Only one machine. Either a real or virtual machine (VM). All traffic is routed through Tor. An Anonymizing Transparent Proxy.

Testers only!

COMMUNITY SUPPORT ONLY : THIS WHOLE WIKI PAGE is only supported by the community. Whonix developers are very unlikely to provide free support for this content. See Community Support for further information, including implications and possible alternatives.

Introduction[edit]

Whonix needs at least two systems. One running Tor, Whonix-Gateway. The other running clients that are routed through Tor, Whonix-Workstation^™. This ensures the highest possible security and isolation. We can implement this using different strategies: Two VMs (Gateway VM and Workstation VM) or bare metal.

A different approach is to run Tor and applications all on the same machine. This can be either a VM or bare metal host.

This site will guide you through all required steps to set up a UniStation. A machine which routes all traffic through the Tor anonymity network. This is an implementation of a Tor TransparentProxy.

Advantages:

Only one machine required.
Lower system requirements.

Disadvantages:

More difficult to install.
User might have to set the network interface setting.
If using VMs: Guest VM can see MAC address of host?
Less secure than Whonix with Whonix-Gateway and Whonix-Workstation.
This is not as well polished, developed and thought through as Whonix yet.
Enhancements that come with Whonix-Workstation such as:
- Tor Browser
- anon-apps-config
- systemcheck
- Whonix Live
- kloak
- tirdad
- AppArmor
- Anon Connection Wizard
- sdwdate-gui
- open-link-confirmation
- Bridges usability, Documentation
- and maybe others
have not been considered yet.
This will potentially not be maintained as well as Whonix.

Prerequisites[edit]

1. Confirm prerequisites are met.

Debian bookworm is installed.
User account user exists.

2. Become root. ^[1] ^[2]

su -

3. Install sudo and adduser packages.

1. Update the package lists.

apt update

2. Upgrade the system.

apt full-upgrade

3. Install sudo and adduser packages.

apt install --no-install-recommends sudo adduser

4. Set user rights.

The following commands must be run either by root or using sudo.

Create group console.

addgroup --system console

Add user user to group console.

adduser user console

Add user user to group sudo.

adduser user sudo

5. Reboot. ^[3]

reboot

Installation[edit]

Packages[edit]

Install gnupg. ^[4]

sudo apt install gnupg

There are two different options to enable the Whonix APT repository. Choose one. ^[5]

1. Install package extrepo.

sudo apt install extrepo

2. Enable the stable whonix APT repository. (See footnote for other options.) ^[6]

===

Whonix

sudo extrepo enable whonix

===

Qubes-Whonix Template (whonix-workstation-17)

sudo http_proxy=http://127.0.0.1:8082 https_proxy=http://127.0.0.1:8082 extrepo enable whonix

3. Advanced options.

For advanced options such as clearnet over Tor or onion. ^[7]

Please press on expand on the right side.

Optional.

Install apt-transport-tor.

Install package(s) apt-transport-tor following these instructions

Platform specific notice.

Non-Qubes-Whonix: No special notice.
Qubes-Whonix: In Template.

Update the package lists and upgrade the system .

sudo apt update && sudo apt full-upgrade

Install the apt-transport-tor package(s).

Using apt command line --no-install-recommends option is in most cases optional.

sudo apt install --no-install-recommends apt-transport-tor

Platform specific notice.

Non-Qubes-Whonix: No special notice.
Qubes-Whonix: Shut down Template and restart App Qubes based on it as per Qubes Template Modification .

Done.

The procedure of installing package(s) apt-transport-tor is complete.

Find out filename.

ls -la /etc/apt/sources.list.d/extrepo_*

NOTE: Filename will be different if using a repository other than the stable repository such as the testers repository.

Open file /etc/apt/sources.list.d/extrepo_kicksecure.sources in an editor with root rights.

This box uses sudoedit for better security.

sudoedit /etc/apt/sources.list.d/extrepo_kicksecure.sources

NOTES:

When using Qubes-Whonix, this needs to be done inside the Template.

sudoedit /etc/apt/sources.list.d/extrepo_kicksecure.sources

After applying this change, shutdown the Template.
All App Qubes based on the Template need to be restarted if they were already running.
This is a general procedure required for Qubes and unspecific to Qubes-Whonix^™.

