I just viewed my sys-net settings and noticed a yellow sign saying
"Caution: default DispVM template has a different networking than this qube. Unexpected network access may occur!
what does the last sentence mean? Is it bad? I have recently checked the Global Settings and tried setting Default template and Default DisposableVM template to whonix-ws-16. It’s probably because of that.
What would you do?
The part about “Unexpected network access may occur!” is saying that if you were to open a DisposableVM from sys-net, the DisposableVM would have a different network route than sys-net. This is important if, for example, you have a Qube that always needs to go through tor and it receives networking from sys-whonix, but the DisposableVM is set to receive networking from sys-firewall. In this case, if you were to open a DisposableVM from that Qube, it could de-anonymize you. However, this caution note doesn’t really apply to sys-net because 1. I don’t think there’s a need to open DisposableVMs from sys-net anyway and 2. sys-net is already the highest level networking VM and the DisposableVM having different networking wouldn’t really matter. You can safely ignore that caution note for sys-net.
This text has been updated in 4.1 to be more explanatory and descriptive. (You must be on 4.0.)
Here’s a previous issue for it:
Here’s the commit where the text was updated:
Yeah, it’s a bit misleading then. I cannot even set ‘Default DisposableVM’ to sys-net in the global settings, only whonix and fedora.
for that reason, I cannot do anything wrong here, right? I’m asking to fully understand the backgrounds.
PS: the only default setting which uses sys-net is ClockVM. does that matter for my privacy?
the others are firewall (netVM) and the rest is all whonix (Dom0 UpdateVM, Default template, Default DisposableVM template).
You can choose one of the templates to use as a DisposableVM, but sys-net isn’t a template. Also, just as a note, you shouldn’t do any actual work inside of sys-net; the only things you need to do in sys-net are connect to wifi networks or set up a VPN if you need to.
The clock qube should be set to sys-net, even if you use sys-whonix for everything else. Everything there looks good.