



Introduction [ edit ]

By Whonix ™ default, Tor is used for DNS resolution. If you suspect a Tor exit relay to tamper with DNS, you can get a second opinion from another non-Tor DNS server. This may also be useful, in special cases if you want to resolve types of DNS over Tor, which are unsupported by Tor itself, such as MX [1], SRV or DNSSEC.

It is recommended against to use non-Tor DNS resolvers for an extended amount of time. Although it is technically possible to completely replace DNS resolution (not using Tor for DNS resolution anymore), it is recommended against. That would add too much power to a single DNS server. Using a permanent DNS server is recommended against just as using a permanent Tor exit relay is recommended against.

Note, that even if you correctly set up all settings, it might happen that this won't work. Sometimes Tor or the DNS server causes a timeout. This gets even worse, when you additionally tunnel the DNS request through an additional proxy (for example: Tor → JonDonym → DNS server).

Read first: Stream Isolation.

Required knowledge:

Difference between encryption and authentication.

All traffic originating from Whonix-Workstation ™ and Whonix-Gateway ™ is routed over Tor. [2] [3] [4] [5] (<-- read the footnotes)

Note that most applications, such as Tor Browser, will not automatically profit from setting up an alternative DNS resolver. This is because applications in Whonix ™ are configured to use SocksPort instead of Trans - or DnsPort , see Stream Isolation for details.

instead of - or , see Stream Isolation for details. Another reason is, that most applications do not yet make use of authenticated DNS (DNSSEC). However, you could use alternative DNS revolvers with these applications when deconfiguring socks proxy settings.

DNSCrypt [ edit ]

Introduction [ edit ]

DNSCrypt supports encryption and DNSSEC (authentication).

These instructions completely replace Tor's DNS resolver with a dnscrypt-enabled resolver for all users and the whole system. Not recommended for a longer amount of time, see warning above. Some hints are included how to do it only for a specific user account.

Installation [ edit ]

Apply all instructions inside your Whonix-Workstation ™.

1) Install the dnscrypt-proxy package.

Install dnscrypt-proxy . 1. Update the package lists. sudo apt-get update sudo apt-get update 2. Upgrade the system. sudo apt-get dist-upgrade sudo apt-get dist-upgrade 3. Install the dnscrypt-proxy package. sudo apt-get install dnscrypt-proxy sudo apt-get install dnscrypt-proxy The procedure of installing dnscrypt-proxy is complete.

2) Open file /etc/dnscrypt-proxy/dnscrypt-proxy.toml in an editor with root rights.

(Qubes-Whonix ™: In TemplateVM)

This box uses sudoedit for better security [archive]. This is an example and other tools could also achieve the same goal. If this example does not work for you or if you are not using Whonix, please refer to this link. sudoedit /etc/dnscrypt-proxy/dnscrypt-proxy.toml sudoedit /etc/dnscrypt-proxy/dnscrypt-proxy.toml

Add the following text at the very top of the file . Note: The default server did not work for the author of this page. Therefore the following instructions advice to comment that server out and add a random alternative server was chosen which worked. [6] This is not an endorsement or non-endorsement of any server. Pick your own server. DNSCrypt publishes a list of servers here [archive].

force_tcp = true #proxy = "socks5://127.0.0.1:9050" server_names = ['arvind-io'] force_tcp = true #proxy = "socks5://127.0.0.1:9050" server_names = ['arvind-io']

Comment out:

server_names = ['cloudflare'] server_names = ['cloudflare']

In other words, rewrite server_names = ['cloudflare'] to #server_names = ['cloudflare'] by adding a hash # in front of it. So it would look like this.

#server_names = ['cloudflare'] #server_names = ['cloudflare']

Save.

Restart dnscrypt-proxy.service.

sudo systemctl restart dnscrypt-proxy.service sudo systemctl restart dnscrypt-proxy.service

Restart dnscrypt-proxy.socket.

sudo systemctl restart dnscrypt-proxy.socket sudo systemctl restart dnscrypt-proxy.socket

3) Open file /etc/resolv.conf in an editor with root rights.

(Qubes-Whonix ™: In TemplateVM)

This box uses sudoedit for better security [archive]. This is an example and other tools could also achieve the same goal. If this example does not work for you or if you are not using Whonix, please refer to this link. sudoedit /etc/resolv.conf sudoedit /etc/resolv.conf

4) Comment out everything and add [7] (It is not 127.0.0.1 . It really is 127.0.2.1 .):

options use-vc nameserver 127.0.2.1 options use-vc nameserver 127.0.2.1

Save.