This is just an example. Other tools could achieve the same goal.
If this example does not work for you or if you are not using Whonix, please refer to this link.

sudoedit /etc/apt/sources.list.d/extrepo_kicksecure.sources

Choose either option A) or B).

A) Clearnet over Tor Repository: To enable clearnet over Tor, tor+ needs do be prepended in front of the https. The same in other words, look for Uris: https and replace it with Uris: tor+https .
B) Onion Repository: To enable onion, look for the line starting with Uris:. Delete the whole line. Or out-comment it by adding as hash ("#") in front of it. Then add a new line: Uris: tor+http://deb.dds6qkxpwdeubwucdiaord2xgbbeyds25rbsgr73tbfpqpt4a6vjwsyd.onion

4. Done.

The Whonix APT repository has been enabled ^[8]

Add Signing Key

Complete the following steps to add the Whonix Signing Key to the system's APT keyring.

Open a terminal.

1. Package curl needs to be installed.

Install package(s) curl following these instructions

Platform specific notice.

Non-Qubes-Whonix: No special notice.
Qubes-Whonix: In Template.

Update the package lists and upgrade the system .

sudo apt update && sudo apt full-upgrade

Install the curl package(s).

Using apt command line --no-install-recommends option is in most cases optional.

sudo apt install --no-install-recommends curl

Platform specific notice.

Non-Qubes-Whonix: No special notice.
Qubes-Whonix: Shut down Template and restart App Qubes based on it as per Qubes Template Modification .

Done.

The procedure of installing package(s) curl is complete.

2. Download Whonix Signing Key. ^[9]

Choose your operating system.

If you are using Debian, run.

Choose TLS or onion.

TLS (Debian)

sudo curl --tlsv1.3 --output /usr/share/keyrings/derivative.asc --url https://www.whonix.org/keys/derivative.asc

onion (Debian)

Downloading over onion requires an already functional system Tor.

sudo torsocks curl --output /usr/share/keyrings/derivative.asc --url http://www.dds6qkxpwdeubwucdiaord2xgbbeyds25rbsgr73tbfpqpt4a6vjwsyd.onion/keys/derivative.asc

If you are using a Qubes Debian Template, run.

Choose TLS or onion.

TLS (Qubes)

sudo http_proxy=http://127.0.0.1:8082 https_proxy=http://127.0.0.1:8082 curl --tlsv1.3 --output /usr/share/keyrings/derivative.asc --url https://www.whonix.org/keys/derivative.asc

onion (Qubes)

Downloading over onion requires an already functional system Tor.

sudo torsocks curl --output /usr/share/keyrings/derivative.asc --url http://www.dds6qkxpwdeubwucdiaord2xgbbeyds25rbsgr73tbfpqpt4a6vjwsyd.onion/keys/derivative.asc

3. Users can check Whonix Signing Key for better security.

4. Done.

The procedure of adding the Whonix signing key is now complete.

Add Repository

Add the Whonix APT Repository.

Choose either: Option A, Option B OR Option C

Option A: Add Whonix Onion Repository.

To add Whonix Repository over Onion please install apt-transport-tor from the Debian repository.

sudo apt install apt-transport-tor

Add Whonix APT repository for default Whonix using Debian stable. At the time of writing this was bookworm.

echo "deb [signed-by=/usr/share/keyrings/derivative.asc] tor+http://deb.dds6qkxpwdeubwucdiaord2xgbbeyds25rbsgr73tbfpqpt4a6vjwsyd.onion bookworm main contrib non-free" | sudo tee /etc/apt/sources.list.d/derivative.list

Option B: Add Whonix Clearnet Repository over Tor.

To add Whonix Repository over torified clearnet install apt-transport-tor from the Debian repository.

sudo apt install apt-transport-tor

Add Whonix APT repository for default Whonix using Debian stable. At the time of writing this was bookworm.

echo "deb [signed-by=/usr/share/keyrings/derivative.asc] tor+https://deb.whonix.org bookworm main contrib non-free" | sudo tee /etc/apt/sources.list.d/derivative.list

Option C: Add Whonix Clearnet Repository over clearnet.

