Can somebody please advise me about setting up isolatation proxying using Win 7 home premium / virtualbox / whonix?

Question

My desktop is running windows 7 home premium x64 (host). I have the latest version of Virtualbox and have setup the latest version of Whonix gateway 8.1 which is up-to-date. I want to use Whonix gateway as a means of setting up a isolation proxying with the host accessing the internet via the Whonix gateway VM (gateway).

The generic instructions on the Whonix site https://www.whonix.org/wiki/Other_Operating_Systems. I have followed the instructions but neither the gateway nor the host are able to connect to the network.

I found that it would make more sense to use VirtualBox bridge interface, than the internal interface. Research indicated that the host would not be able to this network. Practically if this is enabled the gateway is not able to access the network. This would make sense as it is trying to access the network via windows which is trying to access via VirtualBox. I've found that if I set one of the networks to bridged then the gateway is able to connect. I have not been successful in getting the host to connect through the gateway. I've setup static IP addresses for both the host and the 2 whonix bridges. Windows either complains that it cannot access the DNS server or that I should enable DHCP, which would bipass whonix and defeat the point of installing it.

Does anybody have any advice about how I can proceed with this setup?

Thanks,

Answer 1

Whonix-Gateway does not and did never support to route any host operating system through Whonix-Gateway. That would be difficult, I think, because then Tor inside Whonix-Gateway would somehow to have an exception to be allowed to directly connect to the internet without being forced through Tor. Even more difficult with Windows, because in my experience, there is better documentation for advanced stuff using iptables than there is for Windows firewall.

There was something vaguely related long time ago. It was possible to install Tor on the host and to run just one VM. It was called OneVM. Deprecated for a long time. I guess what you want to do would be similarly difficult. Most likely you would have to wrestle with Windows firewall rules.

What could work and what would be simple in comparison would be using Whonix with Physical Isolation.

Another software maybe capable of this (never tested) might be TorWall. There also was another software doing something similar like TorWall, but I forgot its name.

Anyhow. What you are attempting to do is recommended against. Due to protocol leaks you wouldn't be anonymous at all when you just route your every day operating system that you used for non-anonymous stuff beforehand through Tor. See TransparentProxyLeaks.

Full disclosure:
I am a maintainer of Whonix.

Answer 2

I don't recommend that OP do this. With just one VM, it's best to put the workspace there. That's because it's the workspace that will most likely get pwned, and you want that to be isolated from the Tor client. Also, doing any of this with Windows or OS X as the host OS is rather weak.

If OP still wants to do this, it's possible. One would bridge eth0 (WAN) of the Whonix gateway to the host's physical NIC, and attach the gateway's eth1 (LAN) to a host-only adapter, and so to a Microsoft loopback interface on the host. Then one would set up firewall rules in the host that allow only VirtualBox to use the host's physical NIC, and restrict everything else to the loopback interface.

I don't know enough Windows for that. Perhaps another can help with the details.