix using Debian stable. At the time of writing this was buster. 

echo "deb https://deb.Whonix.org buster main contrib non-free" | sudo tee /etc/apt/sources.list.d/derivative.list

Install corridor.

Install corridor.

1. Update the package lists. 

sudo apt-get update

2. Upgrade the system. 

sudo apt-get dist-upgrade

3. Install the corridor package.

Using apt-get command line parameter --no-install-recommends is in most cases optional. 

sudo apt-get install --no-install-recommends corridor

The procedure of installing corridor is complete.

Configuration[edit]

Optional: BridgeFirewall corridor Configuration[edit]

TODO: BridgeFirewall corridor configuration is currently untested.

Info "Bridges are less reliable and tend to have lower performance than other entry points. If you live in a uncensored area, they are not necessarily more secure than entry guards." [5]

In order to use corridor as a BridgeFirewall [archive], configure Tor to use bridges [archive] before installing corridor. [6] {{Box|text= 1. Start sys-corridor and open a terminal using Qubes start menu.
2. Create folder /etc/corridor.d and configuration file /etc/corridor.d/21-bridges-user.conf first. [7]
3. Create a bridges configuration file.

Open file /etc/corridor.d/21-bridges-user.conf in an editor with root rights.

(Qubes-Whonix ™: In TemplateVM)

This box uses sudoedit for better security [archive]. This is an example and other tools could also achieve the same goal. If this example does not work for you or if you are not using Whonix, please refer to this link. 

sudoedit /etc/corridor.d/21-bridges-user.conf

4. Review Whonix-Gateway ™ (sys-whonix) Tor bridge settings.

Depending on how Tor bridges are configured on Whonix-Gateway ™ (sys-whonix):

5. Add the following text. [8]

Syntax is similar as Tor configuration as reviewed in previous step. Replace the IPs and ports 1.2.3.4:443, 2.3.4.5:443 with the actual IPs and ports of the bridges in use. All Tor bridges from Tor configuration on Whonix-Gateway ™ (sys-whonix) need to be added below too. 

BRIDGES="\
Bridge 1.2.3.4:443
Bridge 2.3.4.5:443
Bridge 3.4.5.6:443
"

Save.

6. Done.

BridgeFirewall corridor configuration is complete.

Daemon Status Test[edit]

While these instructions remain experimental, it is advised to run the following systemctl commands to check everything is functioning correctly. 

sudo systemctl --no-pager status corridor-data
sudo systemctl --no-pager status corridor-init-forwarding 
sudo systemctl --no-pager status corridor-init-logged 
sudo systemctl --no-pager status corridor-init-snat

Restart corridor[edit]

Reboot sys-corridor.

Do another Daemon Status Test.

Test corridor[edit]

Test Preparation[edit]

  1. Run the above systemctl commands again.
  2. Create or use an appropriate existing AppVM named corridor-client (or similar).
  3. Install / run either system-tor (from Debian or Fedora package sources) or Tor Browser.
  4. Set Networking of corridor-client to sys-corridor. Tor should be still able to connect.

Testing Steps[edit]

Run a Tor log analysis.

Then restart Tor. 

sudo service tor restart

Check if Tor is still able to connect.

To test Tor Browser:

  1. First check Tor Browser can make an initial connection to the Internet while Networking is still set to sys-firewall.
  2. Next set Networking to sys-corridor and confirm it is still able to connect. If so, that is a positive sign.
  3. Finally attempt an untorified connection by using an application like Chromium or Firefox browser. Untorified applications should fail to connect to the Internet.

Test Logging[edit]

Whenever corridor blocks attempted actions (like the tests above), a message will appear in syslog. To inspect /var/log/syslog

Open file /var/log/syslog in an editor with root rights.

(Qubes-Whonix ™: In TemplateVM)

This box uses sudoedit for better security [archive]. This is an example and other tools could also achieve the same goal. If this example does not work for you or if you are not using Whonix, please refer to this link. 

sudoedit /var/log/syslog

To check for blocks inside sys-corridor, run. 

sudo tail -f /var/log/syslog

If corridor blocks anything, the output will be similar to this. 

Jul 19 00:58:27 localhost kernel: [  954.706833] corridor:

Interpreting the Results[edit]

The safest configuration is only setting sys-whonix to use sys-corridor for Networking. The reason is the qubes-update-check.service [archive] will try to use the Internet without Tor, and other programs [archive] may also try to use clearnet. Therefore, always shut down corridor-client.

Configure sys-whonix[edit]

To set Networking of sys-whonix to sys-corridor:

Qube Manager → left-click sys-whonix → right-click → Qube settings → Networking → sys-corridor → OK

The procedure is now complete.

