Last update: March 17, 2019. This website uses cookies. By using our website, you acknowledge that you have read, understood and agreed to our Privacy Policy, Cookie Policy, Terms of Service, and E-Sign Consent. More information

 Actions

Ports

On the usefulness and security of opening ports in context of clearnet and Tor[edit]

We have to clearly distinguish between opening when referring to clearnet versus referring to opening a port when using Tor.

Most times when talking generally about opening ports (clearnet, unrelated to Tor), technically one is referring to allow unsolicited incoming connections. Imagine a public web server. The websever is supposed to be able to reply to unsolicited incoming connections by clients. On the other hand however, clients usually (except when they are behind some corporate, national or similar firewall) can use any outgoing port. When a client is creating an outgoing connection, the operating system picks a random port where it expects the solicited incoming answer. Sometimes end users want to open a port such for example when they want to install a public webserver on their home connection. The end users have mostly unrestricted outgoing access, but unsolicited incoming connections are restricted by their home router's NAT firewall. Opening a port for them often means that they use their router's web interface, configure the port they want to open and forward it to a computer in their LAN network. Also when they are using a firewall that restricts unsolicited incoming connections, they need to open an incoming port in their firewall in order to make their server application reachable from the open internet. By doing so, the users real public IP address is exposed. You would not want to open a port using this method if you wish to stay anonymous.

When talking about Tor, the topic of opening ports often causes confusion. By default Tor works only as a client, which means it lets the user establish outgoing connections[1] and receives the solicited answers. The Tor software by default does not block any outgoing ports. However, some Tor exit relays restrict outgoing ports. In theory, if there was no Tor exit relay supporting outgoing port 22, then you could not exit the Tor network directly through that port. In these cases there would be no way to force open that port since that is a Tor relay, not Tor client setting.

Hosting Location Onion Services over Tor is possible. One way to accomplish this is using Onion Services. To oversimplify this, by configuration Tor it instructions the Tor network to open an incoming port at Tor relays for Tor onion hostname which gets forwarded to a port on the machine where Tor is running (called virtport). The users real public IP address remains hidden. That onion hostname is only reachable by other Tor clients.

At the time of writing, it makes limited sense to open a port. There are very few exceptions.

If you want to host a Tor onion service, you will need to open a port in Whonix-Workstation firewall so Whonix-Gateway can forward the incoming Tor onion service connection to Whonix-Workstation. This will be covered in Onion Services instructions.

When Tor users ask about how to open a port, they often do not need to and try to fix the wrong problem. Common issues are:

  • Services such as IRC servers ban connections from Tor users. This cannot be remedied by opening any ports.
  • Sometimes applications such as VPNs do not work. Either because one is trying to use UDP, while the Tor network does not support that [2] or because of VPN configuration issues, see Tunnels/Introduction.
  • Sometimes applications such as OnionShare when run in Whonix-Workstation expect Tor to be running on localhost because there are Tor-friendly applications, i.e. applications preconfigured to use Tor by the developer of the application. Now for OnionShare this is a non-issue because Whonix developers preconfigured Whonix using package anon-ws-disable-stacked-tor to make OnionShare work inside Whonix without the user having to setup port redirections. See our Whonix OnionShare instructions if you specifically care about OnionShare. Otherwise see Redirect Whonix-Workstation Ports or Unix Domain Socket Files to Whonix-Gateway.

If you really need an anonymous incoming port your primary option is Tor Onion Services and some methods listed on Hosting Location Hidden Services.

How[edit]

Undocumented. Pointers:

Open Whonix-Gateway Port[edit]

Modify Whonix User Firewall Settings

Note: If no changes have yet been made to Whonix Firewall Settings, then the Whonix User Firewall Settings File /etc/whonix_firewall.d/50_user.conf appears empty (because it does not exist). This is expected.

If using Qubes-Whonix, complete these steps.

Qubes App Launcher (blue/grey "Q") -> Template: whonix-gw-14 -> Whonix User Firewall Settings

If using a graphical Whonix-Gateway, complete these steps.

Start Menu -> Applications -> Settings -> User Firewall Settings

If using a terminal-only Whonix-Gateway, complete these steps.

sudo nano /etc/whonix_firewall.d/50_user.conf

For more help, press on Expand on the right.

Note: The Whonix Global Firewall Settings File /etc/whonix_firewall.d/30_default.conf contains default settings and explanatory comments about their purpose. By default, the file is opened read-only and is not meant to be directly edited. Below, it is recommended to open the file without root rights. The file contains an explanatory comment on how to change firewall settings.

## Please use "/etc/whonix_firewall.d/50_user.conf" for your custom configuration,
## which will override the defaults found here. When Whonix is updated, this
## file may be overwritten.

See also Whonix modular flexible .d style configuration folders.

To view the file, follow these instructions.

If using Qubes-Whonix, complete these steps.