Testing [ edit ]

Obstacles [ edit ]

Test websites might be dysfunctional, show false-positives.

Tor Browser does not use system DNS but uses Tor to resolv DNS.

Firefox might due to a bug disable DNSSEC.

Firefox might not use system DNS but use its own DNS.

SecBrowser security slider setting is breaking test websites.

Noscript disabling script will break test websites.

VirtualBox users: VBoxManage modifyvm "$VMNAME" --natdnsproxy1 on breaks DNS.

DNSCrypt In Use [ edit ]

Stop dnscrypt-proxy systemd socket.

sudo systemctl stop dnscrypt-proxy.socket sudo systemctl stop dnscrypt-proxy.socket

Test again. Now it is expected to fail.

Restart dnscrypt-proxy systemd socket.

sudo systemctl restart dnscrypt-proxy.socket sudo systemctl restart dnscrypt-proxy.socket

Test again. Now it is expected to work.

DNSSec [ edit ]

dig +multiline . DNSKEY dig +multiline . DNSKEY

Expected output using Whonix default (using Tor's SocksPort DNS resolver.

; <<>> DiG 9.11.5-P4-5.1-Debian <<>> +multiline . DNSKEY ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOTIMP, id: 42982 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0 ;; WARNING: EDNS query returned status NOTIMP - retry with '+noedns' ;; QUESTION SECTION: ;. IN DNSKEY ;; Query time: 0 msec ;; SERVER: 10.139.1.1#53(10.139.1.1) ;; WHEN: Wed Jul 17 17:41:33 UTC 2019 ;; MSG SIZE rcvd: 17

Expected output using DNSCrypt.

; <<>> DiG 9.11.5-P4-5.1-Debian <<>> +multiline . DNSKEY ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 63055 ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 1252 ;; QUESTION SECTION: ;. IN DNSKEY ;; ANSWER SECTION: . 8461 IN DNSKEY 256 3 8 ( AwEAAcTQyaIe6nt3xSPOG2L/YfwBkOVTJN6mlnZ249O5 Rtt3ZSRQHxQSW61AODYw6bvgxrrGq8eeOuenFjcSYgNA McBYoEYYmKDW6e9EryW4ZaT/MCq+8Am06oR40xAA3fCl OM6QjRcT85tP41Go946AicBGP8XOP/Aj1aI/oPRGzRnb oUPUok/AzTNnW5npBU69+BuiIwYE7mQOiNBFePyvjQBd oiuYbmuD3Py0IyjlBxzZUXbqLsRL9gYFkCqeTY29Ik7u suzMTa+JRSLz6KGS5RSJ7CTSMjZg8aNaUbN2dvGhakJP h92HnLvMA3TefFgbKJphFNPA3BWSKLZ02cRWXqM= ) ; ZSK; alg = RSASHA256 ; key id = 59944 . 8461 IN DNSKEY 257 3 8 ( AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTO iW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN 7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5 LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8 efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7 pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLY A4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws 9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; KSK; alg = RSASHA256 ; key id = 20326 ;; Query time: 0 msec ;; SERVER: 127.0.2.1#53(127.0.2.1) ;; WHEN: Wed Jul 17 17:43:09 UTC 2019 ;; MSG SIZE rcvd: 578

Browser Tests [ edit ]

FAQ [ edit ]

Why not Use DNSCrypt by Default in Whonix ™? [ edit ]

DNSCrypt [archive] may have good use cases for clearnet activities. However, it is not useful in Whonix ™ and therefore should not be installed and activated by default for everyone. Although some users may have high expectations, DNSCrypt does not magically solve all DNS-related security issues, nor does it implement end-to-end DNS encryption to the destination server. [8] Most important of all, the server will still see all DNS requests in cleartext. [9]

There are several other reasons why DNSCrypt is not activated by default. Firstly, Tor distributes trust because the DNS server changes as circuits are rotated. For pre-installed applications, circuits are also stream-isolated and change every ten minutes by default. Notably, in early 2018 there are 78 open resolvers [archive] that support the protocol.

