Testers only!

Introduction[edit]

Whonix ™ needs at least two systems. One running Tor, Whonix-Gateway. The other running clients that are routed through Tor, Whonix-Workstation ™. This ensures the highest possible security and isolation. We can implement this using different strategies: Two VMs (Gateway VM and Workstation VM) or bare metal.

A different approach is to run Tor and applications all on the same machine. This can be either a VM or bare metal host.

This site will guide you through all required steps to set up a UniStation. A machine which routes all traffic through the Tor anonymity network. This is an implementation of a Tor TransparentProxy.

Advantages:

Only one machine required.
Lower system requirements.

Disadvantages:

More difficult to install.
User might have to set the network interface setting.
If using VMs: Guest VM can see MAC address of host?
Less secure than Whonix ™ with Whonix-Gateway and Whonix-Workstation ™.
This is not as well polished, developed and thought through as Whonix ™ yet.
Enhancements that come with Whonix-Workstation ™ such as:
- Tor Browser
- anon-apps-config
- systemcheck
- Whonix Live
- kloak
- LKRG
- tirdad
- AppArmor
- Anon Connection Wizard
- sdwdate-gui
- open-link-confirmation
- Bridges usability, Documentation
- and maybe others
have not been considered yet.
This will potentially not be maintained as well as Whonix ™.

Prerequisites[edit]

1. Confirm prerequisites are met.

Debian bullseye is installed.
User account user exists.

2. Become root. ^[1] ^[2]

su -

3. Install sudo and adduser packages.

1. Update the package lists.

apt update

2. Upgrade the system.

apt full-upgrade

3. Install sudo and adduser packages.

apt install --no-install-recommends sudo adduser

4. Set user rights.

The following commands must be run either by root or using sudo.

Create group console.

addgroup --system console

Add user user to group console.

adduser user console

Add user user to group sudo.

adduser user sudo

5. Reboot. ^[3]

reboot

Installation[edit]

Packages[edit]

Install gnupg. ^[4]

sudo apt install gnupg

Complete the following steps to add the Whonix ™ Signing Key to the system's APT keyring.

Open a terminal.

1. Package curl needs to be installed.

Install package(s) curl.

A. Update the package lists and upgrade the system.

sudo apt update && sudo apt full-upgrade

B. Install the curl package(s).

Using apt command line parameter --no-install-recommends is in most cases optional.

sudo apt install --no-install-recommends curl

C. Done.

The procedure of installing package(s) curl is complete.

2. Download Whonix ™ Signing Key. ^[5]

A : Debian

If you are using Debian, run.

TLS

curl --tlsv1.3 --output /usr/share/keyrings/derivative.asc --url https://www.whonix.org/keys/derivative.asc

onion

Downloading over onion requires an already functional system Tor. torsocks curl --output /usr/share/keyrings/derivative.asc --url http://www.dds6qkxpwdeubwucdiaord2xgbbeyds25rbsgr73tbfpqpt4a6vjwsyd.onion/keys/derivative.asc

B : Qubes

If you are using a Qubes Debian Template, run.

TLS

curl --proxy http://127.0.0.1:8082/ --tlsv1.3 --output /usr/share/keyrings/derivative.asc --url https://www.whonix.org/keys/derivative.asc

onion

Downloading over onion requires an already functional system Tor. torsocks curl --proxy http://127.0.0.1:8082/ --output /usr/share/keyrings/derivative.asc --url http://www.dds6qkxpwdeubwucdiaord2xgbbeyds25rbsgr73tbfpqpt4a6vjwsyd.onion/keys/derivative.asc

3. Users can check Whonix ™ Signing Key for better security.

4. Done.

The procedure of adding the Whonix ™ signing key is now complete.

Add Whonix ™ Repository.

Choose either: Option A, Option B OR Option C

A : Onion Rep.

Option A: Add Whonix ™ Onion Repository.

