Whonix-Gateway System DNS

From Whonix
Jump to navigation Jump to search

Information about Whonix-Gateway System DNS, /etc/resolv.conf, and nslookup. Getting System DNS working on Whonix-Gateway.

Introduction[edit]

System DNS is defined as:

  • Resolving DNS:
    • Without the use of a socksifier such as torsocks,
    • Without application proxy settings,
    • Without a Tor SocksPort.
  • Using the standard mechanisms on Linux for DNS resolution.
  • Typically configured through the configuration file /etc/resolv.conf.
  • The process that occurs when running nslookup.

All traffic originating from Whonix-Workstation™ and Whonix-Gateway™ is routed over Tor. [1] [2] [3] [4] [5] [6] [7]

Whonix-Workstation™ is configured to use various SocksPortsarchive.org, DNSPortarchive.org, and TransPortarchive.org. See also Stream Isolation. By default, using system DNS on Whonix-Workstation™ does not require Whonix-Gateway system DNS. [8] Modifications to /etc/resolv.conf on Whonix-Gateway do not affect Whonix-Workstation.

Whonix-Gateway is only configured to use various SocksPorts. A global system DNS resolver for resolving DNS requests from applications running on Whonix-Gateway isn't necessary for most common use cases, so it isn't enabled by default. Potential use cases where this could be beneficial include:

  • Resolving the hostname of a proxy specified in /usr/local/etc/torrc.d/50_user.conf via Tor.
  • Resolving the hostname of a VPN. However, a VPN configuration using only IPs would be more suitable.
  • One could consider using /etc/hosts for such scenarios instead of enabling system DNS.

Whonix-Gateway Default System DNS Setting[edit]

As of this writing, no DNS server is pre-configured.

To verify this, users can run the command below. This command will display all lines in the system DNS configuration file /etc/resolv.conf except those that are commented out (lines starting with a hash ("#")).

cat /etc/resolv.conf | grep --invert-match \#

Modifying this configuration may be safe, beneficial, and necessary for certain use cases such as Bridges, pluggable transports, simplified meek and snowflake support. [9]

Whonix-Gateway System DNS Configuration[edit]

Whonix-Gateway System DNS over Clearnet

Setup

Notes:

Clearnet Whonix-Gateway System DNS.

1. Apply the following changes to Whonix-Gateway™.

Open file /etc/resolv.conf.whonix in an editor with root rights.

Non-Qubes-Whonix™

This box uses sudoedit for better security.

sudoedit /etc/resolv.conf.whonix

Qubes-Whonix™

NOTES:

  • When using Qubes-Whonix, this needs to be done inside the Template.

sudoedit /etc/resolv.conf.whonix

  • After applying this change, shutdown the Template.
  • All App Qubes based on the Template need to be restarted if they were already running.
  • This is a general procedure required for Qubes and unspecific to Qubes-Whonix™.

Others and Alternatives

  • This is just an example. Other tools could achieve the same goal.
  • If this example does not work for you or if you are not using Whonix, please refer to this link.

sudoedit /etc/resolv.conf.whonix

2. Uncomment the line #nameserver 10.0.2.3.

Remove the hash ("#") before nameserver. This means you should change #nameserver 10.0.2.3 to nameserver 10.0.2.3.

3. Follow platform-specific steps:

4. Done.

The configuration for Whonix-Gateway System DNS is complete.

5. Note for wiki editors.

Once Whonix 17.2.2.6 or above is released, anon-dnsarchive.org can be used and then the DNS enabling part can be simplified.

Test

Notes:

  • If you're using Snowflake, testing this is typically unnecessary.

To test, use the Whonix-Gateway user named clearnet.

Be cautious: When using the clearnet user account, traffic will bypass Tor and use the standard internet, compromising anonymity!

Run bash as user clearnet.

[11]

sudo -u clearnet bash

To verify, you can use a tool like dig:

dig +short example.com

Whonix-Gateway System DNS over Tor

This approach is generally not recommended and is often unnecessary.

Torified Whonix-Gateway System DNS.

Undocumented.

See Also[edit]

Footnotes[edit]

  1. ↑ Starting from Whonix version 0.2.1, traffic from Whonix-Gateway is also routed over Tor. This approach conceals the use of Whonix from entities monitoring the network.
  2. ↑ For preserving the anonymity of a user's Whonix-Workstation activities, it isn't essential to route Whonix-Gateway's own traffic through Tor.
  3. ↑ For those interested: Altering DNS settings on Whonix-Gateway in /etc/resolv.conf only impacts DNS requests made by Whonix-Gateway's applications that utilize the system's default DNS resolver. By default, no applications on Whonix-Gateway that generate network traffic utilize this default resolver. All default applications on Whonix-Gateway that produce network traffic (like apt, systemcheckarchive.org, sdwdate) are explicitly configured, or force by uwt wrappers, to use their dedicated Tor SocksPort (refer to Stream Isolation).
  4. ↑ Whonix-Workstation's default applications are configured to use dedicated Tor SocksPorts (see Stream Isolation), avoiding the system's default DNS resolver. Any applications in Whonix-Workstation not set up for stream isolation - such as nslookup - will employ the default DNS server configured in Whonix-Workstation (through /etc/network/interfaces), which points to Whonix-Gateway. These DNS requests are then redirected to Tor's DnsPort by the Whonix-Gateway firewall. Changes in Whonix-Gateway's /etc/resolv.conf don't influence Whonix-Workstation's DNS queries.
  5. ↑ Traffic produced by the Tor process, which by Debian's default operates under the user debian-tor originating from Whonix-Gateway, can access the internet directly. This is permitted because Linux user account debian-tor is exempted in the Whonix-Gateway Firewall and allowed to use the "regular" internet.
  6. ↑ Tor version 0.4.5.6 (with no changes announced at the time of writing), the Tor software predominantly relies on TCP traffic. For further details, see Tor wiki page, chapter UDP. For DNS, please refer to the next footnote.
  7. ↑ Tor doesn't depend on, nor uses a functional (system) DNS for most of its operations. IP addresses of Tor directory authorities are hardcoded in the Tor software by Tor developers. Exceptions are:
    • Proxy settings that use proxies with domain names instead of IP addresses.
    • Some Tor pluggable transports such as meek lite, which resolves domains set in url= and front= to IP addresses or snowflake's -front.
  8. ↑ This is because DNS traffic originating from Whonix-Workstation is redirected to Tor's DNSPort running on Whonix-Gateway by the Whonix-Gateway Firewall.
  9. ↑ https://forums.whonix.org/t/censorship-circumvention-tor-pluggable-transports/2601/40archive.org
  10. ↑ Replace 10.0.2.3.
      • To identify the IP to substitute, execute the command below:
      • qubesdb-read /qubes-netvm-primary-dns
      • For example, the output might be:

      • 10.139.1.1

      • In this case, replace 10.0.2.3 with 10.139.1.1. Note: Use the actual IP from the output of the qubesdb-read /qubes-netvm-primary-dns command.
  11. ↑ This is analogous to logging in as the user clearnet.
Your support makes
all the difference!

We believe security software like Whonix needs to remain open source and independent. Would you help sustain and grow the project? Learn more about our 12 year success story and maybe DONATE!

Retrieved from "https://www.whonix.org/w/index.php?title=Whonix-Gateway_System_DNS&oldid=101325"