Qubes App Launcher (blue/grey "Q") -> Template: whonix-gw-14 -> Whonix Global Firewall Settings

If using a graphical Whonix-Gateway, complete these steps.

Start Menu -> Applications -> Settings -> Global Firewall Settings

If using a terminal-only Whonix-Gateway, complete these steps.

nano /etc/whonix_firewall.d/30_default.conf

Add.

EXTERNAL_OPEN_PORTS+=" 80 "

Save.

Reload Whonix-Gateway Firewall.

If you are using Qubes-Whonix, complete the following steps.

Qubes App Launcher (blue/grey "Q") -> Whonix-Gateway ProxyVM (commonly named sys-whonix) -> Reload Whonix Firewall

If you are using a graphical Whonix-Gateway, complete the following steps.

Start Menu -> Applications -> System -> Reload Whonix Firewall

If you are using a terminal-only Whonix-Gateway, run.

sudo whonix_firewall

Open Whonix-Workstation Port[edit]

Modify Whonix-Workstation User Firewall Settings

Note: If no changes have yet been made to Whonix Firewall Settings, then the Whonix User Firewall Settings File /etc/whonix_firewall.d/50_user.conf appears empty (because it does not exist). This is expected.

If using Qubes-Whonix, complete these steps.
In Whonix-Workstation AppVM.

Make sure folder /rw/config/whonix_firewall.d exists.

sudo mkdir -p /rw/config/whonix_firewall.d

Open /rw/config/whonix_firewall.d/50_user.conf with root rights.

kdesudo kwrite /rw/config/whonix_firewall.d/50_user.conf

If using a graphical Whonix-Workstation, complete these steps.

Start Menu -> Applications -> Settings -> User Firewall Settings

If using Non-Qubes-Whonix, complete this step.

In Whonix-Workstation, open the whonix_firewall configuration file in an editor.

sudo nano /etc/whonix_firewall.d/50_user.conf

For more help, press on Expand on the right.

Note: This is for informational purposes only! Do not edit /etc/whonix_firewall.d/30_default.conf

The Whonix Global Firewall Settings File /etc/whonix_firewall.d/30_default.conf contains default settings and explanatory comments about their purpose. By default, the file is opened read-only and is not meant to be directly edited. Below, it is recommended to open the file without root rights. The file contains an explanatory comment on how to change firewall settings.

## Please use "/etc/whonix_firewall.d/50_user.conf" for your custom configuration,
## which will override the defaults found here. When Whonix is updated, this
## file may be overwritten.

See also Whonix modular flexible .d style configuration folders.

To view the file, follow these instructions.

If using Qubes-Whonix, complete these steps.

Qubes App Launcher (blue/grey "Q") -> Template: whonix-ws-14 -> Whonix Global Firewall Settings

If using a graphical Whonix-Workstation, complete these steps.

Start Menu -> Applications -> Settings -> Global Firewall Settings

If using Non-Qubes-Whonix, complete this step.

In Whonix-Workstation, open the whonix_firewall configuration file in an editor.

nano /etc/whonix_firewall.d/30_default.conf

Add.

EXTERNAL_OPEN_PORTS+=" 80 "

Save.

Reload Whonix-Workstation Firewall.

If you are using Qubes-Whonix, complete the following steps.

Qubes App Launcher (blue/grey "Q") -> Whonix-Workstation AppVM (commonly named anon-whonix) -> Reload Whonix Firewall

If you are using a graphical Whonix-Workstation, complete the following steps.

Start Menu -> Applications -> System -> Reload Whonix Firewall

If you are using a terminal-only Whonix-Workstation, run.

sudo whonix_firewall

Forum Discussion[edit]

https://forums.whonix.org/t/new-wiki-page-to-clear-up-confusion-about-opening-ports

See Also[edit]

Footnotes[edit]

  1. TCP and some types of DNS
  2. Tor#UDP

No user support in comments. See Support.

Comments will be deleted after some time. Specifically after comments have been addressed in form of wiki enhancements. See Wiki Comments Policy.


Add your comment
Whonix welcomes all comments. If you do not want to be anonymous, register or log in. It is free.


Random News:

Do you wonder why Whonix will always be free? Check out Why Whonix is Free Software.


https | (forcing) onion

Share: Twitter | Facebook

This is a wiki. Want to improve this page? Help is welcome and volunteer contributions are happily considered! Read, understand and agree to Conditions for Contributions to Whonix, then Edit! Edits are held for moderation.

Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP. Whonix is a trademark. Whonix is a licensee of the Open Invention Network. Unless otherwise noted, the content of this page is copyrighted and licensed under the same Freedom Software license as Whonix itself. (Why?)

By using our website, you acknowledge that you have read, understood and agreed to our Privacy Policy, Cookie Policy, Terms of Service, and E-Sign Consent. Whonix is provided by ENCRYPTED SUPPORT LP. See Imprint.