Tunnel UDP over Tor

Whonix ®

Download

Windows Linux Mac VirtualBox KVM Qubes Intel / AMD64 ARM64 PPC64 USB ISO Raspberry Pi More options Source Code

About

Overview Features Whonix vs VPNs Why Open Source? Project Activities Contributors Mission & Vision

Docs

Documentation FAQ Troubleshooting

Community

Forums Forum Best Practices Contribute

Support

Self Support First Policy Search Engines, Docs and AI Support (Limited) Reporting Bugs Contact (Restricted)

Tools Upload file Special pages Recent changes Print Version Page meta What links here Related changes Page information

Page Read Edit History Move Protection Unwatch Watch Delete Purge

User Preferences Watchlist Contributions Logout Create account Login

Donate

Workaround for Tunneling UDP over Tor. Connection Scheme:
User → Tor → Destination

Introduction

The Tor software does not yet support UDP, although Tor provides a DnsPort.

If UDP is urgently required in Whonix, a limited workaround is provided - see the VPN Method below.

On top of the workaround, it would be required to allow UDP in Whonix-Workstation^™ firewall.

Tor Design

According to the Tor Project:

Tor transports data over encrypted TLS tunnels between nodes, which is in turn carried by TCP.

The current Tor design does not support the transport of UDP-based protocols through exit nodes in the network. This is unlikely to be supported in the near future due to incompatibility with cryptographic protocols in use and those planned.

The consequence is that UDP-based protocols and applications cannot be used to transmit UDP datagrams between guards and exit nodes in the default configuration. This affects a number of activities, such as VoIP or video applications.

Methods

Transporting UDP Tunnels over Tor with a VPN

A solution to this problem is to use a tunneling protocol. In simple terms, this allows a user to access a foreign protocol or network service that the underlying (Tor) network does not support or provide directly.

The tested and working method in Whonix is to utilize a Virtual Private Network (VPN) with a trusted provider that does not block UDP traffic in the following configuration: User → Tor → VPN → [Other Anonymizing Network] → Internet. Some VPN protocols like OpenVPN can use UDP while implementing reliable connections and error checking at the application level.

Before following the instructions to tunnel UDP over Tor, please first read the related VPN documentation and warnings:

• Connecting to Tor before a VPN (User → Tor → VPN → Internet).
• Tor Plus VPN or Proxy.
• Tunneling comparison table.
• Whonix VPN disclaimer

The current Tor architecture may lead to a negative performance impact on user activities. This arises from high latency due to congestion in the network, queue length on nodes (mixing of traffic across multiple nodes), and TCP mechanisms which attempt to account for lost packets and hold delivery of future packets until a resend is complete.

Warnings

Always remember that adding a second connection in the tunneling chain adds significant complexity. This potentially increases the security and anonymity risks due to:

• Misconfiguration.
• The increased attack surface of secure tunneling software.
• The difficulty in anonymously paying for VPN services - a money trail is potentially the weakest link probed by adversaries.
• Potential bottlenecks with VPN providers.

Depending on the final configuration this may also: increase fingerprinting risk, remove stream isolation of activities, and lead to a permanent destination (exit node) "X" in the Tor network.

Table: Tor Project VPN/SSH Warnings

Factor	Warning
Activity Profiling	If the VPN is the last part of the tunnel connection, the provider can build a profile of all activities which is dangerous for anonymity.
Anonymity Impact	You can very well decrease your anonymity by using VPN/SSH in addition to Tor.
Attack Surface and Data	Passive attacks by global adversaries might be more difficult, but this is counter-balanced by a larger attack surface and additional data generated by this configuration. On the other hand, this configuration provides better protection against colluding Tor nodes and hackers targeting Tor client code.
Tunnel Fragility	If/when the VPN connection breaks down, direct Tor connections are made without the VPN unless a fail closed mechanism has been configured; see VPN Firewall.
VPN/SSH Honeypots	If the VPN/SSH server is adversary-controlled, Tor protection is weakened. For example, a malicious VPN provider could maintain detailed traffic and session logs, along with meta-data. This configuration is also reportedly susceptible to end-to-end timing attacks, since the times users were connected to anonymity services can be measured.
Website Traffic Fingerprinting	VPN and SSH protocols are vulnerable to website traffic fingerprinting: ...it's a passive eavesdropping attack, although the adversary only watches encrypted traffic from the VPN or SSH, the adversary can still guess what website is being visited, because all websites have specific traffic patterns. The content of the transmission is still hidden, but to which website one connects to isn't secret anymore. In this UDP tunneling context, this means that a Tor exit relay could apply website traffic fingerprinting and determine which website is being visited, even though a VPN/SSH tunnel is in effect.

