Whonix-Gateways Own Traffic Transparent Proxy
Advanced users only!
Usually recommended against and unnecessary!
Whonix-Workstation has the transparent proxying feature enabled by default. (You could disable it if you wanted to.)
Whonix-Gateway has by default no transparent proxying feature. This article explains how you could enable it. There are no known use cases besides leak testing.
For explanation, openand read what the settings and are about.
Open /etc/whonix_firewall.d/30_user in an editor.
Open /etc/whonix_firewall.d/50_user.conf in an editor with root rights.
Add the following content.
Reload Whonix-Gateway Firewall.
From Whonix 14 onwards, all user unique Tor configurations should be stored in /usr/local/etc/torrc.d/50_user.conf and not anywhere else. Note that Whonix will not modify /usr/local/etc/torrc.d/50_user.conf once it is created, therefore the user is responsible for adding or removing specific configurations in this file.
Add the following content.
TransPort 127.0.0.1:9041 DnsPort 127.0.0.1:54
Test if you wish.
UWT_DEV_PASSTHROUGH=1 curl --tlsv1.2 --proto =https -H 'Host: check.torproject.org' -k https://18.104.22.168
- Getting the global system DNS resolver working on Whonix-Gateway (usually recommended against and unnecessary)
- Since Whonix 0.2.1, Whonix-Gateway traffic is also routed over Tor. In this way, use of Whonix is hidden from persons or systems observing the network.
- To preserve the anonymity of a user's Whonix-Workstation activities, it is not necessary to torify Whonix-Gateway's own traffic.
- For reader interest: If DNS settings on Whonix-Gateway are changed in Stream Isolation). , this only affects Whonix-Gateways's own DNS requests issued by applications using the system's default DNS resolver. By default, no applications issuing network traffic on Whonix-Gateway use the system's default DNS resolver. All applications installed by default on Whonix-Gateway that issue network traffic (apt-get, whonixcheck, timesync) are explicitly configured, or forced by uwt wrappers, to use their own Tor SocksPort (see
- Whonix-Workstation's default applications are configured to use separate Tor SocksPorts (see Stream Isolation), thereby not using the system's default DNS resolver. Any applications in Whonix-Workstation that are not configured for stream isolation - for example - will use the default DNS server configured in Whonix-Workstation (via ), which is the Whonix-Gateway. Those DNS requests are redirected to Tor's DnsPort by Whonix-Gateway's firewall. Whonix-Gateway's does not affect Whonix-Workstation's DNS requests.
This is a wiki. Want to improve this page? Help is welcome and volunteer contributions are happily considered! See Conditions for Contributions to Whonix, then Edit! IP addresses are scrubbed, but editing over Tor is recommended. Edits are held for moderation.