Whonix-Gateway System DNS
From Whonix
Introduction[edit]
System DNS here is defined as:
- resolving DNS,
- without use of a socksifier such as
torsocks, - without application proxy settings,
- without a Tor
SocksPort.
- without use of a socksifier such as
- using the usual mechanisms on Linux for resolving DNS.
- that are usually configured through configuration file
/etc/resolv.conf. - that would happen when running
nslookup.
All traffic originating from Whonix-Workstation ™ and Whonix-Gateway ™ is routed over Tor. [1] [2] [3] [4] [5] [6] [7]
Whonix-Workstation ™ is configured to use various SocksPorts [archive], DNSPort [archive] and TransPort [archive], see also Stream Isolation. Using system DNS on Whonix-Workstation ™ by default does not require Whonix-Gateway ™ system DNS. [8] Modifications of /etc/resolv.conf on Whonix-Gateway ™ have no effect on Whonix-Workstation ™.
Whonix-Gateway ™ is only configured to use various SocksPorts. A global system DNS resolver to resolve DNS originating from applications running on Whonix-Gateway ™ is not required for any common use case to justify enabling it by default. Use cases where this could be useful include:
- resolving the hostname of a proxy used in
/usr/local/etc/torrc.d/50_user.confthrough Tor would be useful (technical explanation [archive]) - resolving the hostname of a VPN. But then using a VPN configuration using IPs only would be better.
- Perhaps we could use
/etc/hostsfor such use cases rather than enabling system DNS?
Whonix-Gateway System DNS over Clearnet[edit]
Setup[edit]
Usually recommended against and unnecessary.
Clearnet Whonix-Gateway System DNS.
1. Make the following modifications to Whonix-Gateway ™.
Open file /etc/resolv.conf in an editor with root rights.
(Qubes-Whonix ™: In TemplateVM)
This box uses sudoedit for better security [archive]. This is an example and other tools could also achieve the same goal. If this example does not work for you or if you are not using Whonix, please refer to this link.
sudoedit /etc/resolv.conf
2. Uncomment #nameserver 10.0.2.3.
Remove the hash ("#") in front of nameserver. In other words, replace #nameserver 10.0.2.3 with nameserver 10.0.2.3.
3. Platform specific steps.
- Non-Qubes-Whonix ™: Done.
- Qubes-Whonix ™: Replace
10.0.2.3.- To find out that IP to replace it with, run the following command.
-
qubesdb-read /qubes-netvm-primary-dns
- Should show for example:
10.139.1.1
- Replace
10.0.2.3with10.139.1.1. Note: Replace it with the actual IP, the output of abovequbesdb-read /qubes-netvm-primary-dnscommand.
4. Done.
The Whonix-Gateway ™ System DNS has been completed.
Test[edit]
Using Whonix-Gateway ™ user clearnet.
Using the clearnet user account, traffic will be sent over normal internet! Not over Tor! Will not be anonymous!
Start bash under user clearnet.
sudo -u clearnet bash
Test it, for example using ping.
ping google.com
Whonix-Gateway System DNS over Tor[edit]
Usually recommended against and unnecessary.
Torified Whonix-Gateway System DNS.
See Also[edit]
Footnotes[edit]
- ↑
Since Whonix ™ version
0.2.1Whonix-Gateway ™ traffic is also routed over Tor. In this way, use of Whonix is hidden from persons or systems observing the network. - ↑ To preserve the anonymity of a user's Whonix-Workstation ™ activities, it is not necessary to torify Whonix-Gateway ™ own traffic.
- ↑
For reader interest: If DNS settings on Whonix-Gateway ™ are changed in
/etc/resolv.conf, this only affects Whonix-Gateway ™ own DNS requests issued by applications using the system's default DNS resolver. By default, no applications issuing network traffic on Whonix-Gateway ™ use the system's default DNS resolver. All applications installed by default on Whonix-Gateway ™ that issue network traffic (apt-get, whonixcheck, sdwdate) are explicitly configured, or forced by uwt wrappers, to use their own TorSocksPort(see Stream Isolation). - ↑
Whonix-Workstation ™ default applications are configured to use separate Tor
SocksPorts(see Stream Isolation), thereby not using the system's default DNS resolver. Any applications in Whonix-Workstation ™ that are not configured for stream isolation - for examplenslookup- will use the default DNS server configured in Whonix-Workstation ™ (via/etc/network/interfaces), which is the Whonix-Gateway ™. Those DNS requests are redirected to Tor's DnsPort by Whonix-Gateway ™ firewall. Whonix-Gateway ™/etc/resolv.confdoes not affect Whonix-Workstation ™ DNS requests. - ↑
Traffic generated by the Tor process itself which runs by Debian default under user
debian-tororiginating from Whonix-Gateway ™ can use the internet normally. This is because userdebian-toris exempted in Whonix-Gateway ™ Firewall, allowed to use the "normal" internet. - ↑
The Tor software (as of
0.4.5.6) (and no changed were announced at time of writing) almost exclusively uses TCP traffic. See also Tor wiki page, chapter UDP. For DNS, see next footnote. - ↑
Tor does not require, use functional (system) DNS for most functionality. IP addresses of Tor directory authorities are hardcoded in the Tor software as per Tor upstream default. Exceptions include:
- proxy settings using proxies with host names rather than IP addresses
- the Tor pluggable transport meek lite to resolve domains used in setting
url=,front=to IP addresses.
- ↑
That is because DNS traffic originating from Whonix-Workstation ™ gets redirected to Tor's
DNSPortrunning on Whonix-Gateway ™ by Whonix-Gateway Firewall. - ↑
Similar to login as user
clearnet.
Whonix ™ is Supported by Evolution Host DDoS Protected VPS. Stay private and get your VPS with Bitcoin or Monero.
Search engines: YaCy | Qwant | ecosia | MetaGer | peekier | Whonix ™ Wiki
.svg.png&filetimestamp=20200623163525&){kind=small}
We are looking for video makers to help create demonstration, promotional and conceptual videos or tutorials.
This is a wiki. Want to improve this page? Help is welcome and volunteer contributions are happily considered! Read, understand and agree to Conditions for Contributions to Whonix ™, then Edit! Edits are held for moderation. Policy of Whonix Website and Whonix Chat and Policy On Nonfreedom Software applies.
Copyright (C) 2012 - 2021 ENCRYPTED SUPPORT LP. Whonix ™ is a trademark. Whonix ™ is a licensee [archive] of the Open Invention Network [archive]. Unless otherwise noted, the content of this page is copyrighted and licensed under the same Freedom Software license as Whonix ™ itself. (Why?)
The personal opinions of moderators or contributors to the Whonix ™ project do not represent the project as a whole.
Whonix ™ is a derivative of and not affiliated with Debian [archive]. Debian is a registered trademark [archive] owned by Software in the Public Interest, Inc [archive].
Whonix ™ is produced independently from the Tor® [archive] anonymity software and carries no guarantee from The Tor Project [archive] about quality, suitability or anything else.
By using our website, you acknowledge that you have read, understood and agreed to our Privacy Policy, Cookie Policy, Terms of Service, and E-Sign Consent. Whonix ™ is provided by ENCRYPTED SUPPORT LP. See Imprint, Contact.