VPN Method

This tutorial uses OpenVPN and works well inside Whonix. Additional VPN implementations like PPTP might be useful -- as well as other VPN protocols which are free and support UDP -- but further research is required.

Before setting up the VPN:

• Refer to related VPN documentation: How to connect to Tor before a VPN (User → Tor → VPN → Internet).
• Familiarize yourself with curl and rdate. The rdate command line switch -p results in just showing the date and time, without setting it. -u uses UDP instead of TCP (the default).

1. Test the Whonix setup is generally working.

UWT_DEV_PASSTHROUGH=1 curl --tlsv1.3 https://check.torproject.org

This should output "Congratulations. Your browser is configured to use Tor."

2. Whonix-Workstation Firewall configuration

See allow UDP in Whonix-Workstation firewall.

3. Install rdate for UDP and TCP testing.

sudo apt update

sudo apt install rdate

4. Run commands for TCP testing.

rdate -p time.u.washington.edu

rdate -p time.nist.gov

rdate -p ptbtime1.ptb.de

5. Run commands for UDP testing.

rdate -u -p time.u.washington.edu

rdate -u -p time.nist.gov

rdate -u -p ptbtime1.ptb.de

The tests should reveal that without a VPN, TCP works over Tor, but not UDP.

6. Configure a VPN tunnel link in Whonix.

Obviously a VPN provider that does not block UDP is required. Most VPN providers allow UDP.

Follow the setup instructions on the VPN Tunnel Setup Examples page; the riseup and usaip examples are functional for this purpose.

Afterwards test rdate again, first in TCP mode and then in UDP mode -- both should work correctly.

SSH Method

This method is currently undocumented. In theory, SSH servers could be utilized to tunnel UDP over Tor. Obstacles:

• Free SSH services are rarely available.
• The existing free SSH services block certain ports, which makes this even harder.
• Even though SSH can provide a SOCKS5 proxy, it is not capable of providing tunneling support for UDP itself.
  • Extra software needs to be installed on both the client and (even worse) the server with root access. Most administrators of free SSH services will not allow this configuration.
• Acquiring a server comes with its own challenges.
• Easy: allow UDP in Whonix-Workstation firewall.

Therefore this method is only useful if you have your own server, but even then the VPN method is usually preferable.

SOCKS5 Proxy Method

Attempts to tunnel UDP with this configuration have failed. See the Design Archive for full details: Tunneling UDP over Tor.

Whonix Recommendations

Whonix recommends the use of OpenVPN as the most secure (SSL/TLS-based) protocol, rather than reliance upon IKE, L2TP/IPsec or PPTP. OpenVPN is considered extremely secure when used with encryption algorithms such as AES.

Wireguard was invented after this documentation was written. Whonix developer Patrick Schleizer experienced many issues with wireguard not re-establishing connection. There are many existing bug reports and discussions on reddit about this issue. Therefore wireguard remains undocumented. Also, Wireguard explicitly does not support tunneling over TCP. Quote:

TCP Mode
WireGuard explicitly does not support tunneling over TCP, due to the classically terrible network performance of tunneling TCP-over-TCP. Rather, transforming WireGuard's UDP packets into TCP is the job of an upper layer of obfuscation (see previous point), and can be accomplished by projects like udptunnel and udp2raw.Known limitations - Wireguard

A dedicated virtual machine is recommended for this activity; see Multiple Whonix-Workstation.

Footnotes / References

Whonix The most watertight privacy operating system in the world.

Dark mode

Follow us on social media

Supported by Power Up Privacy

Whonix is proudly supported until 2025 by Power Up Privacy, a privacy advocacy group that seeks to supercharge privacy projects with resources so they can complete their mission of making our world a better place. (Strictly subject to our sponsorship policy.)

At Whonix we value freedom and trust, supporting Open Source and Freedom Software

By using this website, you acknowledge you have read, understood, and agree to be bound by these agreements: Terms of Service, Privacy Policy, Cookie Policy, E-Sign Consent, DMCA, Imprint 2012- 2025 ENCRYPTED SUPPORT LLC

Your support makes
all the difference!

We believe security software like Whonix needs to remain open source and independent. Would you help sustain and grow the project? Learn more about our 13 year success story and maybe DONATE!