NOTE: When later using Whonix repository tool, then this will be upgraded to "Clearnet Rep. via Tor", unless see footnote. ^[10]

To add Whonix Repository over clearnet please add Whonix APT repository for default Whonix using Debian stable. At the time of writing this was bookworm.

echo "deb [signed-by=/usr/share/keyrings/derivative.asc] https://deb.whonix.org bookworm main contrib non-free" | sudo tee /etc/apt/sources.list.d/derivative.list

The procedure of adding the Whonix repository is now complete.

Install package(s) usability-misc following these instructions

Platform specific notice.

Non-Qubes-Whonix: No special notice.
Qubes-Whonix: In Template.

Update the package lists and upgrade the system .

sudo apt update && sudo apt full-upgrade

Install the usability-misc package(s).

Using apt command line --no-install-recommends option is in most cases optional.

sudo apt install --no-install-recommends usability-misc

Platform specific notice.

Non-Qubes-Whonix: No special notice.
Qubes-Whonix: Shut down Template and restart App Qubes based on it as per Qubes Template Modification .

Done.

The procedure of installing package(s) usability-misc is complete.

^[11]

sudo apt-get-noninteractive install --no-install-recommends kicksecure-cli whonix-firewall uwt anon-gw-anonymizer-config

Firewall Settings[edit]

Find out your network interface name. You can learn about what interfaces you have by running.

sudo ifconfig

Edit /etc/whonix_firewall.d/50_user.conf.

sudoedit /etc/whonix_firewall.d/50_user.conf

Paste.

You might have to change #EXT_IF="eth0" by removing the hash # in front of it and by setting it to the name of your network interface such as wlan0. I.e. the full line might look like this: EXT_IF="wlan0" Include it with the to be pasted text below. ^[12]

## 0: disabled ## 1: enabled ## External interface ## defaults to: #EXT_IF="eth0" WORKSTATION_TRANSPARENT_TCP=0 WORKSTATION_TRANSPARENT_UDP=0 WORKSTATION_TRANSPARENT_DNS=0 WORKSTATION_ALLOW_SOCKSIFIED=0 CONTROL_PORT_FILTER_PROXY_ENABLE=0 GATEWAY_TRANSPARENT_TCP=1 GATEWAY_TRANSPARENT_UDP=0 GATEWAY_TRANSPARENT_DNS=1 GATEWAY_ALLOW_INCOMING_ICMP=0

If you want port 22 to open for incoming SSH, also paste:

GATEWAY_ALLOW_INCOMING_SSH=1

Save.

Qubes[edit]

Qubes only. Does not hurt otherwise.

sudo systemctl mask qubes-iptables

Qubes Debian based VMs would require further /etc/whonix_firewall.d/50_user.conf modifications. See footnote. ^[13]

torsocks[edit]

torsocks config not required. uwt sets that up for us.

Tor Configuration[edit]

Open Tor configuration file /etc/tor/torrc with root rights.

sudoedit /etc/tor/torrc

Paste. ^[14]

TransPort 127.0.0.1:9041 DnsPort 127.0.0.1:5400 DisableNetwork 0

Save.

Restart Tor.

sudo systemctl restart tor

APT[edit]

Check if there is something you need in /etc/apt/sources.list.

Move original /etc/apt/sources.list out of the way because /etc/apt/sources.list.d/debian.list by Kicksecure^™ replaces it.

sudo mv /etc/apt/sources.list ~/

Reboot[edit]

Reboot required.

sudo reboot

Usage[edit]

check sdwdate[edit]

sudo systemctl status sdwdate --no-pager

Updates[edit]

Update as per usual. See also Operating System Software and Updates.

