Jump to: navigation, search

Template:Prevent Bypassing the Tunnel-Link

Disabling stream isolation will prevent bypassing of the tunnel-link. By default, many pre-installed applications are configured for Stream Isolation in Whonix. These specific applications are configured to use Tor SocksPorts, instead of Tor's TransPort.

All applications which are configured to use Tor SocksPorts are not tunneled through the tunnel-link, but instead they are "only" tunneled through Tor. The reason is the following configuration does not touch local connections to, which is the Whonix-Gateway. Therefore, if for example you wish to tunnel Tor Browser via the route User -> Tor -> Tunnel-link -> Internet, all proxy settings from Tor Browser need to be removed. See below for instructions.

Deactivate uwt Wrappers

The following instructions permanently deactivate all uwt wrappers and remove stream isolation for uwt wrapped applications system-wide. Consequently, all uwt wrapped applications revert to the default system networking configuration.

If you want more granular control of uwt wrapper deactivation, see Stream_Isolation#Deactivate_uwt_Stream_Isolation_Wrapper.

Open /etc/uwt.d/50_user.conf in an editor with root rights.

If you are using a graphical Whonix or Qubes-Whonix, run.

kdesudo kwrite /etc/uwt.d/50_user.conf

If you are using a terminal-only Whonix, run.

sudo nano /etc/uwt.d/50_user.conf



Save and exit.

Tor Browser Remove Proxy Settings


This configuration causes Tor Browser to no longer use proxy settings. With no proxy, Tor Browser uses the (VM) system's default networking. This is identical to any other application inside the Whonix-Workstation that has not been explicitly configured to use Tor via socks proxy settings or a socksifier. This setting is also called transparent torification. [1]

Note: This action will break both the Stream Isolation for Tor Browser and Tor Browser's tab isolation by socks user name. This worsens the web fingerprint and causes the user to be pseudonymous, rather than anonymous. To mitigate these risks, consider using More than one Tor Browser in Whonix, or better yet, Multiple Whonix-Workstations.

If these settings are changed, expect Tor Button to show a red sign and state "Tor Disabled" if a mouse is hovered over it.

To enable transparent torification (no proxy setting), set the TOR_TRANSPROXY=1 environment variable. There are several methods, but the #/etc/environment Method is the simplest one.

For other methods with finer granulated settings, please press on Expand on the right.

<span id="
od"></span> Command Line Method

Navigate to the Tor Browser folder.

cd ~/tor-browser_en-US

Every time Tor Browser is started, run the following command to set the TOR_TRANSPROXY=1 environment variable.

TOR_TRANSPROXY=1 ./start-tor-browser.desktop

start-tor-browser Method

This only applies to a single instance of the Tor Browser folder that is configured. This method may not persist when Tor Browser is updated.

Find and open start-tor-browser in the Tor Browser folder in an editor.

This is most likely in ~/tor-browser_en-US/Browser/start-tor-browser below #!/usr/bin/env bash.



/etc/environment Method

This will apply to the whole environment, including any possible custom locations of Tor Browser installation folders. [2]

Open /etc/environment in an editor with root rights.

If you are using a graphical Whonix or Qubes-Whonix, run.

kdesudo kwrite /etc/environment

If you are using a terminal-only Whonix, run.

sudo nano /etc/environment

Add the following line.


Save and reboot.


Reverting this change is undocumented. Simply unsetting that environment variable will not work due to Tor Browser limitations. The easiest way to undo this setting is to install a fresh instance of Tor Browser (please contribute to these instructions)!

Ignore Tor Button's Open Network Settings

Whonix has disabled the Open Network Settings... menu option in Tor Button. Read the footnote for further information. [3]

Deactivate Miscellaneous Proxy Settings

On the Stream Isolation page, there is a list of applications that are pre-configured to use socks proxy settings via application configuration files. To disable this, the Whonix system default must be removed from the application's settings.

TO DO: document and expand.

For some applications, this is impossible:

These applications can only talk to Tor Hidden Services directly and cannot be configured to use the system default. You can only deactivate sdwdate and/or not use Ricochet IM.

  1. This term was coined in context of a Tor Transparent Proxy. It acts as a simple gateway that routes all connections through Tor, but does not provide Stream Isolation.
  2. Unless this environment variable is manually unset before starting Tor Browser.
  3. The regular Tor Browser Bundle from The Tor Project (without Whonix) allows networking settings to changed inside Tor via the Open Network Settings menu option. It has the same effect as editing Tor's config file torrc. In Whonix, the environment variable export TOR_NO_DISPLAY_NETWORK_SETTINGS=1 has been set to disable the TorButton -> Open Network Settings... menu item. It is not useful and confusing to have in the Whonix-Workstation because:
    • In Whonix, there is only limited access to Tor's control port (see Dev/CPFP for more information).
    • For security reasons, Tor must be manually configured in /etc/tor/torrc on the Whonix-Gateway, and not from the Whonix-Workstation (see VPN/Tunnel support for more information).