How-to: "UnWhonix" - using clearnet networking

From Whonix
< Dev
Jump to navigation Jump to search

Using clearnet networking for Whonix-Gateway and/or Whonix-Workstation / Curl Clearnet Connectivity Test from Whonix-Gateway.

This is mostly for developers only!

The clearnet User[edit]

The clearnet user is a special user account on the Whonix-Gateway that is designed to bypass Tor for specific purposes. Unlike the default user account user, which routes all traffic through Tor, the clearnet user has direct access to the internet without anonymization.

Key points about the clearnet user:

  • Purpose: It allows certain applications or services to connect directly to the internet when necessary, such as for the SSH connection in this setup.
  • Security considerations: Traffic from the clearnet user is not anonymized. Any connections made using this account will reveal your real IP address and can potentially be traced back to you.
  • Limited use: The clearnet user should only be used when absolutely necessary and for specific tasks that require a direct internet connection.
  • Isolation: By using a separate user account for non-Tor traffic, Whonix maintains a clear separation between anonymized and non-anonymized connections, reducing the risk of accidental deanonymization.
  • Persistence: By default, the clearnet user's home directory is not persistent. This will change in a future Whonix version. How to make it persistent is documented below.

The clearnet user is essential for establishing the initial tunnel connection that will then be used to route Tor traffic. This allows for the User → proxy/SSH/VPN → Tor → Internet configuration, where the tunnel connection acts as an additional layer before Tor.

Always be aware that when using the clearnet user, your activities are not protected by Tor's anonymity features. Only use this account for tasks that specifically require a direct internet connection and where anonymity is not a concern.

Make Clearnet home persistent[edit]

There is no persistent home for the clearnet user by default. Therefore make it persistent so SSH user data (keys, known_hosts file) can be saved there.

1. Change folder location of user clearnet to /home/clearnet.

Platform specific. See below on where to run the following command.

sudo usermod -d /home/clearnet clearnet

2. Create the new persistent home folder.

Platform specific. See below on where to run the following commands.

sudo mkdir -p /home/clearnet

3. Change owner and group to clearnet.

sudo chown -R clearnet:clearnet /home/clearnet

4. Adjust permissions.

sudo chmod 755 /home/clearnet

This will most likely be simplified in a future Whonix version, where user clearnet will have a persistent home folder by default.

Curl Clearnet Connectivity Test from Whonix-Gateway[edit]

Warning: Not anonymous!

At time of writing IP 116.202.120.181 is check.torproject.org.

Using IP (116.202.120.181) rather than DNS (check.torproject.org) is required since Whonix-Gateway™ does not have a global DNS resolver enabled by default for its own traffic (details on page Whonix-Gateway System DNS).

sudo -u clearnet UWT_DEV_PASSTHROUGH=1 curl --silent --tlsv1.3 --header 'Host: check.torproject.org' --insecure https://116.202.120.181

Enable Clearnet Networking[edit]

restore Whonix-Gateway clearnet networking[edit]

Instructions on how to remove Whonix Tor default networking for Whonix-Gateway. After applying these instructions, Whonix-Gateway will connect to clearnet.

This is possible because Whonix-Gateway is simplified "just a set of configurations". (And anything else would technically be pointless and a proprietary obfuscated software instead of a Freedom Software project. By reverting these configurations, it's possible to revert back to the same functionality that Debian has, which Whonix is based on. And Debian of course supports clearnet connectivity. This cannot happen by accident, see Dev/Technical_Introduction#Security_Overview.

Warning: Not anonymous!

Developers only! Warning: This is for developers-only!

1. Inside Whonix-Gateway: Unload Whonix Firewall.

2. Inside Whonix-Gateway: Verify that the firewall rules have been unloaded. .

sudo iptables --list

Expected output: 

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

3. Find out DNS server IP address.

Choose either option A), B) or B).

  • A) Use your router's IP address.
  • B) Use a public DNS server. (Potential privacy issues!) ## Cloudflare nameserver 1.1.1.1 ## Google #nameserver 8.8.8.8
  • C) Use the IP address provided by the DNS server IP address.

Inside any other VM, any non-Tor VM, any non-Whonix VM. Such as a Debian (based) VM that has functional internet.

Figure out its /etc/resolv.conf settings.

cat /etc/resolv.conf

4. Inside Whonix-Gateway: Delete /etc/resolv.conf.

sudo rm /etc/resolv.conf

5. Inside Whonix-Gateway: Use the same settings from the non-Tor VM.

Open file /etc/resolv.conf in an editor with root rights.

Select your platform.

Non-Qubes-Whonix™

See Kicksecure logo Open File with Root RightsOnion network Logo for detailed instructions on why to use sudoedit for better security and how to use it.