Thanks to uwt it is stream isolated (using Tor SocksPort). No need to use torsocks. uwt uses torsocks which is configued to use IsolatePID 1.

sudo apt update

Transparent DNS Functional[edit]

nslookup torproject.org

Server:		127.0.0.1
Address:	127.0.0.1#53

Non-authoritative answer:
Name:	torproject.org
Address: 95.216.163.36
** server can't find torproject.org: NXDOMAIN

Transparent DNS Functional[edit]

cd /tmp

wget.anondist-orig torproject.org

--2019-12-10 12:25:43--  http://torproject.org/
Resolving torproject.org (torproject.org)... 95.216.163.36
Connecting to torproject.org (torproject.org)|95.216.163.36|:80... connected.
HTTP request sent, awaiting response... 302 Found
Location: https://www.torproject.org/ [following]
--2019-12-10 12:25:45--  https://www.torproject.org/
Resolving www.torproject.org (www.torproject.org)... 116.202.120.165
Connecting to www.torproject.org (www.torproject.org)|116.202.120.165|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 19623 (19K) [text/html]
Saving to: ‘index.html’

index.html                  100%[===========================================>]  19.16K  62.3KB/s    in 0.3s

2019-12-10 12:25:47 (62.3 KB/s) - ‘index.html’ saved [19623/19623]

Troubleshooting[edit]

Depending on network configuration perhaps /etc/whonix_firewall.d/50_user.conf need to be appended.

NON_TOR_GATEWAY="\ 127.0.0.0-127.0.0.24 \ 10.137.0.0-10.138.255.255 \ "

Forum Discussion[edit]

https://forums.whonix.org/t/debian-onevm-anononevm-non-self-contained-host-depending-onevm-unistation-a-tor-transparentproxy-with-only-one-machine/5470

Footnotes[edit]

↑ Parameter - is required to set the correct paths to /usr/sbin. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=833256
↑ Other methods are possible.
↑ Usability. Otherwise after installation is complete, user might not be able to login. Needs further testing if still required. Can be avoided for remote servers.
↑ Required for Debian netinst "minimal" (no default system tools).
↑
extrepo vs manual:
- Usability:
  - There are some detail usability differences. Using onion connection might be easier with manual method until Whonix gets ported to Debian 13 / trixie because extrepo might get onion support then.
  - Apart from that, extrepo's usability seems generally better.
- Security:
  - A detailed comparative research of both methods is unavailable.
  - If usability is considered a security feature, then extrepo might be considered more secure. This is because users do not have to learn as much about Verifying Software Signatures, OpenPGP, its many Software Signature Verification Usability Issues. Debian which is already trusted by the user providing a trust path to the Whonix signing key. Manual key fingerprint verification not required.
  - The extrepo project is a huge amount of work adding all the signing keys for many different projects. The code for securely downloading a signing key in the Python is not among the most difficult programming tasks to get correct. Compared with curl (written in C), it might be more secure.
- Keeping support for manual method:
  - Removal of the manual method is not planned. Since already written, the maintenance effort for that very part of documentation is low. In case extrepo signing key is outdated, get deprecated, it's easy to switch back to manual method.
↑ stable-proposed-updates repository: sudo extrepo enable whonix_proposed testers repository: sudo extrepo enable whonix_testers developers repository: sudo extrepo enable whonix_developers
↑ extrepo feature request: extrepo apt-transport-tor and onion support
↑ forum discussion: extrepo - safely adding repos
↑ See Secure Downloads to understand why curl and the parameters --tlsv1.3 are used instead of wget.

Placing an additional signing key into folder /usr/share/keyrings by itself alone has no impact on security as this folder is not automatically used by Debian's APT by default. Only when an APT sources list configuration file points to folder /usr/share/keyrings using the signed-by keyword the signing key will be actually used. Therefore deleting keys in /usr/share/keyrings is optional if intending to disable an APT repository. See also APT Signing Key Folders.
↑ Unless using repository-dist --transport plain-tls. See also man repository-dist.

↑ apt-get-noninteractive to avoid asking this question.

Setting up anon-base-files (3:4.6-1) ...

Configuration file '/etc/machine-id'
 ==> File on system created by you or by a script.
 ==> File also in package provided by package contributor.
   What would you like to do about it ?  Your options are:
    Y or I  : install the package contributor's version
    N or O  : keep your currently-installed version
      D     : show the differences between the versions
      Z     : start a shell to examine the situation
 The default action is to keep your current version.
*** machine-id (Y/I/N/O/D/Z) [default=N] ? i

↑ VirtualBox: EXT_IF="enp0s3"
↑ This was required in Qubes to make Whonix-Gateways Own Traffic Transparent Proxy work. In that case, append to /etc/whonix_firewall.d/50_user.conf. NON_TOR_GATEWAY="\ 127.0.0.0-127.0.0.24 \ 10.137.0.0-10.138.255.255 \ "
↑ DisableNetwork 0 is required to make sdwdate work because the connectivity check locks at it.

