Dev/Network Manager

From Whonix

< Dev

Network Manager[edit]

Whonix ™ first time users warning This page is out of date.

Whonix ™ first time users warning At time of writing, Qubes(-Whonix ™) does not use ifupdown, but Qubes custom implementation.

It would be desirable to have a graphical network manager installed in Whonix-Workstation ™. There are a few main use cases. Changing Whonix-Workstation ™ internal IP address for Multiple Whonix-Workstation ™, setting up a post-Tor-VPN using a graphical user interface and other kinds of advanced network configurations over Tor which are simpler to set up using a grapical user interface.

At the moment networking still managed by the ordinary ifupdown way. (Template:Network_Config)

If you want to install the KDE Network Manager.

sudo apt-get install network-manager-kde

Then it can be started from the Start Menu.

Start menu → System Settings → Network Settings

You won't see Whonix ™ internal network interface right away. You could make it visible in Network Manger, by editing /etc/NetworkManager/NetworkManager.conf and setting managed to true.



That would be quite useful, if changing settings where possible. However, the NetworkManager.conf man page says, write support for ifupdown managed devices is not planned.

The Fedora wiki has a nice page about Network Manager which is useful for a distro packager perspective.

Quote: "NM is slowly changing from a desktop network connection configurator to a universal network configuration software that could be used as a part of the base system."

Once NM can do everything ifupdown can do (i.e. suitable for all tasks also from command line), ifupdown in Whonix ™ could get completely replaced with NM.

Since IPv6 support in NM is said to be not in a production state yet, I am hesitate to switch to NM. Tor recently added support for IPv6 bridges and full IPv6 support could come in future. If Tor fixes IPv6 support first, there would eventually still (again) need for ifupdown. Therefore I think at the moment it is best to let NM mature.

For running NM on Whonix-Gateway ™ it would be required to check if the pre-up hook to start the firewall works flawless. Having a pre-up hook which fails closed like ifupdown currently provides is desirable, because when there is a tiny syntax error in the firewall, the network won't come up and nothing leaks. Alternatively, an init.d script could be developed, it would have to be researched, if it can provide the same fail closed protections.

Since many people are interested in post-Tor-VPNs (user → Tor → VPN), it is open for debate if network-manager-kde should be pre-installed on Whonix-Workstation ™. Would the user be confused because it won't show the (virtual) wired internal network interface? Would it be less/more confusing if the (virtual) wired internal network interface where shown but impossible to edit? Shouldn't it be pre-installed for these confusion reasons and recommended to be installed manually for users interested in post-Tor-VPNs?

As a footnote, it is also possible to use Gnome applications in Whonix ™ (KDE based), such as Gnome Network Manager chapter on TestVPN page.


"Please also understand that currently networkmanager is not a security tool at all. VPN plugins are regarded as connectivity plugins, not security plugins."

Missing auto-reconnect feature:

So perhaps using NM to set up VPNs for security is not a good idea.

Doesn't look like NM has a fail closed mechanism: VPN-Firewall

[advertisement] Looking to Sell Your Company? Contact me.

Are you proficient with iptables? Want to contribute? Check out possible improvements to iptables. Please come and introduce yourself in the development forum.

https | (forcing) onion
Follow: Twitter.png Facebook.png 1280px-Gab text logo.svg.png Rss.png 1024px-Telegram 2019 Logo.svg.png

Share: Twitter | Facebook

This is a wiki. Want to improve this page? Help is welcome and volunteer contributions are happily considered! Read, understand and agree to Conditions for Contributions to Whonix ™, then Edit! Edits are held for moderation.

Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP. Whonix ™ is a trademark. Whonix ™ is a licensee of the Open Invention Network. Unless otherwise noted, the content of this page is copyrighted and licensed under the same Freedom Software license as Whonix ™ itself. (Why?)

Whonix ™ is a derivative of and not affiliated with Debian. Debian is a registered trademark owned by Software in the Public Interest, Inc.

Whonix ™ is produced independently from the Tor® anonymity software and carries no guarantee from The Tor Project about quality, suitability or anything else.

By using our website, you acknowledge that you have read, understood and agreed to our Privacy Policy, Cookie Policy, Terms of Service, and E-Sign Consent. Whonix ™ is provided by ENCRYPTED SUPPORT LP. See Imprint.