Whonix-Gateway System DNS
Information about Whonix-Gateway System DNS,
nslookup. Getting System DNS working on Whonix-Gateway.
System DNS is defined as:
- Resolving DNS:
- Without the use of a socksifier such as
- Without application proxy settings,
- Without a Tor
- Without the use of a socksifier such as
- Using the standard mechanisms on Linux for DNS resolution.
- Typically configured through the configuration file
- The process that occurs when running
Whonix-Workstation™ is configured to use various
TransPort. See also Stream Isolation. By default, using system DNS on Whonix-Workstation™ does not require Whonix-Gateway system DNS.  Modifications to
/etc/resolv.conf on Whonix-Gateway do not affect Whonix-Workstation.
Whonix-Gateway is only configured to use various
SocksPorts. A global system DNS resolver for resolving DNS requests from applications running on Whonix-Gateway isn't necessary for most common use cases, so it isn't enabled by default. Potential use cases where this could be beneficial include:
- Resolving the hostname of a proxy specified in
/usr/local/etc/torrc.d/50_user.confvia Tor (technical explanation).
- Resolving the hostname of a VPN. However, a VPN configuration using only IPs would be more suitable.
- One could consider using
/etc/hostsfor such scenarios instead of enabling system DNS.
Whonix-Gateway Default System DNS Setting
As of this writing, no DNS server is pre-configured.
To verify this, users can run the command below. This command will display all lines in the system DNS configuration file
/etc/resolv.conf except those that are commented out (lines starting with a hash ("
cat /etc/resolv.conf | grep --invert-match \#
Whonix-Gateway System DNS Configuration
Whonix-Gateway System DNS over Clearnet
- This is generally not recommended and is often unnecessary.
- However, it simplifies the setup when using Bridges with Snowflake.
Clearnet Whonix-Gateway System DNS.
1. Apply the following changes to Whonix-Gateway™.
/etc/resolv.conf in an editor with root rights.
NOTE: When using Qubes-Whonix, this needs to be done inside the Template.
Others and Alternatives
- This is just an example. Other tools could achieve the same goal.
- If this example does not work for you or if you are not using Whonix, please refer to this link.
2. Uncomment the line
Remove the hash ("
nameserver. This means you should change
#nameserver 10.0.2.3 to
3. Follow platform-specific steps:
- Non-Qubes-Whonix: Done.
- Qubes-Whonix™: This should typically work. If not, refer to the footnote. 
The configuration for Whonix-Gateway System DNS is complete.
- If you're using Snowflake, testing this is typically unnecessary.
To test, use the Whonix-Gateway user named
bash as user
sudo -u clearnet bash
To verify, you can use a tool like ping:
Whonix-Gateway System DNS over Tor
This approach is generally not recommended and is often unnecessary.
Torified Whonix-Gateway System DNS.
Starting from Whonix version
0.2.1, traffic from Whonix-Gateway is also routed over Tor. This approach conceals the use of Whonix from entities monitoring the network.
- For preserving the anonymity of a user's Whonix-Workstation activities, it isn't essential to route Whonix-Gateway's own traffic through Tor.
For those interested: Altering DNS settings on Whonix-Gateway in
/etc/resolv.confonly impacts DNS requests made by Whonix-Gateway's applications that utilize the system's default DNS resolver. By default, no applications on Whonix-Gateway that generate network traffic utilize this default resolver. All default applications on Whonix-Gateway that produce network traffic (like apt, systemcheck, sdwdate) are explicitly configured, or force by uwt wrappers, to use their dedicated Tor
SocksPort(refer to Stream Isolation).
Whonix-Workstation's default applications are configured to use dedicated Tor
SocksPorts(see Stream Isolation), avoiding the system's default DNS resolver. Any applications in Whonix-Workstation not set up for stream isolation - such as
nslookup- will employ the default DNS server configured in Whonix-Workstation (through
/etc/network/interfaces), which points to Whonix-Gateway. These DNS requests are then redirected to Tor's DnsPort by the Whonix-Gateway firewall. Changes in Whonix-Gateway's
/etc/resolv.confdon't influence Whonix-Workstation's DNS queries.
Traffic produced by the Tor process, which by Debian's default operates under the user
debian-tororiginating from Whonix-Gateway, can access the internet directly. This is permitted because Linux user account
debian-toris exempted in the Whonix-Gateway Firewall and allowed to use the "regular" internet.
0.4.5.6(with no changes announced at the time of writing), the Tor software predominantly relies on TCP traffic. For further details, see Tor wiki page, chapter UDP. For DNS, please refer to the next footnote.
Tor doesn't depend on, nor uses a functional (system) DNS for most of its operations. IP addresses of Tor directory authorities are hardcoded in the Tor software by Tor developers. Exceptions are:
- Proxy settings that use proxies with domain names instead of IP addresses.
- Some Tor pluggable transports such as meek lite, which resolves domains set in
front=to IP addresses or snowflake's
This is because DNS traffic originating from Whonix-Workstation is redirected to Tor's
DNSPortrunning on Whonix-Gateway by the Whonix-Gateway Firewall.
- To identify the IP to substitute, execute the command below:
- qubesdb-read /qubes-netvm-primary-dns
- For example, the output might be:
- In this case, replace
10.139.1.1. Note: Use the actual IP from the output of the
This is analogous to logging in as the user