For instance, the following static IP configuration is used for a first VM:Īll the traffic will now be isolated from your host LAN, and will only use Tor (including DNS queries). Thus, you can assign your VMs in the range 10.152.152.10 /18. Once Whonix-Gateway has been configured, you get the following network configuration: For the VMs you want to redirect the traffic, go to Settings, Network and select Internal Network.You may want to activate the auto-update when prompted,.Start Whonix-Gateway VM and follow the initial instructions,.Leave the default settings untouched, read and agree the agreement,.ova downloaded above with File > Import Appliance, Download the associated signature, and the SHA512 file (also provided with its signature),.Download Whonix-Gateway (look for Download Whonix-Gateway link),.DNS queries will use Tor DnsPort on the Whonix Gateway to avoid leaks. However, please note that UDP traffic won’t work due to Tor limitations. Among other features, it uses Tor for all network connection thanks to Whonix-Gateway, a VM dedicated to be used as a gateway between Whonix VMs to the Tor network. Whonix is an OS designed to run as a set of VMs with pre-installed and configured applications. A more recent solution uses VirtualBox, Tor, and Whonix alongside Wireshark and is pretty quick to set up without bothering with DHCP or other network protocols. A few years ago we spoke about JanusVM which is no longer maintained and not so easy to set up. Multiple solutions exist to isolate the untrusted VMs from the host LAN. One caveat about this approach is that both the VM and the host will access the same network (like a personal trusted LAN for instance…), something definitely not desirable. Most of the time, the default networking configuration uses a bridge to allow VMs to communicate. Virtual machines are a great tool to run untrusted piece of software and analyzing the network activity.

Malware analysis traffic