Public resolvers supporting DNSCrypt have not yet acted in a way to cause mistrust. However, even if the operators were absolutely trustworthy, complete confidence is also needed in their servers - it is unwise to let the DNS security for all Whonix ™ users depend on a few servers. Another consideration is load balancing. If Whonix ™ relied upon a DNSCrypt supporting server by default, DNS would break for all users if that server ever decided to forbid connections from the Tor network [10] or if the servers went down for maintenance.

Would result in a unique web fingerprint, i.e. visited websites can distinguish Whonix users using DNSCrypt from other Tor users using Tor to resolve DNS.

For more detailed information about DNSCrypt, refer to these related forum [archive] posts [archive].

Can I Use DNSCrypt on the Host or Router for Clearnet? [ edit ]

This configuration is possible; read the next section before proceeding.

Does DNSCrypt on the Host or Router Harm Anonymity when Using Tor / Whonix ™? [ edit ]

The short answer to this question is no. The longer answer is DNSCrypt on the host or in the router only affects clearnet activities. Tor assumes in advance that a user's local network and ISP are completely unsafe and untrustworthy. Tor and Whonix ™ are unaffected by DNS settings that are made on the host or in the router.

It is debatable whether DNSCrypt is useful or not for clearnet activities since there are various pros and cons. It is useful when using foreign or untrusted Wi-Fi networks that are shared with others, since DNS requests could potentially be modified or read. That said, trust is just shifted from the ISP to a DNSCrypt-supporting DNS server, such as OpenDNS. If the DNS server supporting DNSCrypt leaks a user's network address and/or logs queries as part of their business model, then it might actually be worse than using the ISP! It is hard to mount an argument for which party is more trustworthy, the ISP or a third party provider.

Alternatives [ edit ]

DNS with DNSSEC over TCP using Unbound [ edit ]

Introduction [ edit ]

source for this chapter: CZ NIC LABS [archive]

The CZ.NIC Labs DNS resolver has been chosen as an example. Feel free to use and other DNS resolver at your own choice.

These instructions have not been tested for years. There might be no reasons to use these instructions. Above DNSCrypt might do everything that is required.

Installation [ edit ]

Everything inside your Whonix-Workstation ™.

Install unbound [archive] and socat [archive].

sudo apt-get install unbound socat sudo apt-get install unbound socat

Open /etc/unbound/unbound.conf.

sudoedit /etc/unbound/unbound.conf sudoedit /etc/unbound/unbound.conf

Add the following lines.

#tcp-upstream goes under "server:" section tcp-upstream: yes #put forward-zone somewhere at the end of file forward-zone: name: "." forward-addr: 0.0.0.0@5353 #tcp-upstream goes under "server:" section tcp-upstream: yes #put forward-zone somewhere at the end of file forward-zone: name: "." forward-addr: 0.0.0.0@5353

Starting [ edit ]

Open a terminal and start socat.

socat TCP4-LISTEN:5353,bind=localhost,reuseaddr,fork SOCKS4A:10.152.152.10:217.31.204.130:53,socksport=9150 socat TCP4-LISTEN:5353,bind=localhost,reuseaddr,fork SOCKS4A:10.152.152.10:217.31.204.130:53,socksport=9150

Open another terminal tab and restart unbound.

sudo service unbound restart sudo service unbound restart

Using [ edit ]

Test with dig.

dig +dnssec nic.cz @localhost dig +dnssec nic.cz @localhost

Please refer to upstream documentation on how to interpret the DNSSEC test results.

httpsdnsd by JonDos [ edit ]

Introduction [ edit ]

Source: anonymous-proxy-servers.net [archive] and also use it as a more verbose tutorial, but keep in mind that their tutorial is JonDonym specific, while this tutorial is Tor specific.

These instructions have not been tested for years. There might be no reasons to use these instructions. Above DNSCrypt might do everything that is required.

Installation [ edit ]

Everything inside your Whonix-Workstation ™.

Install dependencies.

sudo apt-get install libnet-ssleay-perl libnet-server-perl libnet-dns-perl libxml-simple-perl liblog-log4perl-perl sudo apt-get install libnet-ssleay-perl libnet-server-perl libnet-dns-perl libxml-simple-perl liblog-log4perl-perl

Download httpsdnsd. (See source above in case download link changed.)

scurl --remote-name https://anonymous-proxy-servers.net/downloads/httpsdnsd.tar.bz2 scurl --remote-name https://anonymous-proxy-servers.net/downloads/httpsdnsd.tar.bz2

Or manually run curl with these parameters. [11]

curl --tlsv1.2 --proto =https --remote-name https://anonymous-proxy-servers.net/downloads/httpsdnsd.tar.bz2 curl --tlsv1.2 --proto =https --remote-name https://anonymous-proxy-servers.net/downloads/httpsdnsd.tar.bz2



Unpack.

.

Go into the httpsdnsd folder.

cd httpsdnsd cd httpsdnsd

Install httpsdnsd. [12]

sudo install.sh sudo install.sh

Add a new user for httpsdnsd.

sudo adduser --system --disabled-password --group httpsdns_daemon sudo adduser --system --disabled-password --group httpsdns_daemon

Editing /etc/resolv.conf is not required. (You still could out comment everything against DNS leaks.)

Create a firewall script.

nano dns-fw.sh nano dns-fw.sh

Insert these firewall rules.

# Flush old rules iptables -F iptables -t nat -F iptables -X # Redirect DNS traffic to httpdnsd. iptables -t nat -A OUTPUT -p udp -m owner --uid-owner anonuser --dport 53 -j REDIRECT --to-ports 4053 # Accept connections to the httpdnsd. iptables -t filter -A OUTPUT -p udp -m owner --uid-owner anonuser --dport 4053 -j ACCEPT # Reject all other traffic for anonuser. iptables -t filter -A OUTPUT ! -o lo -m owner --uid-owner anonuser -j REJECT # Flush old rules iptables -F iptables -t nat -F iptables -X # Redirect DNS traffic to httpdnsd. iptables -t nat -A OUTPUT -p udp -m owner --uid-owner anonuser --dport 53 -j REDIRECT --to-ports 4053 # Accept connections to the httpdnsd. iptables -t filter -A OUTPUT -p udp -m owner --uid-owner anonuser --dport 4053 -j ACCEPT # Reject all other traffic for anonuser. iptables -t filter -A OUTPUT ! -o lo -m owner --uid-owner anonuser -j REJECT

Install Privoxy. [13]

sudo apt-get install privoxy sudo apt-get install privoxy

Open the privoxy configuration file.

nano /etc/privoxy/config nano /etc/privoxy/config

Add the following to your privoxy configuration file.

# Theoretically you can tunnel through any # http or socks proxy. Local or remote proxy. # Inside Whonix-Workstation ™, due to design, # everything will be tunneled through Tor first. # Using Tor's socks5 proxy, running on Whonix-Gateway ™. # Change the port, see above... forward-socks5 / 10.152.152.10:9112 . # Another example using a http proxy. # (In this case, JonDo running on localhost.) # forward / 127.0.0.1:4001 # Theoretically you can tunnel through any # http or socks proxy. Local or remote proxy. # Inside Whonix-Workstation ™, due to design, # everything will be tunneled through Tor first. # Using Tor's socks5 proxy, running on Whonix-Gateway ™. # Change the port, see above... forward-socks5 / 10.152.152.10:9112 . # Another example using a http proxy. # (In this case, JonDo running on localhost.) # forward / 127.0.0.1:4001

Restart privoxy to enable the changes.

sudo /etc/init.d/privoxy restart sudo /etc/init.d/privoxy restart

Privoxy is now listening on 127.0.0.1:8118. [14]

Starting [ edit ]

Run httpsdnsd. [15] [16] [17] [18]

sudo httpsdnsd --https_proxy_port=8118 --runasdaemon sudo httpsdnsd --https_proxy_port=8118 --runasdaemon

Activate the firewall. Shouldn't show any errors.

sudo ./dns-fw.sh sudo ./dns-fw.sh

Using [ edit ]

Open a console and switch to anonuser.

su anonuser su anonuser

Resolve DNS.

nslookup check.torproject.org nslookup check.torproject.org

↑ Required for some Mixmaster servers over Tor ↑ Since Whonix 0.2.1, Whonix-Gateway ™ traffic is also routed over Tor. In this way, use of Whonix is hidden from persons or systems observing the network. ↑ To preserve the anonymity of a user's Whonix-Workstation ™ activities, it is not necessary to torify Whonix-Gateway ™ own traffic. ↑ /etc/resolv.conf , this only affects Whonix-Gateway ™ own DNS requests issued by applications using the system's default DNS resolver. By default, no applications issuing network traffic on Whonix-Gateway ™ use the system's default DNS resolver. All applications installed by default on Whonix-Gateway ™ that issue network traffic (apt-get, SocksPort (see For reader interest: If DNS settings on Whonix-Gateway ™ are changed in, this only affects Whonix-Gateway ™ own DNS requests issued by applications using the system's default DNS resolver. By default, no applications issuing network traffic on Whonix-Gateway ™ use the system's default DNS resolver. All applications installed by default on Whonix-Gateway ™ that issue network traffic (apt-get, whonixcheck sdwdate ) are explicitly configured, or forced by uwt wrappers, to use their own Tor(see Stream Isolation ). ↑ SocksPorts (see nslookup - will use the default DNS server configured in Whonix-Workstation ™ (via /etc/network/interfaces ), which is the Whonix-Gateway ™. Those DNS requests are redirected to Tor's DnsPort by Whonix-Gateway ™ firewall. Whonix-Gateway ™ /etc/resolv.conf does not affect Whonix-Workstation ™ DNS requests. Whonix-Workstation ™ default applications are configured to use separate Tor(see Stream Isolation ), thereby not using the system's default DNS resolver. Any applications in Whonix-Workstation ™ that are not configured for stream isolation - for example- will use the default DNS server configured in Whonix-Workstation ™ (via), which is the Whonix-Gateway ™. Those DNS requests are redirected to Tor's DnsPort by Whonix-Gateway ™ firewall. Whonix-Gateway ™does not affect Whonix-Workstation ™ DNS requests. ↑ dig +dnssec google.com dig +dnssec google.com Test was done using: ↑ options use-vc is optional as in it also works without it. ↑ Conceptually, end-end DNS encryption is illogical. If the IP address of the destination server was known in advance, then DNS would not be required in the first place. ↑ https://security.stackexchange.com/questions/162601/what-are-the-privacy-advantages-of-a-dns-encryption-service-such-as-dnscrypt [archive] ↑ Due to the Tor network abuse such as DDOS attacks on their servers. ↑ This has the same effect as the scurl command above. ↑ It contains also a uninstall.sh, if you want to uninstall it later. ↑ torproject.org Wiki Version 95 [archive] of this site contains a working example using Polipo. Changed later to Privoxy, because Privoxy can be useful for other tasks as well. (Incoming: TransPort, http proxy; forwarding: http and socks.) of this site contains a working example using Polipo. Changed later to Privoxy, because Privoxy can be useful for other tasks as well. (Incoming: TransPort, http proxy; forwarding: http and socks.) ↑ For debugging you can enter this IP/port into Tor Browser as http proxy and try if you can still reach check.torproject.org. Deactivate after testing. ↑ For debugging, kill httpsdnsd and drop the --runasdaemon. ↑ Run httpsdnsd --help or man httpsdnsd for help. ↑ Httpsdnsd will by default listen on localhost port 4053 for DNS queries. ↑ --https_proxy_port=8118 will redirect traffic to port 8118, where Privoxy is listening. This is necessary because Tor offers a socks proxy and httpsdnsd requires a http proxy. Privoxy translates from http to socks.



Jobs in USA

Search engines: YaCy | Qwant | ecosia | MetaGer | peekier | Whonix ™ Wiki

Follow:

Donate:

Share: Twitter | Facebook

Want to make Whonix safer and more usable? We're looking for helping hands. Check out the Open Issues [archive] and development forum [archive].

This is a wiki. Want to improve this page? Help is welcome and volunteer contributions are happily considered! Read, understand and agree to Conditions for Contributions to Whonix ™, then Edit! Edits are held for moderation. Policy of Whonix Website and Whonix Chat and Policy On Nonfreedom Software applies.

Copyright (C) 2012 - 2020 ENCRYPTED SUPPORT LP. Whonix ™ is a trademark. Whonix ™ is a licensee [archive] of the Open Invention Network [archive]. Unless otherwise noted, the content of this page is copyrighted and licensed under the same Freedom Software license as Whonix ™ itself. (Why?)

Whonix ™ is a derivative of and not affiliated with Debian [archive]. Debian is a registered trademark [archive] owned by Software in the Public Interest, Inc [archive].

Whonix ™ is produced independently from the Tor® [archive] anonymity software and carries no guarantee from The Tor Project [archive] about quality, suitability or anything else.