Tor and Whonix on Qubes OS — one option

Tor is a network of relays. Whonix is a two-machine layout: one machine runs Tor, the other has no path of its own onto the ordinary internet. Qubes OS is one place to run that layout next to ordinary work — in separate qubes, not on the same desktop as mail.

This is an option for someone who already wants isolation between tasks. It is not a default daily system, and logging into an account you own does not become anonymity.

What Tor does with a connection

Tor (The Onion Router) sends TCP traffic through a circuit of several relays, usually three. The entry relay sees where the client came from and does not see the clearnet destination. The exit sees where the stream is going and does not get the client’s address. No single relay holds both ends. An onion site stays inside the network and never uses a clearnet exit.

The local network — the provider, an office firewall, someone on the same Wi-Fi — still sees that you are talking to the Tor network. It sees the time and the volume. It does not see the list of sites, as long as the traffic actually entered a circuit and the application did not carry it out the side.

Tor does not touch the content you type yourself. A login on an account with your name, the same nickname on a forum, and a file with metadata carry identity regardless of the path. Tor is not a VPN “for the whole computer” just because an icon is lit somewhere in the system.

Whonix’s two machines

Whonix splits the roles:

• the gateway runs Tor and is the only machine with a path out
• the workstation has a network only as far as the gateway; applications on it do not get an ordinary route beside Tor

The browser on the workstation is the Tor Browser shipped with Whonix. It uses the Tor process on the gateway. A second Tor inside that same workstation (Tor over Tor) breaks the circuit — Whonix documentation treats that as a configuration mistake, not as a “stronger” layer.

The gateway is for the connection and the wizard (including bridges, when a network blocks ordinary relays). You do not edit documents or browse on the gateway. The current bridge procedure is on the Whonix page, not in this post.

Qubes OS as a place for this layout

Qubes OS isolates tasks in separate qubes on Xen. Mail, banking, and a browser can live in different machines, on different networks. Whonix is a supported pair in that model, not the only network on the system.

In the current Qubes-Whonix documentation the pair is named like this:

• sys-whonix — the gateway, a NetVM running Tor
• anon-whonix — the workstation, whose network is sys-whonix

Other qubes stay on the ordinary path (sys-firewall, then sys-net) until you set their network to sys-whonix yourself. Templates carry release numbers (the docs currently show the 18 line). The number changes. The gateway / workstation split stays. Installation, and the salt that creates these qubes, is on Qubes/Install.

Day-to-day use looks like this:

1. You work in anon-whonix (or a disposable based on the workstation template), not in sys-whonix.
2. Ordinary mail and accounts with your name stay in a qube that does not use this gateway.
3. One Whonix workstation is one role. Two unrelated topics in the same qube stick together as one application trace, even when the path is shared.
4. dom0 updates over Tor are a separate setting: UpdateVM = sys-whonix. Templates go through an UpdatesProxy aimed at that same gateway. Turn both on deliberately, not “while you are here” on the first install, if you do not know what you are moving.

Qubes needs hardware with virtualization support, and it is a system you learn before you put work on it. Whonix on another hypervisor (KVM, VirtualBox) is the same pair of machines without the rest of Qubes.

Other options, beside this one

• Tor Browser on an ordinary system — the shortest path to sites over Tor. Every other application on that host still uses the ordinary route. Enough when you want one browser, not a separate system.
• Tails — a system from removable media, aimed at a session that does not leave a trace on the computer’s disk. A different goal from a qube that comes back tomorrow with the same layout.
• Whonix outside Qubes — the same gateway and workstation, with weaker isolation from the rest of your work if an ordinary system with ordinary accounts sits on the host beside it.
• Qubes-Whonix — when qubes already separate tasks, and the traffic of “this one” qube has to go through a gateway you do not use for mail.

What this layout does not close

A compromise of dom0 on Qubes is a compromise of the hypervisor. Whonix does not undo that. An account you log into carries that account’s identity. The hour, the volume, and the fact of a connection to Tor are visible locally. A bridge changes how you reach the network, not the contract with the application you type data into.

Isolation is the same principle here as with a backup and an administrator account: one role in one container. Tor is the path. Qubes-Whonix is a way to keep that path from accidentally becoming the whole desktop.