blocker:
Qubes integration
Integrate Whonix firewall with Qubes nftables rule

This was implemented.

quote https://forums.whonix.org/t/whonix-16-has-been-released-debian-11-bullseye-based-for-virtualbox-major-release/12297

https://wiki.nftables.org/wiki-nftables/index.php/Atomic_rule_replacement

https://wiki.nftables.org/wiki-nftables/index.php/Scripting

Some progress.

In other words, iptabels is already symlinked to iptabels-nft anyhow. Therefore Whonix is already using iptabels-nft.

• https://unix.stackexchange.com/questions/722007/translate-firewall-rule-from-iptables-to-nftables
• https://wiki.nftables.org/wiki-nftables/index.php/Moving_from_iptables_to_nftables

https://forums.whonix.org/t/whonix-linux-installer-development-discussion/15917/20

https://forums.whonix.org/t/disk-usb-automount-in-kicksecure/8728/31

In T509#20232, @ak88 wrote:

Any updates on this?

Any updates on this?

After running a bunch of tcp ping tests, the conclusion is this attack
is not really effective against TCP like ICMP. The latency is much lower
for TCP pings and though it slightly decreases with cpu stress it is not
consistent. Reloading pages in TBB with cpu stress
on/off does not impact latency readings while doing so with tc
attached has massive latency foot prints - implying it will ironically make such attacks much easier in addition to degrading performance.

Cyrus recommends adding delays per packet to disrupt inter-packet patterns that remain. The command can be fine tuned as such:

The good news is I think I've figured out the equivalent tc-netem command looking the slot parameter in the manual:

Ticket above closed and convo moved to tails-dev.

It looks like bpfilter is in rather early stages, and it's few years until we'll see it in Debian.

Or skip nftables and use Berkeley Packet Filter (BPF)?

Not a problem anymore.

https://www.whonix.org/wiki/Chat#Ricochet_IM

NonaSuomy:

Added requested NFTables example from duclicsic #netfilter freenode.

Starting with Bullseye nftables will be the default:

https://redmine.tails.boum.org/code/issues/17156

Analysis by Cyrus cited here for completion:

Reported build failures:

When an implementation is decided, let's decide if we can include this in security-misc for use on Linux hosts and Kicksecure. We would need some way in detecting the active NIC since on wireless systems wlan0 is the interface of choice and not eth0

tc-netem is a utility that is part of the iproute2 package in Debian. It leverages functionality already built into Linux and userspace utilities to simulate networks including packet delays and loss.

install electrum appimage by default:
https://github.com/Whonix/anon-meta-packages/commit/71d40f5316ee7eb38eb04142d80d23c56a48407b

Any update?

Will keep watching what Tails is doing.