Debugging[edit]

If problems are encountered, this section provides tips on gathering useful information for debugging.

It is also possible to ignore everything said on this website. Pretend it does not exist. Then acquire corridor from its original upstream [archive] and contact upstream for support [archive].

Check if the corridor_relays ipset gets populated. 

sudo ipset list corridor_relays

It is recommended to also install the usability-misc package from Whonix ™ repository, since it provides the iptables-save-deterministic command. Alternatively, retrieve the package from elsewhere. 

sudo apt-get install usability-misc

Run iptables-save-deterministic. 

sudo iptables-save-deterministic

In Qubes, the output should be similar to the following. 

*nat
:PREROUTING ACCEPT [0,0]
:INPUT ACCEPT [0,0]
:OUTPUT ACCEPT [0,0]
:POSTROUTING ACCEPT [0,0]
:CORRIDOR_SNAT - [0,0]
-A POSTROUTING -j CORRIDOR_SNAT
-A CORRIDOR_SNAT -s 10.137.0.0/16 ! -d 10.137.0.0/16 -j MASQUERADE
COMMIT
*filter
:INPUT ACCEPT [0,0]
:FORWARD ACCEPT [0,0]
:OUTPUT ACCEPT [0,0]
:CORRIDOR_FILTER - [0,0]
-A FORWARD -j CORRIDOR_FILTER
-A CORRIDOR_FILTER -m conntrack --ctstate RELATED,ESTABLISHED -j RETURN
-A CORRIDOR_FILTER -m set --match-set corridor_relays dst,dst -j RETURN
-A CORRIDOR_FILTER -m set --match-set corridor_logged src -j LOG --log-prefix "corridor: reject " --log-macdecode
-A CORRIDOR_FILTER -j REJECT --reject-with icmp-host-prohibited
COMMIT

Credits[edit]

The author of corridor is rustybird [archive]. Patrick Schleizer [archive] is the author of the corridor for Debian [archive] fork [archive] used in these Whonix ™ instructions.

Footnotes[edit]

  1. ↑ Corridor for Whonix ™ KVM ticket [archive].
  2. ↑ Without third party contributions to corridor, Non-Qubes-Whonix ™ is unlikely to be supported in the near future.
  3. ↑ gpg is required by apt-key. gpg-agent is required due to the following error message. 
    sudo apt-key --keyring /etc/apt/trusted.gpg.d/derivative.gpg add ~/patrick.asc

    gpg: failed to start agent '/usr/bin/gpg-agent': No such file or directory
gpg: can't connect to the agent: No such file or directory
  4. ↑ See Secure Downloads to understand why curl and the parameters --tlsv1.3 --proto =https are used instead of wget.
  5. ↑ bridge vs non-bridge users anonymity [archive].
  6. ↑ The Whonix ™ Bridges page can help, but the steps do not apply one-to-one.
  7. ↑ This skip is stepped if Tor entry guards [archive] are preferred.
  8. ↑ https://github.com/rustybird/corridor/issues/42 [archive]
Fosshost is sponsors Kicksecure stage server Whonix old logo.png
Fosshost About Advertisements

Search engines: YaCy | Qwant | ecosia | MetaGer | peekier | Whonix ™ Wiki

Follow: 1024px-Telegram 2019 Logo.svg.png Iconfinder Apple Mail 2697658.png Twitter.png Facebook.png Rss.png Reddit.jpg 200px-Mastodon Logotype (Simple).svg.png

Support: 1024px-Telegram 2019 Logo.svg.png Discourse logo.png Matrix logo.svg.png

Donate: Donate Bank Wire Paypal Bitcoin accepted here Monero accepted here Contriute

Whonix donate bitcoin.png Monero donate Whonix.png United Federation of Planets 1000px.png

Twitter-share-button.png Facebook-share-button.png Telegram-share.png Iconfinder Apple Mail 2697658.png Reddit.jpg Hacker.news.jpg 200px-Mastodon Logotype (Simple).svg.png

Are you proficient with iptables? Want to contribute? Check out possible improvements to iptables. Please come and introduce yourself in the development forum.

https link onion link Priority Support | Investors | Professional Support

Whonix ™ | © ENCRYPTED SUPPORT LP | Heckert gnu.big.png Freedom Software / Osi standard logo 0.png Open Source (Why?)

The personal opinions of moderators or contributors to the Whonix ™ project do not represent the project as a whole.

Retrieved from "https://www.whonix.org/w/index.php?title=Corridor&oldid=65454"
By using our website, you acknowledge that you have read, understood and agreed to our Privacy Policy, Cookie Policy, Terms of Service, and E-Sign Consent.
More information