Qubes-Whonix-17 Tor Snowflake Proxy Setup Guide That Works

Hi there, first post, been using qubes for a month. Like many I have seen on this forum, on reddit, and whonix forums, I have been unable to get snowflake proxy in whonix-gateway-17(sys-whonix) ever working. for months it seems I have tried;
until now, and I would like to share how I did it in case it is not already documented on how to do this. Forgive me if this doesn’t belong here, I’m new. Also, maybe this belongs in the whonix forum, so I apologize.

EDIT: I did use the snowflake-client copied from the whonix-workstation-17 template to the whonix-gateway template, I’m not sure if that makes a difference.

The guide found at Configure (Private) (Obfuscated) Tor Bridges doesn’t seem to work without the changes I have made to it, which aren’t much.
If you follow that guide, I believe it gets you stuck at 10% bootstrap, and I keep seeing even recently that this continues to be a problem(for like years?).

So here are the changes I used to get it to work. I changed the default bridge lines provided by step 2 in the whonix guide in Tor User Config to the AMP cache bridge lines which can be found as option 3 in this snowflake connection troubleshooting guide: (Fix) Problems with Snowflake since 2024-03-01:"broker failure Unexpected error, no answer." - Censorship Circumvention - Tor Project Forum

I have not tried the other 3 bridge line options but I imagine they work fine(i think fastly is the default but perhaps its config has changed and should be updated in whonix docs?) I don’t know, and now that I have snowflake working I don’t want to touch it (lol).

Also, nameserver in /etc/resolv.conf.whonix(sys-whonix) is set to 10.139.1.1(as per the footnote in the Qubes-Whonix guide), and it seems that this is mandatory in Qubes-Whonix.

Checking with nyx points to a 192 address and it mentions snowflake connecting.

I hope this is not a repost, figuring this out took me a lot of time and i’m not the most skilled linux user. Hopefully this helps out those in my situation! :slight_smile:

Please delete my post if it is irrelevant, wrong etc, but I couldn’t find any concrete guide that works…

P.S. this post I think is for noobs who wouldn’t think to change the bridge lines I guess. Again, please delete if irrelevant. Following 3 different guides didn’t work, applying my own half-witted solution did.

1 Like

Update: I have tried all snowflake bridge types and they all work. But somebody on the Tor Project forums said that it’s safest to use the CDN77 bridges, that the AMP cache bridges wont work in China, and that Fastly is prone to changing certificates(this maybe explains why Whonix always stopped at 10% Bootstrapped?), as shown in this post: (Fix) Problems with Snowflake since 2024-03-01:"broker failure Unexpected error, no answer." - #3 by piers.nicolai - Censorship Circumvention - Tor Project Forum

“It’s probably safest to go with a CDN77 domain front for the builtin bridges and moat, since Azure has officially stopped supporting it, and any Fastly domain could renew their certificate at any time.”

This is a screenshot of snowflake running on qubes-whonix-gateway-17(sys-whonix), I hope this helps anyone!(I guess I wrote this guide for myself lol))