@Patrick I was wondering if this is working in regular Whonix 10? If so can you give me some clues on how to troubleshoot it (startup scripts, configuration locations, expected firewall rules) since I have never used it before

• works for me in Whonix 10
• Documentation: https://www.whonix.org/wiki/Bridges
• obfsproxy: https://www.whonix.org/wiki/Bridges#Using_obfuscated.2C_.28private.29_and.2For_ordinary_bridges
• no different firewall rules required for obfs3
• no startup scripts required
• no other fancy stuff required
• user configuration is simply added to /etc/tor/torrc
• make sure the obfsproxy package is installed
• apparmor was an issue in past, try obfsproxy yourself and check /var/log/kern.log
• for now, just try it out yourself. Does it work for you? If it works for you, if you can confirm from /var/log/tor/log and arm, that Tor is in fact connecting only to the obfs3 bridges you configured, then it's more likely a user configuration error than Whonix bug.

Thanks for all the info. I will test it out over the weekend!

This seems to have gotten lost in the backlog.

Seeing that nrgaway mentioned init scripts and firewalls, here's the output of iptables-save:

{P1}

In case either are useful, tor log:

[warn] Problem bootstrapping. Stuck at 15%: Establishing an encrypted directory connection. (DONE; DONE; count 2; recommendation warn)
[warn] 2 connections have failed:
[warn] 2 connections died in state handshaking (TLS) with SSL state unknown state in HANDSHAKE

obfsproxy log:
{P2}
Note the timing. I don't know what sort of delays iptables can be expected to give, but perhaps someone else can infer something.

torrc matches the guide, with:

DisableNetwork 0

UseBridges 1

ClientTransportPlugin scramblesuit exec /usr/bin/obfsproxy managed

bridge scramblesuit [ip]:[port] [id] password=[password]
bridge scramblesuit [ip]:[port] [id] password=[password]

Both tor and obfsproxy are running as uid 104.

For the record, flushing all rules and defaulting to ACCEPT makes obfsproxy work.

For the record, slightly off-topic.
Qubes Q3 RC1, Whonix 10.

DisableNetwork 0
UseBridges 1
ClientTransportPlugin obfs2,obfs3 exec /usr/bin/obfsproxy managed
Bridge obfs3 <ip> <fingerprint>

Without any firewall modifications. Works for me.

scramblesuit not yet tested by me.

Related, there is another unrelated reason why obfsproxy might not work...
"Qubes-Whonix obfsproxy AppArmor issue" -> T396

Qubes Q3 RC1, Whonix 11.
obfs4 works for me. Example config:

UseBridges 1
ClientTransportPlugin obfs4 exec /usr/bin/obfs4proxy managed
Bridge obfs4 141.201.27.48:420 gibberish cert=more-gibberish iat-mode=0

Now also documented here:
https://www.whonix.org/wiki/Bridges#Using_obfuscated.2C_.28private.29_and.2For_ordinary_bridges