To add Whonix ™ Repository over Onion please install apt-transport-tor from the Debian repository.

sudo apt install apt-transport-tor

Add Whonix ™ APT repository for default Whonix ™ using Debian stable. At the time of writing this was bullseye.

echo "deb [signed-by=/usr/share/keyrings/derivative.asc] tor+http://deb.dds6qkxpwdeubwucdiaord2xgbbeyds25rbsgr73tbfpqpt4a6vjwsyd.onion bullseye main contrib non-free" | sudo tee /etc/apt/sources.list.d/derivative.list

B : Clearnet Rep. via Tor

Option B: Add Whonix ™ Clearnet Repository over Tor.

To add Whonix ™ Repository over torified clearnet install apt-transport-tor from the Debian repository.

sudo apt install apt-transport-tor

Add Whonix ™ APT repository for default Whonix ™ using Debian stable. At the time of writing this was bullseye.

echo "deb [signed-by=/usr/share/keyrings/derivative.asc] tor+https://deb.whonix.org bullseye main contrib non-free" | sudo tee /etc/apt/sources.list.d/derivative.list

C : Clearnet Rep.

Option C: Add Whonix Clearnet Repository over clearnet.

NOTE: When later using Whonix ™ repository tool, then this will be upgraded to "Clearnet Rep. via Tor", unless see footnote. ^[6]

To add Whonix ™ Repository over clearnet please add Whonix ™ APT repository for default Whonix ™ using Debian stable. At the time of writing this was bullseye.

echo "deb [signed-by=/usr/share/keyrings/derivative.asc] https://deb.whonix.org bullseye main contrib non-free" | sudo tee /etc/apt/sources.list.d/derivative.list

Install package(s) usability-misc.

A. Update the package lists and upgrade the system.

sudo apt update && sudo apt full-upgrade

B. Install the usability-misc package(s).

Using apt command line parameter --no-install-recommends is in most cases optional.

sudo apt install --no-install-recommends usability-misc

C. Done.

The procedure of installing package(s) usability-misc is complete.

^[7]

sudo apt-get-noninteractive install --no-install-recommends kicksecure-cli whonix-firewall uwt anon-gw-dns-conf ipv4-forward-disable ipv6-disable

Update: Packages anon-gw-dns-conf, ipv4-forward-disable, ipv6-disable are deprecated (merged into anon-gw-anonymizer-config) in Whonix ™ developers repository (upcoming stable) but these packages are so trivial that the 1 config file per package can be manually set up.

Firewall Settings[edit]

Find out your network interface name. You can learn about what interfaces you have by running.

sudo ifconfig

Edit /etc/whonix_firewall.d/50_user.conf.

sudoedit /etc/whonix_firewall.d/50_user.conf

Paste.

You might have to change #EXT_IF="eth0" by removing the hash # in front of it and by setting it to the name of your network interface such as wlan0. I.e. the full line might look like this: EXT_IF="wlan0" Include it with the to be pasted text below. ^[8]

## 0: disabled ## 1: enabled ## External interface ## defaults to: #EXT_IF="eth0" WORKSTATION_TRANSPARENT_TCP=0 WORKSTATION_TRANSPARENT_UDP=0 WORKSTATION_TRANSPARENT_DNS=0 WORKSTATION_ALLOW_SOCKSIFIED=0 CONTROL_PORT_FILTER_PROXY_ENABLE=0 GATEWAY_TRANSPARENT_TCP=1 GATEWAY_TRANSPARENT_UDP=0 GATEWAY_TRANSPARENT_DNS=1 GATEWAY_ALLOW_INCOMING_ICMP=0

If you want port 22 to open for incoming SSH, also paste:

GATEWAY_ALLOW_INCOMING_SSH=1

Save.

Qubes[edit]

Qubes only. Does not hurt otherwise.

sudo systemctl mask qubes-iptables

Qubes Debian based VMs would require further /etc/whonix_firewall.d/50_user.conf modifications. See footnote. ^[9]

torsocks[edit]

torsocks config not required. uwt sets that up for us.

Tor Configuration[edit]

Open Tor configuration file /etc/tor/torrc with root rights.

sudoedit /etc/tor/torrc

Paste. ^[10]

TransPort 127.0.0.1:9041 DnsPort 127.0.0.1:5400 DisableNetwork 0

Save.

Restart Tor.

sudo systemctl restart tor

APT[edit]

Check if there is something you need in /etc/apt/sources.list.

