TLDR: sudo sysctl -w net.ipv4.ip_forward=1
in your whonix gateway will resolve it, until reboot. In your template, you can edit /etc/sysctl.d/anonymizer-config-gateway.conf
and comment out the line net.ipv4.ip_forward = 0
, and this should fix ARP requests not getting replies.
Long: Qubes uses proxy arp, which is why every ARP request receives a fe:ff:ff:ff:ff:ff
(MAC address of the corresponding netVM) reply. Behind sys-whonix, ARP requests for MAC address of sys-whonix receive the proper reply, but anything besides that do not work. It doesn’t really make sense to me personally why IP forwarding would need to be enabled in order for sys-whonix
to simply proxy it? Maybe i’m misunderstanding. In the end, this seems more like a Whonix change more than a Qubes one.