Whonix

The most watertight privacy operating system in the world.

Dark mode

Supported by Power Up Privacy

Whonix is proudly supported until 2025 by Power Up Privacy, a privacy advocacy group that seeks to supercharge privacy projects with resources so they can complete their mission of making our world a better place. (Strictly subject to our sponsorship policy.)

At Whonix we value freedom and trust, supporting Open Source and Freedom Software

By using this website, you acknowledge you have read, understood, and agree to be bound by these agreements: Terms of Service, Privacy Policy, Cookie Policy, E-Sign Consent, DMCA, Imprint

2012- 2024 ENCRYPTED SUPPORT LP

Your support makes
all the difference!

We believe security software like Whonix needs to remain open source and independent. Would you help sustain and grow the project? Learn more about our 12 year success story and maybe DONATE!

[1] Parameter - is required to set the correct paths to /usr/sbin. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=833256

[2] Other methods are possible.

[3] Usability. Otherwise after installation is complete, user might not be able to login. Needs further testing if still required. Can be avoided for remote servers.

[4] Required for Debian netinst "minimal" (no default system tools).

[5] extrepo vs manual:
Usability:
There are some detail usability differences. Using onion connection might be easier with manual method until Whonix gets ported to Debian 13 / trixie because extrepo might get onion support then.

Apart from that, extrepo's usability seems generally better.

Security:
A detailed comparative research of both methods is unavailable.

If usability is considered a security feature, then extrepo might be considered more secure. This is because users do not have to learn as much about Verifying Software Signatures, OpenPGP, its many Software Signature Verification Usability Issues. Debian which is already trusted by the user providing a trust path to the Whonix signing key. Manual key fingerprint verification not required.

The extrepo project is a huge amount of work adding all the signing keys for many different projects. The code for securely downloading a signing key in the Python is not among the most difficult programming tasks to get correct. Compared with curl (written in C), it might be more secure.

Keeping support for manual method:
Removal of the manual method is not planned. Since already written, the maintenance effort for that very part of documentation is low. In case extrepo signing key is outdated, get deprecated, it's easy to switch back to manual method.

[6] Usability:
There are some detail usability differences. Using onion connection might be easier with manual method until Whonix gets ported to Debian 13 / trixie because extrepo might get onion support then.

Apart from that, extrepo's usability seems generally better.

[7] There are some detail usability differences. Using onion connection might be easier with manual method until Whonix gets ported to Debian 13 / trixie because extrepo might get onion support then.

[8] Apart from that, extrepo's usability seems generally better.

[9] Security:
A detailed comparative research of both methods is unavailable.

If usability is considered a security feature, then extrepo might be considered more secure. This is because users do not have to learn as much about Verifying Software Signatures, OpenPGP, its many Software Signature Verification Usability Issues. Debian which is already trusted by the user providing a trust path to the Whonix signing key. Manual key fingerprint verification not required.

The extrepo project is a huge amount of work adding all the signing keys for many different projects. The code for securely downloading a signing key in the Python is not among the most difficult programming tasks to get correct. Compared with curl (written in C), it might be more secure.

[10] A detailed comparative research of both methods is unavailable.

[11] If usability is considered a security feature, then extrepo might be considered more secure. This is because users do not have to learn as much about Verifying Software Signatures, OpenPGP, its many Software Signature Verification Usability Issues. Debian which is already trusted by the user providing a trust path to the Whonix signing key. Manual key fingerprint verification not required.

[12] The extrepo project is a huge amount of work adding all the signing keys for many different projects. The code for securely downloading a signing key in the Python is not among the most difficult programming tasks to get correct. Compared with curl (written in C), it might be more secure.

