Introduction[edit]

When using Whonix ™, it is still possible to volunteer to Tor by hosting a bridge, private bridge, obfuscated bridge, private obfuscated bridge, middle node or exit relay. This configuration is set up either inside Whonix-Gateway ™ or directly on the host.

Rationale[edit]

Anonymity might or might not ^[archive] be improved by hosting a Tor relay and/or bridge and using it to mix personal client Tor traffic. The reason is adversaries observing traffic will need to perform classification of both traffic generated by the Tor relay or bridge and your personal client traffic. To learn more about this topic, refer to posts by The Tor Project (developers of the Tor software). ^[1]

Quote The Tor Project New low cost traffic analysis attacks and mitigations ^[archive]:

In terms of mitigating the use of these vectors in attacks against Tor, here's our recommendations for various groups in our community:

Users: Do multiple things at once with your Tor client

Because Tor uses encrypted TLS connections to carry multiple circuits, an adversary that externally observes Tor client traffic to a Tor Guard node will have a significantly harder time performing classification if that Tor client is doing multiple things at the same time. This was studied in section 6.3 of this paper ^[archive] by Tao Wang and Ian Goldberg. A similar argument can be made for mixing your client traffic with your own Tor Relay or Tor Bridge that you run, but that is very tricky to do correctly ^[archive] for it to actually help.

Configuration[edit]

Outside Whonix-Gateway ™[edit]

This procedure is currently Undocumented. Help is most welcome to complete this section.

Inside Whonix-Gateway ™[edit]

Introduction[edit]

This procedure has not been tested for a significant period; please contact Whonix ™ developers if you are interested in this configuration.

This configuration is non-trivial for reasons outside of Whonix ™ control and is mostly unspecific to the platform. An open port is required to allow unsolicited incoming connections; see Ports for an explanation.

Prerequisite Knowledge[edit]

Before attempting this setup, various learning exercises are recommended beforehand.

1. Set up a web server reachable on PC. For example: Internet → home router → PC → web server
2. Set up a web server reachable in VM. For example: Internet → home router → PC → Debian (not Whonix ™) VM → web server

After succeeding with the above configurations, then try the same with Tor in Whonix ™.

Instructions[edit]

sudo mkdir -p /usr/local/etc/whonix_firewall.d

sudoedit /usr/local/etc/whonix_firewall.d/50_user.conf

## Please use "/etc/whonix_firewall.d/50_user.conf" for your custom configuration,
## which will override the defaults found here. When {{project_name}} is updated, this
## file may be overwritten.

nano /etc/whonix_firewall.d/30_whonix_gateway_default.conf

## Allow incoming DIRPORT connections for an optional Tor relay.
GATEWAY_ALLOW_INCOMING_DIR_PORT=1

## Allow incoming ORPORT connections for an optional Tor relay.
GATEWAY_ALLOW_INCOMING_OR_PORT=1

## DIRPORT incoming port.
DIR_PORT=80

## ORPORT incoming port.
OR_PORT=443

sudo whonix_firewall

Easy Option: Snowflake Pluggable Transport[edit]

It was previously possible to install the Flashproxy bridge add-on in Chrome, Chromium and Firefox to help censored users access Tor. Essentially this performed as a miniature proxy that ran in the web browser, checked for clients needing access, and conveyed data between them and a Tor relay. ^[2] However, after being operational between 2013 and 2016, Flashproxy was deprecated in 2017.

The modern alternative to Flashproxy is Snowflake: ^{[3] [4]}

Snowflake is an improvement upon Flashproxy. It sends your traffic through WebRTC, a peer-to-peer protocol with built-in NAT punching.

This system is composed of three components: volunteers running Snowflake proxies, Tor users that want to connect to the internet, and a broker, that delivers snowflake proxies to users. ... Volunteers willing to help users on censored networks can help by spinning short-lived proxies on their regular browsers. ... Snowflake uses the highly effective domain fronting ^[archive] technique to make a connection to one of the thousands of snowflake proxies run by volunteers. These proxies are lightweight, ephemeral, and easy to run, allowing us to scale Snowflake more easily than previous techniques.

To assist censored users, the Snowflake pluggable transport can be installed in Tor Browser / Firefox or Chrome. Note that websites that are browsed by censored users will match their Tor exit node, not yours:

• Tor Browser / Firefox ^[archive]
• Chrome ^[archive]

To learn more about Snowflake, see here ^[archive] (v3 ^[archive]). Note that it is also possible to run a standalone Snowflake proxy ^[archive] (v3 ^[archive]) on a server, but this configuration has not yet been attempted in Whonix ™.

Footnotes[edit]

	100px
Fosshost	About Advertisements

Search engines: YaCy | Qwant | ecosia | MetaGer | peekier | Whonix ™ Wiki

Follow:

Support:

Donate:

Priority Support | Investors | Professional Support

Whonix ™ | © ENCRYPTED SUPPORT LP | Freedom Software / Open Source (Why?)

The personal opinions of moderators or contributors to the Whonix ™ project do not represent the project as a whole.