Note: Mousepad (or the chosen text editor) must be closed before running the sudoedit command.

sudoedit /etc/resolv.conf

Qubes-Whonix™

NOTES:

  • When using Qubes-Whonix, this needs to be done inside the Template.

sudoedit /etc/resolv.conf

  • After applying this change, shutdown the Template.
  • All App Qubes based on the Template need to be restarted if they were already running.
  • This is a general procedure required for Qubes and unspecific to Qubes-Whonix™.

Others and Alternatives

  • This is just an example. Other tools could achieve the same goal.
  • If this example does not work for you or if you are not using Whonix, please refer to this link.

sudoedit /etc/resolv.conf

6. Inside Whonix-Gateway: Deactivate all uwt wrappers globally.

The following instructions permanently deactivate all uwt wrappers and remove stream isolation for uwt-wrapped applications system-wide. Consequently, all uwt-wrapped applications revert to the default system networking configuration.

For more granular control of uwt wrapper deactivation, see: Deactivate uwt Stream Isolation Wrapper.

1. Platform specific notice:

2. Open file /etc/uwt.d/50_user.conf in an editor with root rights.

Select your platform.

Non-Qubes-Whonix™

See Kicksecure logo Open File with Root RightsOnion network Logo for detailed instructions on why to use sudoedit for better security and how to use it.

Note: Mousepad (or the chosen text editor) must be closed before running the sudoedit command.

sudoedit /etc/uwt.d/50_user.conf

Qubes-Whonix™

NOTES:

  • When using Qubes-Whonix, this needs to be done inside the Template.

sudoedit /etc/uwt.d/50_user.conf

  • After applying this change, shutdown the Template.
  • All App Qubes based on the Template need to be restarted if they were already running.
  • This is a general procedure required for Qubes and unspecific to Qubes-Whonix™.

Others and Alternatives

  • This is just an example. Other tools could achieve the same goal.
  • If this example does not work for you or if you are not using Whonix, please refer to this link.

sudoedit /etc/uwt.d/50_user.conf

3. Add.

uwtwrapper_global="0"

4. Save and exit.

5. Check that the changes have taken effect. Run in terminal: uwt_settings_show

It should print 

uwt INFO: disabled.

6. Done.

7. Inside Whonix-Gateway: Download https://check.torproject.orgarchive.org iconarchive.today icon

scurl --remote-name https://check.torproject.org

Or manually run curl with these parameters. [4]

curl --tlsv1.3 --remote-name https://check.torproject.org

Open file index.html in a text editor of your choice as a regular, non-root user.

If you are using a graphical environment, run. mousepad index.html

If you are using a terminal, run. nano index.html

Should include. 

Sorry. You are not using Tor.

8. Inside Whonix-Gateway: Untorify APT sources.

For all files in /etc/apt/sources.list.d folder, remove the tor+ prefix.

for file_name in /etc/apt/sources.list /etc/apt/sources.list.d/* ; do sudo str_replace "tor+" "" "$file_name" ; done

9. Done.

restore Whonix-Workstation clearnet networking[edit]

Undocumented. It would require at least:

  • Configuration of the host virtualization software to use either:
    • A) a different gateway VM or
    • B) changing the network type form internal to "normal" (virtualizer specific, NAT for VirtualBox for example).
  • Disabling Whonix-Workstation firewall.
  • DNS configuration.
  • Network configuration.

Untested but of course possible in theory. This is possible because Whonix-Workstation is also simplified "just a set of configurations". By reverting these configurations, it's possible to revert back to the same functionality that Debian has, which Whonix is based on. And Debian of course supports clearnet connectivity. This cannot happen by accident or malware running inside the VM, see Dev/Technical_Introduction#Security_Overview.

How to UnWhonix - Whonix package removal[edit]

TODO: document

Footnotes[edit]

  1. ↑ Because /etc/passwd, the configuration file that declares location of the home folders for users, is stored in the Qubes root image.
  2. ↑ Because home folders of users are stored in the Qubes private image.
  3. ↑ Qubes-Whonix users note: Or alternatively in App Qube.

    1. Create folder /usr/local/etc/uwt.d.

    sudo mkdir -p /usr/local/etc/uwt.d

    2. Open with root rights: sudoedit /usr/local/etc/uwt.d/50_user.conf

  4. ↑ This has the same effect as the scurl command above.
Notification image
Your support makes
all the difference!

We believe security software like Whonix needs to remain open source and independent. Would you help sustain and grow the project? Learn more about our 13 year success story and maybe DONATE!

Retrieved from "https://www.whonix.org/w/index.php?title=Dev/Test&oldid=100185"