## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
## See the file COPYING for copying conditions.

## Whonix /etc/whonix_firewall.d/30_whonix_gateway_default.conf

## Please use "/etc/whonix_firewall.d/50_user.conf" for your custom
## configuration, which will override the defaults found here. When Whonix is
## updated, this file may be overwritten.

## Only apply this config to Whonix-Gateway.
if [ ! -f "/usr/share/anon-gw-base-files/gateway" ]; then
   return 0
fi

#### meta start
#### project Whonix
#### category networking and firewall and vpn
#### gateway_only yes
#### description
## Whonix firewall configuration file
#### meta end

## Allow ESTABLISHED,RELATED instead of only ESTABLISHED.
## Reported to be required sometimes for Whonix KVM.
## https://www.whonix.org/wiki/Troubleshooting#RELATED_state_fix
## https://forums.whonix.org/t/tor-is-not-yet-fully-bootstrapped-30-done/8792/3
## https://forums.whonix.org/t/have-firewall-accept-icmp-fragmentation-needed/10233
## https://forums.whonix.org/t/change-related-established-to-established/19416
GATEWAY_ALLOW_INCOMING_RELATED_STATE=0

##########################
## Flash Proxy Settings ##
##########################

## Allow incoming Flash Proxy connections on the external interface.
## This has NOTHING to do with Adobe Flash.
GATEWAY_ALLOW_INCOMING_FLASHPROXY=0

## Flash Proxy incoming port.
FLASHPROXY_PORT=9000

################################
## Transparent Proxy Settings ##
################################

## Read first:
## https://www.whonix.org/wiki/Stream_Isolation

#########################
## For the Workstation ##
#########################

## Enable (1) or disable (0) transparent TCP proxying for the Whonix-Workstation.
## Any misc TCP traffic, for example /usr/bin/wget.anondist-orig (circumventing uwt wrapper)
## or any custom installed applications on the Whonix-Workstation will be
## automatically routed through Tor. In most cases you have to enable
## WORKSTATION_TRANSPARENT_DNS as well.
WORKSTATION_TRANSPARENT_TCP=1

## Enable (1) or disable (0) transparent UDP proxying for the Whonix-Workstation.
## This setting has really no effect.
## The Tor network does not support UDP yet.
## This is not a Whonix specific limitation.
## There is a limited workaround for tunneling udp over Tor with Whonix:
## https://www.whonix.org/wiki/Tunnel_UDP_over_Tor
## Do not bother changing this setting, it will do nothing.
WORKSTATION_TRANSPARENT_UDP=0

## Enable (1) or disable (0) transparent DNS proxying for the Whonix-Workstation.
## Any misc DNS traffic, for example nslookup, from the Whonix-Workstation will be
## automatically routed through Tor.
WORKSTATION_TRANSPARENT_DNS=1

## Enable (1) or disable (0) access to Tor SocksPorts for the Whonix-Workstation.
## You most likely want to leave this enabled. Otherwise most applications that
## come with Whonix-Workstation by default will no longer function.
## This may be useful if you are using a big number of multiple internal network
## interfaces, but want to only use transparent proxying. Because by disabling this
## setting, you could skip a lot nftables rules. (The more nftables rules, the slower.)
## related: INTERNAL_OPEN_PORTS
## For a list of ports and more information on screen isolation, see:
## https://www.whonix.org/wiki/Stream_Isolation
WORKSTATION_ALLOW_SOCKSIFIED=1

## Enable (1) or disable (0) Control Port Filter Proxy for the Whonix-Workstation.
## It enables Whonix-Workstation to issue a limited set of safe Tor control port
## commands such as "SIGNAL NEWNYM", which enables Tor Browsers New Identity
## feature. Uses white listing and filters out potentially harmful commands such
## as "GETINFO address".
CONTROL_PORT_FILTER_PROXY_ENABLE=1

########################
## Open External Ports #
########################

## Ports you wish to open on the external network interface.
## TCP only. UDP see below. Other protocols would require
## firewall modifications.
#EXTERNAL_OPEN_PORTS+=" 22 "
#EXTERNAL_OPEN_PORTS+=" 9050 "

## Ports you wish to open on the external network interface. UDP only.
#EXTERNAL_UDP_OPEN_PORTS+=" 5300 "

## Open all ports on the external network interface.
#EXTERNAL_OPEN_ALL=true

########################
## Open Internal Ports #
########################

#INTERNAL_OPEN_PORTS+=" 80 "

########################
## Tor Relay Settings ##
########################

## Allow incoming DIRPORT connections for an optional Tor relay.
GATEWAY_ALLOW_INCOMING_DIR_PORT=0

## Allow incoming ORPORT connections for an optional Tor relay.
GATEWAY_ALLOW_INCOMING_OR_PORT=0

## DIRPORT incoming port.
DIR_PORT=80

## ORPORT incoming port.
OR_PORT=443

######################################################################
## DO NOT CHANGE ANYTHING BELOW, UNLESS YOU KNOW WHAT YOU ARE DOING! #
## DO NOT CHANGE ANYTHING BELOW, UNLESS YOU KNOW WHAT YOU ARE DOING! #
## DO NOT CHANGE ANYTHING BELOW, UNLESS YOU KNOW WHAT YOU ARE DOING! #
## DO NOT CHANGE ANYTHING BELOW, UNLESS YOU KNOW WHAT YOU ARE DOING! #
## DO NOT CHANGE ANYTHING BELOW, UNLESS YOU KNOW WHAT YOU ARE DOING! #
######################################################################

#####################
## For the Gateway ##
#####################

## External interface
## defaults to:
#EXT_IF="eth0"
## to use multiple:
#EXT_IF="\
#eth0
#eth4
#eth5"

## Internal interface
## defaults to:
#INT_IF="eth1"
## to use multiple:
#INT_IF="\
#eth1
#eth2
#eth3"

## Internal "tunnel" interface, usually the same as
## the Internal interface unless using vpn tunnels
## between workstations and gateway
## defaults to:
#INT_TIF="eth1"
## to use multiple:
#INT_TIF="\
#eth1
#eth2
#eth3"

## Enable (1) or disable (0) transparent TCP proxying for the Whonix-Gateway.
## Experts only!
## Any misc TCP traffic, for example /usr/bin/wget.anondist-orig (circumventing uwt wrapper)
## from the Whonix-Gateway will be automatically routed through Tor.
## For example apt-get, wget and gpg are torified using uwt wrappers.
## In most cases you have to enable GATEWAY_TRANSPARENT_DNS as well.
## DISABLED BY DEFAULT, because the Whonix-Gateway should only be used as a proxy.
## There are currently no useful use cases recognized by Whonix developer adrelanos.
## Enable this only if you know what you are doing!
GATEWAY_TRANSPARENT_TCP=0

## Enable (1) or disable (0) transparent UDP proxying for the Whonix-Gateway.
## This setting has really no effect.
## The Tor network does not support UDP yet.
## This is not a Whonix specific limitation.
## Do not bother changing this setting, it will do nothing.
GATEWAY_TRANSPARENT_UDP=0

## Enable (1) or disable (0) transparent DNS proxying for the Whonix-Gateway.
## Experts only!
## Any misc DNS traffic, for example nslookup, from the Whonix-Gateway will be
## automatically routed through Tor.
## DISABLED BY DEFAULT, because the Whonix-Gateway should only be used as a proxy.
## There are currently no useful use cases recognized by Whonix developer adrelanos.
## Enable this only if you know what you are doing!
GATEWAY_TRANSPARENT_DNS=0

#####################
## AnyBOX settings ##
#####################

## The following section may be interesting for example for an I2PBOX.
## https://www.whonix.org/wiki/I2P#Installing_I2P_on_Whonix-Gateway (https://web.archive.org/web/20140723174127/https://www.whonix.org/wiki/I2P#Installing_i2p_on_Whonix-Gateway_.28i2pBOX.29)

## Add additional linux user ids that are excluded from NAT by default.
#NO_NAT_USERS+=" $(id -u i2psvc)"

###########################
## VPN-Firewall Settings ##
###########################

## Make sure Tor always connects through the VPN.
## Enable: 1
## Disable: 0
## DISABLED BY DEFAULT, because it requires a VPN provider.
#VPN_FIREWALL=1

## For OpenVPN.
#VPN_INTERFACE=tun0

## Destinations you don't not want routed through the VPN.
## 10.0.2.2-10.0.2.24: VirtualBox DHCP
#      LOCAL_NET="\
#         127.0.0.0-127.0.0.24 \
#         192.168.0.0-192.168.0.24 \
#         192.168.1.0-192.168.1.24 \
#         10.152.152.0-10.152.152.24 \
#         10.0.2.2-10.0.2.24 \
#      "

################################################################
## Torify Gateway / Hide the fact, that you are a Whonix user ##
################################################################

## For ensuring, that the Whonix-Workstation can only send traffic through Tor,
## it would not be required to route Whonix-Gateways traffic through Tor as well.
## Torifying the Whonix-Gateway prevents your ISP from knowing you are a Whonix user.
##
## This does NOT prevent your ISP from knowing you are a Tor user.
##    If you want this, read:
##    https://www.whonix.org/wiki/Hide_Tor_from_your_Internet_Service_Provider
##
## Torifying the Gateway has the disadvantage, that apt-get operating system updates
## are slower. It also makes testing, developing and all kinds of special non-stock
## configurations more complicated. You can optionally disable this feature.
##
## Experts only! There is also the user clearnet on the Whonix-Gateway, which
## is allowed to make non-Tor connections.
##
## Allow (1) or forbid (0) the root user on the Whonix-Gateway to make non-Tor connections.
## Experts only!
ALLOW_GATEWAY_ROOT_USER=0
## Allow (1) or forbid (0) the user user on the Whonix-Gateway to make non-Tor connections.
## Experts only!
ALLOW_GATEWAY_USER_USER=0

#############################
## SSH into Whonix-Gateway ##
#############################

## This will simply open incoming port 22 in the Whonix-Gateway firewall.
## A port forwarding from the host to the Whonix-Gateway has still to be created,
## see SSH into Whonix-Gateway.
##    https://www.whonix.org/wiki/File_Transfer
## Experts only!
GATEWAY_ALLOW_INCOMING_SSH=0

##########
## Misc ##
##########

## Reject invalid outgoing packages (0) or do not reject them (1).
NO_REJECT_INVALID_OUTGOING_PACKAGES=0

## Destinations you don't not want routed through Tor, only for Whonix-Gateway!
## 10.0.2.2-10.0.2.24: VirtualBox DHCP
##      NON_TOR_GATEWAY="\
##         127.0.0.0-127.0.0.24 \
##         192.168.0.0-192.168.0.24 \
##         192.168.1.0-192.168.1.24 \
##         10.152.152.0-10.152.152.24 \
##         10.0.2.2-10.0.2.24 \
##      "

## Drop all incoming ICMP traffic.
## Enable: 1
## Disable: 0
## DISABLED BY DEFAULT
GATEWAY_ALLOW_INCOMING_ICMP=0

## Allow fragmentation-needed ICMP packets to avoid MTU problems
## when Whonix-Gateway is connected to a link that has smaller
## MTU than 1500 assumed by Whonix-Gateway
## Enable: 1
## Disable: 0
## ENABLED BY DEFAULT
GATEWAY_ALLOW_INCOMING_ICMP_FRAG_NEEDED=1

## Firewall mode setting.
## "full" (default): Full network access. timesync-fail-closed is not used.
## "timesync-fail-closed": Restrict network access until sdwdate succeeds.
##   Only the sdwdate SOCKS port (9108) and the control port proxy are
##   allowed. Transitions to full mode automatically after sdwdate succeeds.
## Can be overridden per invocation with: --mode full
firewall_mode=full
