Try this test setup with socks from sys-whonix as outbound:
Set sys-proxy net qube to sys-whonix.
Run these commands in sys-proxy to only allow the connection to the socks proxy in sys-whonix:
sudo nft add chain ip qubes output '{ type filter hook output priority 0; policy accept; }'
sudo nft insert rule ip qubes output ct state established,related accept
sudo nft add rule ip qubes output oifname eth0 ip daddr 10.152.152.10 meta l4proto tcp tcp dport 9153 accept
sudo nft add rule ip qubes output oifname eth0 drop
Allow sing-box traffic:
sudo nft add rule ip qubes custom-input iifname singtun0 ip saddr 10.139.1.0/30 accept
Create new sing-box config whonix.json:
{
"log": {
"disabled": false,
"level": "info",
"output": "",
"timestamp": true
},
"dns": {
"servers": [
{
"tag": "remote",
"address": "tls://1.1.1.1"
},
{
"tag": "local",
"address": "local",
"detour": "direct"
}
],
"strategy": "prefer_ipv4"
},
"inbounds": [
{
"type": "socks",
"tag": "socks-in",
"listen": "127.0.0.1",
"listen_port": 2080
},
{
"type": "tun",
"tag": "tun-in",
"interface_name": "singtun0",
"inet4_address": "10.139.1.0/30",
"strict_route": true,
"auto_route": true,
"inet4_route_exclude_address": [
"10.137.0.0/16",
"10.138.0.0/16"
],
"inet6_route_exclude_address": [
"fd09:24ef:4179::a89:0/112",
"fd09:24ef:4179::a8a:0/112"
],
"sniff": true
}
],
"outbounds": [
{
"tag": "proxy",
"type": "socks",
"server": "10.152.152.10",
"server_port": 9153,
"version": "5",
"username": "sing-box",
"password": "RandomPassword",
"network": "tcp"
#"udp_over_tcp": false
},
{
"type": "direct",
"tag": "direct"
},
{
"type": "block",
"tag": "block"
},
{
"type": "dns",
"tag": "dns-out"
}
],
"route": {
"geosite": {
"path": "/usr/local/share/sing-box/geosite.db"
},
"geoip": {
"path": "/usr/local/share/sing-box/geoip.db"
},
"rules": [
{
"protocol": "dns",
"outbound": "dns-out"
},
{
"geosite": "category-ads-all",
"outbound": "block"
},
{
"geosite": "cn",
"geoip": "cn",
"outbound": "direct"
},
{
"geosite": "private",
"geoip": "private",
"outbound": "direct"
}
],
"auto_detect_interface": true
}
}
Stop the sing-box service if it’s running:
sudo systemctl stop sing-box
Run sing-box manually in the terminal to see the log output:
sudo sing-box run -c whonix.json
Test the connection in sys-proxy:
curl https://ip.me
curl -x socks5h://127.0.0.1:2080 https://ip.me