{{Header}} {{title|title= How-to: "Un{{project_name_long}}" - using clearnet networking }} {{#seo: |description=Using clearnet networking for Whonix-Gateway and/or Whonix-Workstation / Curl Clearnet Connectivity Test from Whonix-Gateway. }} {{local_connections_mininav}} {{intro| Using clearnet networking for Whonix-Gateway and/or Whonix-Workstation / Curl Clearnet Connectivity Test from Whonix-Gateway. This is mostly for developers only! }} __TOC__ = The clearnet User = The clearnet user is a special user account on the {{project_name_gateway_short}} that is designed to bypass Tor for specific purposes. Unlike the default user account user, which routes all traffic through Tor, the clearnet user has direct access to the internet without anonymization. Key points about the clearnet user: * Purpose: It allows certain applications or services to connect directly to the internet when necessary, such as for the SSH connection in this setup. * Security considerations: Traffic from the clearnet user is not anonymized. Any connections made using this account will reveal your real IP address and can potentially be traced back to you. * Limited use: The clearnet user should only be used when absolutely necessary and for specific tasks that require a direct internet connection. * Isolation: By using a separate user account for non-Tor traffic, {{project_name_short}} maintains a clear separation between anonymized and non-anonymized connections, reducing the risk of accidental deanonymization. * Persistence: By default, the clearnet user's home directory is not persistent. This will change in a future {{project_name_short}} version. How to make it persistent is documented below. The clearnet user is essential for establishing the initial tunnel connection that will then be used to route Tor traffic. This allows for the User → proxy/SSH/VPN → Tor → Internet configuration, where the tunnel connection acts as an additional layer before Tor. {{mbox | type = critical | image = [[File:Ambox_warning_pn.svg.png|40px]] | text = Always be aware that when using the clearnet user, your activities are not protected by Tor's anonymity features. Only use this account for tasks that specifically require a direct internet connection and where anonymity is not a concern. }} == Make Clearnet home persistent == There is no persistent home for the clearnet user by default. Therefore make it persistent so SSH user data (keys, known_hosts file) can be saved there. '''1.''' Change folder location of user clearnet to /home/clearnet. Platform specific. See below on where to run the following command. * [[Non-Qubes-Whonix]]: On {{project_name_gateway_short}}. * [[Qubes-Whonix]]: On {{project_name_gateway_template}} Template. Because /etc/passwd, the configuration file that declares location of the home folders for users, is stored in the Qubes root image. {{CodeSelect2|code= sudo usermod -d /home/clearnet clearnet }} '''2.''' Create the new persistent home folder. Platform specific. See below on where to run the following commands. * [[Non-Qubes-Whonix]]: On {{project_name_gateway_short}}. * [[Qubes-Whonix]]: On {{project_name_gateway_vm}} App Qube. Because home folders of users are stored in the Qubes private image. {{CodeSelect2|code= sudo mkdir -p /home/clearnet }} '''3.''' Change owner and group to clearnet. {{CodeSelect2|code= sudo chown -R clearnet:clearnet /home/clearnet }} '''4.''' Adjust permissions. {{CodeSelect2|code= sudo chmod 755 /home/clearnet }} This will most likely be simplified in a future {{project_name_short}} version, where user clearnet will have a persistent home folder by default. = Curl Clearnet Connectivity Test from Whonix-Gateway = '''Warning:''' Not anonymous! At time of writing IP {{Check.torproject.org IP}} is check.torproject.org. Using IP ({{Check.torproject.org IP}}) rather than DNS (check.torproject.org) is required since {{project_name_gateway_long}} does not have a global DNS resolver enabled by default for its own traffic (details on page [[Whonix-Gateway System DNS]]). {{CodeSelect|code= sudo -u clearnet {{Curl_Plain}} --silent {{Curl_Secure}} --header 'Host: check.torproject.org' --insecure https://{{Check.torproject.org IP}} | grep IP }} = Enable Clearnet Networking = == restore Whonix-Gateway clearnet networking == Instructions on how to remove {{project_name_short}} Tor default networking for {{project_name_gateway_short}}. After applying these instructions, {{project_name_gateway_short}} will connect to clearnet. This is possible because Whonix-Gateway is simplified "just a set of configurations". (And anything else would technically be pointless and a proprietary obfuscated software instead of a Freedom Software project. By reverting these configurations, it's possible to revert back to the same functionality that Debian has, which Whonix is based on. And Debian of course supports clearnet connectivity. This cannot happen by accident, see [[Dev/Technical_Introduction#Security_Overview]]. '''Warning:''' Not anonymous! {{Developers-only}} '''1.''' Inside {{project_name_gateway_short}}: [[Dev/Firewall_Unload|Unload {{project_name_short}} Firewall]]. '''2.''' Inside {{project_name_gateway_short}}: Verify that the firewall rules have been unloaded. . {{CodeSelect|code= sudo iptables --list }} Expected output: 
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
'''3.''' Find out DNS server IP address. Choose either option '''A)''', '''B)''' or '''B)'''. * '''A)''' Use your router's IP address. * '''B)''' Use a public DNS server. (Potential privacy issues!) {{CodeSelect|code= ## Cloudflare nameserver 1.1.1.1 ## Google #nameserver 8.8.8.8 }} * '''C)''' Use the IP address provided by the DNS server IP address. Inside any other VM, any non-Tor VM, any non-Whonix VM. Such as a Debian (based) VM that has functional internet. Figure out its /etc/resolv.conf settings. {{CodeSelect|code= cat /etc/resolv.conf }} '''4.''' Inside {{project_name_gateway_short}}: Delete /etc/resolv.conf. {{CodeSelect|code= sudo rm /etc/resolv.conf }} '''5.''' Inside {{project_name_gateway_short}}: Use the same settings from the non-Tor VM. {{Open with root rights| filename=/etc/resolv.conf }} '''6.''' Inside {{project_name_gateway_short}}: Deactivate all uwt wrappers globally. {{Uwt_wrappers_deactivate_all_permanently}} '''7.''' Inside {{project_name_gateway_short}}: Download https://check.torproject.org {{scurl|https://check.torproject.org}} {{Open File| filename=index.html }} Should include. 
Sorry. You are not using Tor.
'''8.''' Inside {{project_name_gateway_short}}: Untorify APT sources. For all files in /etc/apt/sources.list.d folder, remove the {{CodeSelect|inline=true|code= tor+ }} prefix. {{CodeSelect|code= for file_name in /etc/apt/sources.list /etc/apt/sources.list.d/* ; do sudo str_replace "tor+" "" "$file_name" ; done }} '''9.''' Done. == restore Whonix-Workstation clearnet networking == [[Undocumented]]. It would require at least: * Configuration of the host virtualization software to use either: ** A) a different gateway VM or ** B) changing the network type form internal to "normal" (virtualizer specific, NAT for VirtualBox for example). * Disabling Whonix-Workstation firewall. * DNS configuration. * Network configuration. Untested but of course possible in theory. This is possible because Whonix-Workstation is also simplified "just a set of configurations". By reverting these configurations, it's possible to revert back to the same functionality that Debian has, which Whonix is based on. And Debian of course supports clearnet connectivity. This cannot happen by accident or malware running inside the VM, see [[Dev/Technical_Introduction#Security_Overview]]. = How to Un{{project_name_short}} - {{project_name_short}} package removal = TODO: document = Footnotes = {{Footer}}