Move original /etc/apt/sources.list out of the way because /etc/apt/sources.list.d/debian.list by Kicksecure ™ replaces it.

sudo mv /etc/apt/sources.list ~/

Reboot[edit]

Reboot required.

sudo reboot

Usage[edit]

check sdwdate[edit]

sudo systemctl status sdwdate --no-pager

Updates[edit]

Update as per usual. See also Operating System Software and Updates.

Thanks to uwt it is stream isolated (using Tor SocksPort). No need to use torsocks. uwt uses torsocks which is configued to use IsolatePID 1.

sudo apt update

Transparent DNS Functional[edit]

nslookup torproject.org

Server:		127.0.0.1
Address:	127.0.0.1#53

Non-authoritative answer:
Name:	torproject.org
Address: 95.216.163.36
** server can't find torproject.org: NXDOMAIN

Transparent DNS Functional[edit]

cd /tmp

wget.anondist-orig torproject.org

--2019-12-10 12:25:43--  http://torproject.org/
Resolving torproject.org (torproject.org)... 95.216.163.36
Connecting to torproject.org (torproject.org)|95.216.163.36|:80... connected.
HTTP request sent, awaiting response... 302 Found
Location: https://www.torproject.org/ [following]
--2019-12-10 12:25:45--  https://www.torproject.org/
Resolving www.torproject.org (www.torproject.org)... 116.202.120.165
Connecting to www.torproject.org (www.torproject.org)|116.202.120.165|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 19623 (19K) [text/html]
Saving to: ‘index.html’

index.html                  100%[===========================================>]  19.16K  62.3KB/s    in 0.3s

2019-12-10 12:25:47 (62.3 KB/s) - ‘index.html’ saved [19623/19623]

Troubleshooting[edit]

Depending on network configuration perhaps /etc/whonix_firewall.d/50_user.conf need to be appended.

NON_TOR_GATEWAY="\ 127.0.0.0-127.0.0.24 \ 10.137.0.0-10.138.255.255 \ "

Forum Discussion[edit]

https://forums.whonix.org/t/debian-onevm-anononevm-non-self-contained-host-depending-onevm-unistation-a-tor-transparentproxy-with-only-one-machine/5470

Footnotes[edit]

↑ Parameter - is required to set the correct paths to /usr/sbin. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=833256
↑ Other methods are possible.
↑ Usability. Otherwise after installation is complete, user might not be able to login. Needs further testing if still required. Can be avoided for remote servers.
↑ Required for Debian netinst "minimal" (no default system tools).
↑ See Secure Downloads to understand why curl and the parameters --tlsv1.3 are used instead of wget.

Placing an additional signing key into folder /usr/share/keyrings by itself alone has no impact on security as this folder is not automatically used by Debian's APT by default. Only when an APT sources list configuration file points to folder /usr/share/keyrings using the signed-by keyword the signing key will be actually used. Therefore deleting keys in /usr/share/keyrings is optional if intending to disable an APT repository. See also APT Signing Key Folders.
↑ Unless using repository-dist --transport plain-tls. See also man repository-dist.

↑ apt-get-noninteractive to avoid asking this question.

Setting up anon-base-files (3:4.6-1) ...

Configuration file '/etc/machine-id'
 ==> File on system created by you or by a script.
 ==> File also in package provided by package contributor.
   What would you like to do about it ?  Your options are:
    Y or I  : install the package contributor's version
    N or O  : keep your currently-installed version
      D     : show the differences between the versions
      Z     : start a shell to examine the situation
 The default action is to keep your current version.
*** machine-id (Y/I/N/O/D/Z) [default=N] ? i

↑ VirtualBox: EXT_IF="enp0s3"
↑ This was required in Qubes to make Whonix-Gateways Own Traffic Transparent Proxy work. In that case, append to /etc/whonix_firewall.d/50_user.conf. NON_TOR_GATEWAY="\ 127.0.0.0-127.0.0.24 \ 10.137.0.0-10.138.255.255 \ "
↑ DisableNetwork 0 is required to make sdwdate work because the connectivity check locks at it.

