Sys-net Networking: Caution!

User Support
1

I just viewed my sys-net settings and noticed a yellow sign saying

"Caution: default DispVM template has a different networking than this qube. Unexpected network access may occur!

what does the last sentence mean? Is it bad? I have recently checked the Global Settings and tried setting Default template and Default DisposableVM template to whonix-ws-16. It’s probably because of that.
What would you do?

2

The part about “Unexpected network access may occur!” is saying that if you were to open a DisposableVM from sys-net, the DisposableVM would have a different network route than sys-net. This is important if, for example, you have a Qube that always needs to go through tor and it receives networking from sys-whonix, but the DisposableVM is set to receive networking from sys-firewall. In this case, if you were to open a DisposableVM from that Qube, it could de-anonymize you. However, this caution note doesn’t really apply to sys-net because 1. I don’t think there’s a need to open DisposableVMs from sys-net anyway and 2. sys-net is already the highest level networking VM and the DisposableVM having different networking wouldn’t really matter. You can safely ignore that caution note for sys-net.

2 Likes
3

This text has been updated in 4.1 to be more explanatory and descriptive. (You must be on 4.0.)

Here’s a previous issue for it:

Here’s the commit where the text was updated:

4

Yeah, it’s a bit misleading then. I cannot even set ‘Default DisposableVM’ to sys-net in the global settings, only whonix and fedora.
for that reason, I cannot do anything wrong here, right? I’m asking to fully understand the backgrounds.

PS: the only default setting which uses sys-net is ClockVM. does that matter for my privacy?
the others are firewall (netVM) and the rest is all whonix (Dom0 UpdateVM, Default template, Default DisposableVM template).

5

You can choose one of the templates to use as a DisposableVM, but sys-net isn’t a template. Also, just as a note, you shouldn’t do any actual work inside of sys-net; the only things you need to do in sys-net are connect to wifi networks or set up a VPN if you need to.

The clock qube should be set to sys-net, even if you use sys-whonix for everything else. Everything there looks good.

1 Like