IPv6 Development

From Whonix
< Dev
Jump to navigation Jump to search

Development notes for adding IPv6 support to Whonix.

Essential Knowledge[edit]

  • Tor 6to4: Tor is capable of tunneling IPv6 over IPv4. Even if your ISP does not support IPv4, the user will still be able to reach IPv6 destinations. Tor will build circuits over IPv4. However, IPv6 traffic is tunneled through IPv4. There is no need to have functional IPv6 support for clearnet just to be able to reach IPv6 destinations over Tor.
  • Qubes specific.
    • https://www.qubes-os.org/doc/networking/#limitationsarchive.org
      • Currently only IPv4 DNS servers are configured, regardless of ipv6 feature state. It is done this way to avoid reconfiguring all connected qubes whenever IPv6 DNS becomes available or not. Configuring qubes to always use IPv6 DNS and only fallback to IPv4 may result in relatively long timeouts and poor usability. But note that DNS using IPv4 does not prevent to return IPv6 addresses. In practice this is only a problem for IPv6-only networks.

    • Qubes IPv6 only mode bug: Fix IPv6 connectivity on downstream qubesarchive.org

IPv6 Support in Whonix[edit]

IPv6 support are multiple parts.

  • A) Whonix-Workstation connecting to Whonix-Gateway using IPv6.
    • TODO
  • B) Tor proxying connections to IPv6 destinations.
    • Already functional with Tor Browser.
      • NOTE: ISP IPv6 feature state does not matter. Tor does not require functional IPv6 by the ISP to be able to proxy/tunnel IPv6. Tor can tunnel IPv6 over IPv4.
    • curl: TODO
    • transparent proxying: TODO
  • C) Tor using IPv6 to build Tor circuits.
    • TODO

Whonix TODO[edit]

iface eth0 inet6 static
    address ::FFFF:
    netmask 96

Tor IPv6 Configuration[edit]

sudo nano /etc/tor/torrc

SocksPort [::1]:9050

sudo systemctl restart tor

Note: If localhost on the system (inside the VM) does not have IPv6 support, Tor will fail to start.

[warn] Could not bind to ::1:9050: Cannot assign requested address
[warn] Failed to parse/validate config: Failed to bind one of the listener ports.
[err] Reading config failed--see warnings above.



  • broken ISP IPv6: Your ISP does not provide IPv6. Visiting IPv6 pages are broken.


  • broken ISP IPv6 + Debian + Tor IPv6 Configuration (see above) + curl --ipv6 + IPv6 localhost
    • using IP (without DNS)
      • curl --ipv6 --proxy socks5h://[::1]:9050 --resolve v6.ipv6test.app:443:[2600:9000:21f3:1800:18:3c03:3680:93a1] https://v6.ipv6test.app/
    • using DNS
      • curl --ipv6 --proxy socks5h://[::1]:9050 https://v6.ipv6test.app/
    • example output: 2a0b:f4c2:1::1
  • broken ISP IPv6 + Debian + Tor Browser + IPv6-only test page
  • broken ISP IPv6 + Whonix-Workstation + Tor Browser + IPv6-only test page


  • Tor SocksPort configuration option IPv6Traffic is optional, not required.
  • Find out the IP address of an IPv6 test server. Requires functional IPv6 connectivity somewhere.
    • nslookup v6.ipv6test.app
      • 2600:9000:21f3:1800:18:3c03:3680:93a1

TODO Test[edit]

  • functional ISP IPv6 + Debian + curl --ipv6 + IPv6 via IP only (without DNS)
    • useful for testing if IP connectivity is functional while exluding potential DNS related issues
    • curl --ipv6 --resolve v6.ipv6test.app:443:[2600:9000:21f3:1800:18:3c03:3680:93a1] https://v6.ipv6test.app/

IPv6-only test pages[edit]

These are only reachable over IPv6. Not over IPv4 at all. This makes these test pages ideal for testing.

Test Scenario[edit]

After full IPv6 support has been added to Whonix, the following test might be ideal to test if IPv6 is fully functional.

IPv6 only ISP simulation:

  • Disable IPv4 either:
    • A) on the router or,
    • B) alternatively, in case of Non-Qubes-Whonix alternatively on the host operating system.
    • C) alternatively, in case of Qubes-Whonix use a VM sys-ipv4-breaker (A ProxyVM that disables IPv4 using sysctl)


We believe security software like Whonix needs to remain open source and independent. Would you help sustain and grow the project? Learn more about our 12 year success story and maybe DONATE!