Whonix ™ The most watertight privacy operating system in the world.

Donate

FREE · PLUS · PREMIUM Support

Dark mode

At Whonix we believe in freedom and trust. That's why we fully support Open Source and Freedom Software.

Whonix ™ is supported by Evolution Host DDoS Protected VPS.

The personal opinions of moderators or contributors to the Whonix ™ project do not represent the project as a whole. By using this website, you acknowledge you have read, understood, and agree to be bound by these these agreements: Terms of Service , Privacy Policy , Cookie Policy , E-Sign Consent , DMCA , Imprint Whonix

ENCRYPTED SUPPORT LP, 2023

Your support makes
all the difference!

We believe security software like Whonix needs to remain open source and independent. Would you help sustain and grow the project? Learn more about our 10 year success story and maybe DONATE!

[1] Parameter - is required to set the correct paths to /usr/sbin. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=833256

[2] Other methods are possible.

[3] Usability. Otherwise after installation is complete, user might not be able to login. Needs further testing if still required. Can be avoided for remote servers.

[4] Required for Debian netinst "minimal" (no default system tools).

[5] See Secure Downloads to understand why curl and the parameters --tlsv1.3 are used instead of wget.

Placing an additional signing key into folder /usr/share/keyrings by itself alone has no impact on security as this folder is not automatically used by Debian's APT by default. Only when an APT sources list configuration file points to folder /usr/share/keyrings using the signed-by keyword the signing key will be actually used. Therefore deleting keys in /usr/share/keyrings is optional if intending to disable an APT repository. See also APT Signing Key Folders.

[6] Unless using repository-dist --transport plain-tls. See also man repository-dist.

[7] t-get-noninteractive to avoid asking this question.
Setting up anon-base-files (3:4.6-1) ... Configuration file '/etc/machine-id' ==> File on system created by you or by a script. ==> File also in package provided by package contributor. What would you like to do about it ? Your options are: Y or I : install the package contributor's version N or O : keep your currently-installed version D : show the differences between the versions Z : start a shell to examine the situation The default action is to keep your current version. *** machine-id (Y/I/N/O/D/Z) [default=N] ? i

[8] VirtualBox: EXT_IF="enp0s3"

[9] This was required in Qubes to make Whonix-Gateways Own Traffic Transparent Proxy work. In that case, append to /etc/whonix_firewall.d/50_user.conf. NON_TOR_GATEWAY="\ 127.0.0.0-127.0.0.24 \ 10.137.0.0-10.138.255.255 \ "

[10] DisableNetwork 0 is required to make sdwdate work because the connectivity check locks at it.

[1]

[2]

[3]

[4]

[5]

[6]

[7]

[8]

[9]

[10]

UniStation - A Tor TransparentProxy with only One Machine

Contents

Introduction[edit]

Prerequisites[edit]

Installation[edit]

Packages[edit]

A : Debian

TLS

onion

B : Qubes

TLS

onion

A : Onion Rep.

B : Clearnet Rep. via Tor

C : Clearnet Rep.

Firewall Settings[edit]

Qubes[edit]

torsocks[edit]

Tor Configuration[edit]

APT[edit]

Reboot[edit]

Usage[edit]

check sdwdate[edit]

Updates[edit]

Transparent DNS Functional[edit]

Transparent DNS Functional[edit]

Troubleshooting[edit]

Forum Discussion[edit]

Footnotes[edit]

Navigation menu

UniStation - A Tor TransparentProxy with only One Machine

Introduction[edit]

Prerequisites[edit]

Installation[edit]

Packages[edit]

A : Debian

TLS

onion

B : Qubes

TLS

onion

A : Onion Rep.

B : Clearnet Rep. via Tor

C : Clearnet Rep.

Firewall Settings[edit]

Qubes[edit]

torsocks[edit]

Tor Configuration[edit]

APT[edit]

Reboot[edit]

Usage[edit]

check sdwdate[edit]

Updates[edit]

Transparent DNS Functional[edit]

Transparent DNS Functional[edit]

Troubleshooting[edit]

Forum Discussion[edit]

Footnotes[edit]

Donate

Navigation menu

Search