How to configure Whonix Gateway for communication between two local Workstations in Qubes?

Question

I'm running Qubes with two Whonix Workstations side-by-side on the same Whonix Gateway. I'd like to set up SSH communication between them: locally, not through the onionsphere.

How do I configure the Whonix Gateway to properly route these local TCP packets?

Or pending that, what is the nature of the Whonix routing and firewall setup, or where do I go to learn it?

Answer 1

sys-whonix is not set up to forward packets between VMs, and doing has not been evaluated for leaks. Instead, qrexec should be used for inter-vm communication.

1. In dom0, create a file /etc/qubes-rpc/policy/local.ssh containing the line:

   srcVMname destVMname allow
   

   Replace with the actual names of your VMs. Repeat this line for as many connection pairs as needed. This informs Qubes to allow srcVM to execute the script 'local.ssh' in destVM; see https://www.qubes-os.org/doc/qrexec3/#qubes-rpc-administration for more

2. In each destVM, create a file /etc/qubes-rpc/local.ssh, containing the line:

   exec socat STDIO TCP-CONNECT:localhost:22
   

   This is a simple script that binds its input and output to a local connection on port 22, the ssh port.

3. In each srcVM, add two lines to either ~/.ssh/config or /etc/ssh/ssh_config:

   Host destVMname
       ProxyCommand qrexec-client-vm %h local.ssh
   

   Replace destVMname with the actual name of your destination vm. This tells ssh that when you ask to connect to destVMname, it should run an inter-vm process instead of making a network connection.

That's it! Thanks to Patrick and entr0py for doing most of the work figuring out that this is the right approach at https://forums.whonix.org/t/multiple-whonix-workstations-that-can-communicate-with-each-other/2524/16 .