[13] Keeping support for manual method:
Removal of the manual method is not planned. Since already written, the maintenance effort for that very part of documentation is low. In case extrepo signing key is outdated, get deprecated, it's easy to switch back to manual method.

[14] Removal of the manual method is not planned. Since already written, the maintenance effort for that very part of documentation is low. In case extrepo signing key is outdated, get deprecated, it's easy to switch back to manual method.

[6] stable-proposed-updates repository: sudo extrepo enable whonix_proposed testers repository: sudo extrepo enable whonix_testers developers repository: sudo extrepo enable whonix_developers

[7] xtrepo feature request: extrepo apt-transport-tor and onion support

[8] rum discussion: extrepo - safely adding repos

[9] See Secure Downloads to understand why curl and the parameters --tlsv1.3 are used instead of wget.

Placing an additional signing key into folder /usr/share/keyrings by itself alone has no impact on security as this folder is not automatically used by Debian's APT by default. Only when an APT sources list configuration file points to folder /usr/share/keyrings using the signed-by keyword the signing key will be actually used. Therefore deleting keys in /usr/share/keyrings is optional if intending to disable an APT repository. See also APT Signing Key Folders.

[10] Unless using repository-dist --transport plain-tls. See also man repository-dist.

[11] t-get-noninteractive to avoid asking this question.
Setting up anon-base-files (3:4.6-1) ... Configuration file '/etc/machine-id' ==> File on system created by you or by a script. ==> File also in package provided by package contributor. What would you like to do about it ? Your options are: Y or I : install the package contributor's version N or O : keep your currently-installed version D : show the differences between the versions Z : start a shell to examine the situation The default action is to keep your current version. *** machine-id (Y/I/N/O/D/Z) [default=N] ? i

[12] VirtualBox: EXT_IF="enp0s3"

[13] This was required in Qubes to make Whonix-Gateways Own Traffic Transparent Proxy work. In that case, append to /etc/whonix_firewall.d/50_user.conf. NON_TOR_GATEWAY="\ 127.0.0.0-127.0.0.24 \ 10.137.0.0-10.138.255.255 \ "

[14] DisableNetwork 0 is required to make sdwdate work because the connectivity check locks at it.

[1]

[2]

[3]

[4]

[5]

[6]

[7]

[8]

[9]

[10]

[11]

[12]

[13]

[14]

UniStation - A Tor TransparentProxy with only One Machine

Contents

Introduction[edit]

Prerequisites[edit]

Installation[edit]

Packages[edit]

Using extrepo

A : Non-Qubes-Whonix^™

B : Qubes-Whonix^™ Template

Non-Qubes-Whonix^™

Qubes-Whonix^™

Others and Alternatives

Manually

A : Debian

B : Qubes

A : Onion Rep.

B : Clearnet Rep. via Tor

C : Clearnet Rep.

Firewall Settings[edit]

Qubes[edit]

torsocks[edit]

Tor Configuration[edit]

APT[edit]

Reboot[edit]

Usage[edit]

check sdwdate[edit]

Updates[edit]

Transparent DNS Functional[edit]

Transparent DNS Functional[edit]

Troubleshooting[edit]

Forum Discussion[edit]

Footnotes[edit]

Navigation menu

UniStation - A Tor TransparentProxy with only One Machine

Introduction[edit]

Prerequisites[edit]

Installation[edit]

Packages[edit]

Using extrepo

A : Non-Qubes-Whonix™

B : Qubes-Whonix™ Template

Non-Qubes-Whonix™

Qubes-Whonix™

Others and Alternatives

Manually

A : Debian

B : Qubes

A : Onion Rep.

B : Clearnet Rep. via Tor

C : Clearnet Rep.

Firewall Settings[edit]

Qubes[edit]

torsocks[edit]

Tor Configuration[edit]

APT[edit]

Reboot[edit]

Usage[edit]

check sdwdate[edit]

Updates[edit]

Transparent DNS Functional[edit]

Transparent DNS Functional[edit]

Troubleshooting[edit]

Forum Discussion[edit]

Footnotes[edit]

Navigation menu

Search

A : Non-Qubes-Whonix^™

B : Qubes-Whonix^™ Template

Non-Qubes-Whonix^™

Qubes-Whonix^™