Discuss the problem of tor traffic nodes in APPvm under the same or different sys-whonix

[leo1]

Discuss the problem of tor traffic using nodes in APPvm with the same or different sys-whonix

1. When multiple APPVMs use the same sys-whonix, will the tor traffic node server used by each appvm be different or the same?

2. When each appvm uses an independent sys-whonix, are the tor traffic node servers different?

[FranklyFlawless]

@leo1

1. When multiple APPVMs use the same sys-whonix, will the tor traffic node server used by each appvm be different or the same?

It depends if stream isolation is configured for the (presumed) anon-whonix application(s):

Stream Isolation

Therefore, if it is not on the list(s), then Tor circuits will be shared.

@leo1

2. When each appvm uses an independent sys-whonix, are the tor traffic node servers different?

Yes, each will utilize different Tor guard relays by default:

Multiple Whonix-Gateway

It is simple to create additional Whonix-Gateway (sys-whonix instances) in Qubes-Whonix.

Though the procedure is for advanced users who want the security benefit of separate Whonix-Gateway instances in Qubes-Whonix. While it affords some protection in the event that other Whonix-Gateway instances are compromised, it will result in a different set of Tor entry guards unless precautions are taken.

Please ensure that the newly created sys-whonix is based on the whonix-gateway-18 Template and has a distinctive VM name, so it is not confused with other VMs. Additionally, it is recommended not to run multiple Whonix-Gateway instances in parallel, see Multiple Whonix-Gateway.

[leo1]

First of all, thanks for the reply. If I just use separate software for each whonix-workstation appvm, will the traffic be isolated?

[corny]

@leo1

If I just use separate software for each whonix-workstation appvm, will the traffic be isolated?

It’s anecdotal but when I open multiple whonix ws disps, I get different countries in what is my IP searches. I’m using a single sys-whonix for networking

[rustybird]

@leo1

1. When multiple APPVMs use the same sys-whonix, will the tor traffic node server used by each appvm be different or the same?
2. When each appvm uses an independent sys-whonix, are the tor traffic node servers different?

In both cases, traffic from any client VM (using a Whonix Gateway as its netvm) goes through a different set of circuits than traffic from any other client VM. Similar to running Tor on multiple hardware devices. But two circuits can coincidentally use the same exit node, which is normal and also like running Tor on multiple hardware devices. The exit node and the destination host can’t easily tell that the two circuits are operated by the same user. (Although they could take note if e.g. both connections drop at the same time due to a power/ISP outage. The destination host can do this just as well if the two exit nodes are different.)

@FranklyFlawless

It depends if stream isolation is configured for the (presumed) anon-whonix application(s):

Stream Isolation

Therefore, if it is not on the list(s), then Tor circuits will be shared.

That page is about fine grained circuit isolation within one client VM (using a Whonix Gateway as its netvm). There’s an unconditional baseline circuit isolation between different client VMs. See the IsolateClientAddress option in the tor manpage, which is enabled by default.

[leo1]

How do you detect and confirm that your appvm is using a different IP? What is the command?
Does the result returned by this command return all IPs passing through the node, or does it return something?

[leo1]

Is there a way to check that we can verify?

1. However, I checked the IP using the tor browser of different appvm and it was indeed different.

2. Is there any other feasible method to more intuitively see that the IPs are different to determine the identity isolation problem of different APPvm?