Have a look at the Network Filter documentation.
.... This is solved by blocking all outbound Internet traffic except
Tor (and I2P when enabled), and explicitly configuring all
applications to use one of these.
config/chroot local-includes/etc/ferm/ferm.conf (uses ferm to build an
When I run Tor software, in theory my computer becomes a relay
Not by default.
You have to purposefully configure the Tor software to be a relay. And if you're doing that, you hopefully know how to configure your router to forward a port to your computer so you can run a relay on it.
You should read about how nmap works and how iptables transproxying works or SOCKS proxying works and then realise that you will not be able to effectively nmap over a whonix gateway nor should you ever.
Nmap uses by default the "SYN Scan" technique, this means that it sends a TCP SYN packet to each of the ip:port pairs on the list, if it gets a SYN+ACK ...
You might look at the pluggable transports like obfsproxy which is designed with DPI in mind. You might also try using a bridge relay rather than the regular 9 directory authority servers. These are the two typical ways firewalls can be bypassed that I know of.
There is a possibility that the snowflake project might be of use to you. While the frontpage talks mostly about browsers, there is an experimental Go-based standalone implementation which might be able to run on your behind-the-NAT server. It isn't a proper Tor relay, merely a way for those who are severely restricted to get into the Tor network proper, ...
if it's(a firewall you can't manage directly) not supporting UPnP - there's no way. You can use a VPN service with static IP : you're connecting from outside, obtaining an IP address inside your box and you're ready to go.
The only approach to this is to use something like a "no-root" firewall. A "no-root" firewall uses the same principle as the Orbot VPN mode, except it uses it's position to deny connections to specific apps.
In this way, you could deny connections to all apps, except for Orbot effectively only allowing apps that can locally talk to Orbot be able to reach ...
When you "reset" (I assume you mean you flushed/cleared) iptables, you also killed the iptables rule which was redirecting traffic destined to 127.0.0.1:53 to 127.0.0.1:5353. The latter IP/Port is where Tor is actually listening and DNS requests are no longer able to reach the DNS listener and so nothing will resolve anymore.
You will either need to take a ...
You need to follow Whonix documentation for combining VPNs. Otherwise they conflict with Whonix's firewall.
Should I be concerned or do anything about it?
Ubuntu comes with a firewall, called ufw (Uncomplicated Firewall) which should suffice, it is a front end to the Linux iptables packet filter.
To enable it:
sudo ufw allow 9001/tcp #change 9001 to your chosen ORPort
sudo ufw allow 22/tcp #if you remotely administrate with ssh
sudo ufw enable
You may need to add additional lines if there are other services ...
Malwarebytes is blocking Tor - it's a known issue. If I got you right - you have two antiviruses on one PC, it's a bad idea nowdays: I remember 1994 - yes, then it made some sense, but not now. Some network filtering is remaining when the AV is deactivated, and - if your host is also Windows - it can activate windows defender+firewall when disabling other ...
sys-whonix is not set up to forward packets between VMs, and doing has not been evaluated for leaks. Instead, qrexec should be used for inter-vm communication.
In dom0, create a file /etc/qubes-rpc/policy/local.ssh containing the line:
srcVMname destVMname allow
Replace with the actual names of your VMs. Repeat this line for as many connection pairs as ...
Write a server and learn the ways: You listen to a port, say 53 and then block all use of port 53. Nobody else can use it, and you are notified by the kernel of new messages on this. You do not open it like a file, but bind and connect to it, and after "fd = Connect();" you listen() to it and can even use regular "read(fd, buf,len)" and "write(fd,buf,len)" ...
The Tor project website and the download can be blocked and have been in the past and currently in some locations in the world. That is why they even offer to email you a copy or send you a secure download if you reach out to them on twitter or other means to get a copy.
"two different rules sets for static IP/manual as apposed to DHCP?"
No, it has one config that applies to all situations.
"can a server/router [...] send packets [...] that can go through the firewall"
Yes, otherwise you'd never receive any replies from connection attempts.
"Does the static IP connection work as a loop back only or is it unidirectional?"
You prevent IP leaks by using the tor browser bundle in its most paranoid security setting.
Enabling plugins will expose you to deanonymouzation techniques. Enabling a firewall does not help.
The reason the defaults are the way they are is for your safety. Do not change them unless you understand the consequences.
"Tails may be made a more secure OS by preventing the firewall from allowing unencrypted data."
No. There is no meaningful way to discern between "encrypted" an "unencrypted". Furthermore day-to-day network usage (DHCP, etc) depend on it being able to send unencrypted traffic and access to "captive portals" and local resources are required by many of it's ...