0

I set up Whonix Gateway, Workstation and Iceweacel. I also set up a Proxy on Iceweaceal (in Preferences) at the Gateway and now my IP address is defined as the one on the proxy. But I'm confused ... Whonix have isolation and respectively, all inbound connections must pass first through the Gateway, where there is no proxy. For example: Workstation-Gateway-TOR-Internet

In this scheme proxy can not be configured in the Workstation, but maybe on the Gateway. So, the question is, how proxy works on the Workstation?

Improve this question

1 Answer 1

Reset to default
1

There are no unsolicited inbound connections except hidden services when you set some up. (Different Tor Hidden Services are automatically stream isolated.) Solicited (related) incoming connections are stream isolated by Tor. As I understand, answers for requests come in the same way through the Tor network they were sent. They don't take some random way back. That is up to Tor. None of this is specific to Whonix.

Whonix-Gateway also uses transparent proxying for Whonix-Workstation. All applications on the workstation not configured to use a SocksPort by socks proxy settings or forced to use a SocksPort by a socksifier (such as uwt/torsocks) will be routed through Tor's TransPort. These are stream isolated form all connections using Tor SocksPorts. But inside the TransPort these are mixed up and cannot be further stream isolated. The transparent proxying feature can be optionally disabled, see Whonix documentation on how to do so if you want to do that.

( https://www.whonix.org/wiki/Stream_Isolation )

(I hope you did not overlook the big warning message Do not use this browser for anything other than downloading Tor Browser, unless you know what you are doing! after starting iceweasel.)

Full disclosure: I am a maintainer of Whonix.

Improve this answer
2
  • Thanks for the answer! Do I understand correctly that in the case of use the proxy on iceweasel, the traffic does NOT pass through the TOR at all? And then we get the scheme: Workstation -> Proxy -> Internet? (WITHOUT tor, and we get deanonymization as result)
    – ideloxew
    Commented May 12, 2016 at 8:02
  • Do I understand correctly that in the case of use the proxy on iceweasel, the traffic does NOT pass through the TOR at all? Wrong. There is no way for traffic from Whonix-Workstation to circumvent Whonix-Gateway/Tor. [Without making non-trivial undocumented modifications to Whonix-Gateway that do not happen by chance.] See documentation on tunnels: whonix.org/wiki/Tunnels/Introduction Please use the same connection schemes as in Whonix documentation. User -> Tor -> proxy/VPN/SSH -> Internet etc.
    – adrelanos
    Commented May 13, 2016 at 13:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .