Combining Tunnels with Tor

Whonix ®

Download

Windows Linux Mac VirtualBox KVM Qubes USB ISO (coming soon) More options Source Code

About

Overview Features Whonix vs VPNs Why Open Source? Project Activities Contributors Mission & Vision

Docs

Documentation FAQ Troubleshooting

Community

Forums Contribute

Support

Self Support First Policy Search Engines, Docs and AI Support (Limited) Reporting Bugs Contact (Restricted)

Tools Upload file Special pages Recent changes Print Version Page meta What links here Related changes Page information

Page Read Edit History Move Protection Unwatch Watch Delete Purge

User Preferences Watchlist Contributions Logout Create account Login

Donate

Information on whether Tor gets more or less secure when combining Tor with tunnels such as VPN, SSH, proxies. (User → Tor → proxy/VPN/SSH → Internet) (User → proxy/VPN/SSH → Tor → Internet)

Introduction

User → Tor → proxy/VPN/SSH → Internet
User → proxy/VPN/SSH → Tor → Internet

• It is possible to combine Tor with tunnels like VPNs, proxies and SSH. The traffic can be sent through both Tor and the second tunnel, in either order. However, this is an advanced topic and appropriate only for special cases. Adding a second connection does not automatically improve security, but it will add significant complexity. See also Whonix vs VPNs. On the balance of the evidence VPNs should be avoided, and these same arguments could be made against other tunnels too.
• The improper combination of Tor and another service may actually degrade a user's security and anonymity. These configurations are difficult to set up and should only be attempted by advanced users. For the vast majority of Whonix users, using Tor in isolation – without a VPN or proxy – is the correct choice.
• VPNs on their own can be vulnerable to serious attacks like Port Shadow Attacks which have been discovered in 2024. This vulnerability is serious as it stems from the shared nature of ports in VPN servers and in the most serious cases would allow snooping of unencrypted data, port scans or connection hijacking.

Tor blocks by destination servers can usually be bypassed using simple proxies, rather than adding an additional tunnel to Tor. In order to circumvent state-level censorship of the Tor network, Bridges or other alternative circumvention tools will probably be required.

The potential positive or negative effects on anonymity are being controversially debated.

The law of triviality / bikeshedding applies to VPNs. While VPNs are frequently discussed, related privacy issues receive much less attention, including: browser fingerprinting, website traffic fingerprinting, TCP Initial Sequence Numbers Randomization (tirdad); Keystroke Deanonymization (kloak); guard discovery and related traffic analysis attacks (vanguards); Time Attacks (sdwdate); and Advanced Deanonymization Attacks. See also: Anonymity Bibliography, Selected Papers in Anonymity.

Warnings

Tunnel Link Risks

Anonymity can be negatively affected under some circumstances by using an additional tunnel, such as a VPN, proxy or SSH. To mitigate any potential risks refer to the background information below, draw your own conclusions and take preventative steps where necessary.

Table: Tunnel Warnings

Configuration	Description
Individual Tunnel Links	Individual tunnel-links should only be used for a single configuration and never reused in any other tunnel-link chains. If this advice is ignored, any anonymous identities associated with the tunnel-link might be tied to the user's ISP-assigned IP address.
Qubes Tunnel Configuration	It is not recommended to run the tunnel software from within a Template. This is because the whonix-gateway-17 Template acts more like a workstation since it is behind sys-whonix and is not sys-whonix itself. If openvpn is used inside Whonix-Gateway™ (sys-whonix) or Whonix-Workstation™ (anon-whonix) as per the Whonix documentation, openvpn will not start inside the whonix-gateway-17 or whonix-workstation-17 Template. In Qubes R4 and above, by default the Templates's NetVM is purposely set to none. (They are upgraded through the qrexec-based updates proxy that is running on sys-whonix.)
Tunnel Provider / Configuration	Do not use the same tunnel provider / configuration in more than one place at the same time. For example, do not use the same tunnel setup inside Whonix-Gateway as well as inside Whonix-Workstation. Also do not use the same tunnel setup on the host operating system (OS) (outside any virtual machine (VM)) and inside a Whonix-Gateway or Whonix-Workstation at the same time. Example: In tunnel-chain 1, the ISP-assigned IP address is permanently linked to the tunnel-link. In tunnel-chain 2, the same tunnel-link was reused. Since the user's ISP-assigned IP address was previously linked to that same tunnel-link, the "anonymous" identity can now be linked to the user's actual IP address. Tunnel-chain 1: (User → Tunnel-link (user's IP address is linked) → Tor → Internet) Tunnel-chain 2: (User → Tor → Tunnel-link (anonymous activities linked) → Internet) The previous example also holds true if the tunnel-link is first used with tunnel-chain 2 and then reused in tunnel-chain 1. In this case, all anonymous activities conducted with tunnel-chain 2 would be linked with the user's ISP-assigned IP address.

VPN Tunnel Risks

As noted in the introduction, whether or not VPNs materially improve security and/or anonymity is a hotly debated topic, and a configuration that is frequently raised in the Whonix forums.

Before reviewing the following table VPN risks in combination with Tor, it is recommended to have look at general VPN risks on the Whonix versus VPNs wiki page first.

Table: VPN Risks in Combination with Tor

Domain	Description
Anonymity	In the User → VPN → Internet configuration or User → VPN → Tor → Internet configuration, anonymous payments with Bitcoin, cash and other methods does not improve anonymity because a user is still connecting to the service from their own IP address (which can be logged). In the User → VPN → Internet configuration or User → Tor → VPN → Internet configuration the use of shared IP addresses does not confuse modern surveillance systems which have a many additional fingerprinting methods (like user agents) to identify persons of interest. VPN traffic is sensitive to Deep Packet Inspection (DPI) and Website Traffic Fingerprinting, so it is ineffective in hiding use of Whonix and Tor from the ISP or skilled adversaries. Certain variables make it likely Whonix / Tor users can be identified. This includes: the hardened network configuration fingerprint, the list of installed packages and those fetched from repositories, the amount of traffic going to one IP address daily (guard nodes), and examination of dropped (invalid) versus non-dropped packets when the firewall is probed. Apart from a few exceptions (see Use Case Exceptions), VPNs do not provide additional privacy -- it is still possible for adversaries to tap your connection, except at a different point (where traffic leaves the VPN server).
Malware	Adversaries who can break Tor Browser to make web requests not travel over Tor are probably also capable of: running arbitrary commands as a non-root user, gaining root privileges, or ultimately performing a VM escape from Whonix. In this case a VPN is useless in providing additional security.
Tor + VPN	The User → Tor → VPN → Internet configuration attempts to display an IP address that is not associated with Tor. This throws away many of the anonymity and security benefits associated with Tor and places sole trust in the VPN provider where the traffic exits. Traffic is no longer separated on different browser tabs -- a single circuit is built in the Tor network, and this can break local state separation within Tor Browser. If other things are done over the VPN connection like SSH traffic, IRC traffic, SMTP or OS updates, all of this traffic is sitting right next to each other. Anonymity is affected because the ISP will see connections to the Tor guard (unless trying to hide it with a bridge) and a global adversary is likely capable of performing traffic analysis on the limited number of VPN exit points. Further, the VPN provider is granted greater trust under this configuration. This configuration slows down connection speed because there is a TCP stream (OpenVPN) inside of a TCP stream (Tor).
VPN + Tor	It is questionable the User → VPN → Tor → Internet configuration adds any additional protection; see this stackexchange discussion. If Tor is blocked for whatever reason it is simpler to configure a bridge with a pluggable transport to try and bypass it. This configuration is unlikely to hide Tor use from a Global Passive Adversary (GPA). Since a GPA is capable of watching all traffic enter and exit the Tor network, they are more likely to be capable of watching all traffic enter and exit from a single VPN provider. It has been assessed as difficult beyond practicality to Hide Tor use from the Internet Service Provider with proxies, bridges, VPNs or SSH tunnels.

Challenges in Tunnel-link Provider Selection

It is essential to consider the following factors when selecting a tunnel-link provider. Anonymity can be materially affected by the chosen network/operator's location, network/operator/IP address commonality with Tor relays, use of shared infrastructure, and other variables.

Table: Provider Selection Considerations

Domain	Description
End-to-end Correlation (Confirmation) Attacks	Tor avoids using more than one relay belonging to the same operator in the circuits it is building. Legitimate Tor relay operators adhere to Tor's relay operator practices of announcing which relays belong to them by declaring this in the Tor relay family setting. Tor also avoids using Tor relays that are within the same network by not using relays within the same /16 subnet. Tor however does not take into account your real external IP address nor destination IP addresses. In essence, you must avoid using the same network/operator as your first and last Tor relays since this would open up Confirmation Attacks.
Shared IP Addresses	Many tunnel providers use shared IP addresses which means that many users share the same external IP address. On the one hand this configuration is beneficial, since it is similar to Tor whereby many users share the same Tor exit relays. On the other hand, in some circumstances this may result in making you, more unique, easier to track because the IP address is known to belong to a VPN provider but only few users are using it.
Operator/Network Shared Infrastructure	It is possible to host (run) Tor relays -- including bridges, entry, middle or exit relays -- behind VPNs or tunnel-links. For example, there are VPN providers that support VPN port forwarding. This is an interesting way to contribute to Tor while not exposing oneself to too much legal risk. This also means in certain situations a VPN or other tunnel-link could be hosted by the same operator providing support to Tor relays, in the same network or even on the same IP address. In an economy with deep labor division, certain operators are providing a service to host servers (VPS etc.), while others provide VPN and other tunnel-link services and rent such servers. It is therefore not uncommon for diverse customers to run or share the same IP address. This is another situation where a VPN or other tunnel-link could be hosted by the same operator supporting Tor relays, in the same network or even on the same IP address.
Tunnel-link Connection Chain Risk	Based on the section immediately above, it follows that adding arbitrary tunnel-links might lead to the same operator/network being used twice in your connection chain. Consider the scenarios below. Scenario 1: A VPN with a fixed IP address is used on the host operating system (OS) (outside any virtual machine (VM)), thereby it acts as the first relay. The same user's Tor client coincidentally selects a Tor exit relay running on the same VPN IP address. The user is now using the same IP address as the first and last proxy, meaning overall anonymity is reduced in this scenario. Scenario 2: A VPN with a fixed IP address is set up inside Whonix-Workstation. This results in the connection scheme User → Tor → VPN → Internet. A Tor entry guard is also hosted on the VPN IP address. The user is now using the same IP address as the first and last proxy, meaning overall anonymity is reduced in this scenario.
Tunnel Provider Criteria	Consider the physical location of networks/servers and the legal jurisdiction(s) they are operating in. Perhaps avoid using VPN or SSH providers that support port forwarding. Perhaps only use tunnel-link providers that are assigning private (non-shared), unique IP addresses. However, as noted earlier it is unclear if this does more harm than good. Perhaps use tunnel-link providers that run their own servers rather than relying on shared infrastructure. See also Criteria for Reviewing VPN Providers which equally applies for other tunnel-links.
Tor Relay Selection	It might be safer to manually select your Tor relay(s), specifically the Entry Guard(s) or Bridge(s) in operation. Tor documentation generally discourages tampering with Tor's routing algorithm by manually choosing relays. However, if you have decided to extend the length of the Tor chain -- despite the difficulty of this endeavor and potential adverse anonymity impacts -- then it might make sense to pick the entry guard(s) by hand. Using Bridges might be an alternative, but note this warning from experienced Tor developers: Bridges are less reliable and tend to have lower performance than other entry points. If you live in a uncensored area, they are not necessarily more secure than entry guards.

Comparison Table

	User → Proxy → Tor → Internet	User → VPN / SSH → Tor → Internet	User → Tor → Proxy / VPN / SSH → Internet
Modified Configuration Location	Whonix-Gateway	Whonix-Gateway [or host operating system (OS) (outside any virtual machine (VM)) (FAQ)]	Whonix-Workstation
Changes IP that Destination Websites (such as IP check websites) can see	No	No	Yes, if correctly configured.
Evade Website Tor Bans	No	No	Maybe
Evade Network Censor Tor Bans	Maybe	Maybe	No
Hide Tor and Whonix from ISPs	Very weak	Very weak	No
No Loss of Stream Isolation	Yes	Yes	No
Browser Web Fingerprint is not Worsened	Yes	Yes	No
Extra Tunnel Link does not Require Reconfiguration of Pre-configured Software	Yes	Yes	No
No Permanent Exit Relay	Unaffected	Unaffected	No
Tor Onion Services (.onion) Connections	Yes	Yes	No
Hosting Location Hidden Services	No	No	Proxy: No VPN: If the VPN supports Remote Port Forwarding, yes SSH: If the SSH supports Remote Port Forwarding, yes
Increased Tunnel Length	Yes	Yes	Yes
Anonymity Effects	Disputed	Disputed	Disputed
Tunnel UDP over Tor	No	No	Proxy: No VPN: If supported by the VPN, yes SSH: Undocumented

Connecting to a Tunnel-link (Proxy/VPN/SSH) before Tor

Table: Pre-Tor Tunnel-link

Domain	Description
Connection Scheme	User → proxy/VPN/SSH → Tor → Internet
Network Traffic	In this case, your Internet traffic will: pass through the ISP as proxy/VPN/SSH traffic; exit the proxy/VPN/SSH server as encrypted Tor traffic; enter the Tor network; and exit the Tor network at a Tor exit node as normal Internet traffic (encrypted or unencrypted).
Use Cases	You must connect to a VPN or proxy to access the Internet. Your ISP blocks Tor and Tor bridges but does not block the tunnel-link. Concerns exist over de-anonymizing attacks against the Tor network and a user believes a VPN or proxy may help protect their identity in such a case.
Warnings	A VPN or proxy that knows your identity and/or location may be more willing and able to compromise your privacy than an ISP. If the software configuration does not block all traffic if/when the VPN connection suddenly disconnects, all encrypted Tor traffic will pass through the ISP without warning. This is the default for most VPN configurations and not a Whonix-specific issue. Workarounds are described in the links below. If Tor use is dangerous in your area, VPNs or SSH may provide insufficient protection (due to software misconfiguration or sophisticated packet inspection). Proxies do not provide encryption and should not be used to try and hide Tor.

How to connect to a VPN before Tor (User → VPN → Tor → Internet)

How to connect to a proxy before Tor (User → proxy → Tor → Internet)

How to connect to SSH before Tor (User → SSH → Tor → Internet)

How to connect to Lantern before Tor (User → Lantern → Tor → Internet)

Connecting to Tor before a Tunnel-link (Proxy/VPN/SSH)

Table: Post-Tor Tunnel-link

Domain	Description
Connection Scheme	User → Tor → proxy/VPN/SSH → Internet
Network Traffic	In this case, your Internet traffic will: pass through the ISP as encrypted Tor traffic; exit the Tor network at a Tor exit node as proxy/VPN/SSH traffic; and exit the proxy/VPN/SSH as normal Internet traffic (encrypted or unencrypted).
Use Cases	It is necessary to use a VPN or proxy anonymously for a specific reason. It is necessary to connect to an Internet server who bans Tor exit nodes. Concerns exist over de-anonymizing attacks against the Tor network and a user believes a VPN or proxy may help protect their identity in such a case.
Warnings	Even though Tor will hide the IP address from the VPN or proxy, you can still be located via payment methods, usage logs, or other identifying information the tunnel-link service holds. This configuration prevents access to Tor onion (.onion) services. Malware on Whonix-Workstation cannot bypass Tor, but it can ignore the VPN or proxy unless a separate Tunnel-Gateway is configured. It is not simple to configure VPNs, SSH or proxies in a foolproof, leak-free manner. However, in the case of Whonix it is impossible for traffic to bypass Tor, even if the VPN or proxy is misconfigured. Most of the pre-installed software on Whonix-Workstation, including Tor Browser, is configured to take advantage of Stream Isolation. As a side effect, this software will ignore the VPN by default. It is necessary to reconfigure this software to disable stream isolation. When connecting to Tor before a tunnel link, the browser tab stream isolation feature of Tor Browser will be lost (or difficult to access). The reason is Tor Browser will not talk to Tor directly anymore, but will connect to the tunnel-link instead. When using a browser, connecting to Tor before a tunnel link worsens the web fingerprint. The anonymity effects of using the configuration: User → (Proxy / VPN / SSH →) Tor → Proxy / VPN / SSH → Tor Browser → Website are unknown. This setup is so specialized that very few people are likely to configure it, reducing the Tor Browser user pool to a far smaller subset. Due to potential fingerprinting harm it is recommended against. If proceeding despite the risk, the tunnel configuration should not be combined with any browser other than Tor Browser (like Firefox or Chrome). This would further exacerbate the browser fingerprinting risk.

How to connect to Tor before a VPN (User → Tor → VPN → Internet)

How to connect to Tor before a proxy (User → Tor → proxy → Internet)

How to connect to Tor before SSH (User → Tor → SSH → Internet)

How to connect to Tor before I2P (User → Tor → I2P → Internet)

Terminology for Support Requests

Phrases such as "over Tor" are ambiguous. Please do not coin idiosyncratic words or phrases, otherwise this leads to confusion. Please use the same terms that are consistently referenced in documentation, such as:

• Connect to a VPN Before Tor (User → VPN → Tor → Internet).
• Connect to Tor Before a VPN (User → Tor → VPN → Internet).
• And so on.

Always refer to the connection scheme when requesting support, such as:

• User → VPN → Tor → Internet, or
• User → Tor → VPN → Internet.

See Also

• Whonix versus VPNs
• Whonix versus Proxies
• Why does Whonix use Tor

Footnotes

Whonix The most watertight privacy operating system in the world.

Dark mode

Follow us on social media

Supported by Power Up Privacy

Whonix is proudly supported until 2025 by Power Up Privacy, a privacy advocacy group that seeks to supercharge privacy projects with resources so they can complete their mission of making our world a better place. (Strictly subject to our sponsorship policy.)

At Whonix we value freedom and trust, supporting Open Source and Freedom Software

By using this website, you acknowledge you have read, understood, and agree to be bound by these agreements: Terms of Service, Privacy Policy, Cookie Policy, E-Sign Consent, DMCA, Imprint 2012- 2024 ENCRYPTED SUPPORT LP

Your support makes
all the difference!

We believe security software like Whonix needs to remain open source and independent. Would you help sustain and grow the project? Learn more about our 12 year success story and maybe DONATE!