A practical course on network isolation, built on a Whonix lab

You set up a lab on your own computer and work through threat modeling, Tor, daily use, and keeping activities separate. The course is for journalists, researchers, NGO staff, and the IT people who support them.

format

written lessons and hands-on labs

size

8 modules, 32 lessons, 12 labs

status

applications open, all lessons written

price

free; no checkout, no subscription

docs checked

2026-10-30, against Whonix 18

Apply for the course → See the syllabus

01The idea

Most privacy advice is about settings: turn this off, install that. Settings only hold if every program obeys them. Whonix takes a different approach, with two virtual machines and only one way out.

 your host computer
+--------------------------+
|  +--------------------+  |
|  | Workstation        |  |
|  | browser, apps,     |  |
|  | your work          |  |
|  +---------+----------+  |
|            |             |
|            | isolated    |
|            | network     |
|            v             |
|  +---------+----------+  |
|  | Gateway            |  |
|  | Tor, firewall      |  |
|  +---------+----------+  |
+------------|-------------+
             v
            Tor
             |
             v
         internet

 your host computer
+-------------------------------------------------------+
|                                                       |
|  +---------------+   isolated    +---------------+    |
|  | Workstation   |   network     | Gateway       |    |
|  |               |-------------->|               |---------> Tor ---> internet
|  | browser, apps |               | Tor, firewall |    |
|  | your work     |               |               |    |
|  +---------------+               +---------------+    |
|                                                       |
+-------------------------------------------------------+

Your applications run on the Workstation, and its only route out is through the Gateway. A program that ignores its proxy settings still can't open a direct connection to the internet. The course starts here, then moves on to the parts this design can't solve for you.

02What the course covers

• Writing a threat model: what you protect, from whom, and what you leave out.
• What each Tor relay knows, and where Tor stops protecting you.
• Installing Whonix on VirtualBox, KVM, or Qubes, and verifying the images.
• Daily work in the user session and administration in sysmaint.
• Stream isolation: keeping applications on separate circuits.
• Multiple Workstations and written procedures for keeping identities apart.
• Hosting a small onion service.

03What this course won't do

• Promise anonymity. No course can.
• Protect a compromised host computer. If the host is compromised, so is what runs on it.
• Teach you to attack anything. The labs run on machines you own or are explicitly authorized to assess, and the course does not provide material for unauthorized access, fraud, or attacks on third-party systems.

04Syllabus

Full syllabus, lesson by lesson

05Requirements

An x86 computer with hardware virtualization (AMD-V or Intel VT-x), at least 1 GB of free RAM, and 10 GB of free disk. 8 GB of RAM and an SSD are recommended. On Apple hardware, Whonix support is experimental. You should be comfortable installing software and using a terminal.

06Questions

Who is it for?

Journalists, researchers, NGO staff, and IT people who look after someone else's security. You should be comfortable installing software and using a terminal.

What do I need?

An x86 computer with hardware virtualization (AMD-V or Intel VT-x), at least 1 GB of free RAM and 10 GB of free disk. 8 GB of RAM is recommended.

How much does it cost?

Nothing. The course is free to read. There is no checkout, subscription, or recurring billing. Access is granted after a short application so we know a bit about who is using the material.

Why is there an application form?

The form keeps the course usable at our small scale and lets us answer questions about fit before you start. We do not ask for payment at any step.

Is the course available now?

Yes. All eight modules are written. Access is sent by email after the application is reviewed.

All questions