I'm running Qubes with two Whonix Workstations side-by-side on the same Whonix Gateway. I'd like to set up SSH communication between them: locally, not through the onionsphere.

How do I configure the Whonix Gateway to properly route these local TCP packets?

Or pending that, what is the nature of the Whonix routing and firewall setup, or where do I go to learn it?


1 Answer 1


sys-whonix is not set up to forward packets between VMs, and doing has not been evaluated for leaks. Instead, qrexec should be used for inter-vm communication.

  1. In dom0, create a file /etc/qubes-rpc/policy/local.ssh containing the line:

    srcVMname destVMname allow

    Replace with the actual names of your VMs. Repeat this line for as many connection pairs as needed. This informs Qubes to allow srcVM to execute the script 'local.ssh' in destVM; see https://www.qubes-os.org/doc/qrexec3/#qubes-rpc-administration for more

  2. In each destVM, create a file /etc/qubes-rpc/local.ssh, containing the line:

    exec socat STDIO TCP-CONNECT:localhost:22

    This is a simple script that binds its input and output to a local connection on port 22, the ssh port.

  3. In each srcVM, add two lines to either ~/.ssh/config or /etc/ssh/ssh_config:

    Host destVMname
        ProxyCommand qrexec-client-vm %h local.ssh

    Replace destVMname with the actual name of your destination vm. This tells ssh that when you ask to connect to destVMname, it should run an inter-vm process instead of making a network connection.

That's it! Thanks to Patrick and entr0py for doing most of the work figuring out that this is the right approach at https://forums.whonix.org/t/multiple-whonix-workstations-that-can-communicate-with-each-other/2524/16 .

  • This can of course be extended to any other network connection, other than ssh, through proper use of socat
    – xloem
    Dec 31, 2016 at 12:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .