3

Lately I've been messing around with Whonix, trying to figure out how it works. All of the problems I've encountered, I've been able to figure out, except one:

I can't get nmap to work through the gateway. When I run nmap from my workstation to scan my server, it returns with a ridiculous amount of open ports (Probably more than 100). The latency is significantly less than 1 second, which also doesn't make sense. I think it might actually be scanning the whonix gateway -- maybe it has something to do with the firewall?

If anyone has any clue what's going on here that'd be much appreciated. Anything at all, really... I've basically hit a wall.

hello
  • 31
  • 2
  • I haven't tried this myself, but it looks like this (external) link might be of help: https://sourceforge.net/p/whonix/discussion/general/thread/ac04011c/ – Richard Horrocks Apr 11 '16 at 08:42
  • Richard Horrocks, thank you for replying. I've already found that discussion (And every other discussion on the internet about this). No one there has the solution, except one guy saying he figured out how to do it with proxychains, and then leaving the discussion without explaining anything. I wanted to leave this as a comment to your reply, but I apparently can't do that without creating an account :-) –  Apr 11 '16 at 20:22

2 Answers2

2

You should read about how nmap works and how iptables transproxying works or SOCKS proxying works and then realise that you will not be able to effectively nmap over a whonix gateway nor should you ever.

Nmap uses by default the "SYN Scan" technique, this means that it sends a TCP SYN packet to each of the ip:port pairs on the list, if it gets a SYN+ACK back from the destination, it considers the port open. (If it gets a RST then, conversely, it considers it 'closed' and if nothing ever comes back it considers it 'filtered').

Since a local SOCKS proxy is expected to accept a connection then "dial" the remote address, it's always "open" in the proxychain/torsocks case. And similarly transproxy will produce the same results results.

Port scanning over Tor is both harmful to the Tor network (its loud, obvious and generates a lot of "abuse" reports for exit operators to deal with) and ineffective. You should not do it, there are better methods for both you and the Tor network.

cacahuatl
  • 11,047
  • 2
  • 17
  • 39
0

It is posible that the small latencies and visible ports are because your computer running whonix is on the same local network as your server.

I am not sure about whonix but you can route nmap scans (and pretty much any network program) with proxychains:

proxychains nmap www.google.com
user12488
  • 19
  • 3