Whonix users report Stream Isolation failures in version 18.2.4.2

Reports from the Whonix community indicate that the Stream Isolation feature is failing to establish connections for some users after updating to version 18.2.4.2. This issue specifically affects attempts to use the recommended SOCKS5 port range (9153 to 9159) intended for traffic separation.

While the standard non-isolated port 9150 remains functional, users have noted that applications configured for isolated streams cannot connect. Developers have attempted to reproduce the bug using command-line tools like curl.anondist-orig but have so far been unable to replicate the connection failures in their testing environment.

Technical details of the reported connectivity issue

• Affected Feature: Tor Stream Isolation via specific SOCKS5 port ranges (9153-9159) designed to prevent identity correlation.
• Regression Context: The issue appears specifically after the transition to Whonix version 18.2.4.2, whereas the standard port 9150 continues to work.
• Testing Discrepancy: Manual testing using /usr/bin/curl.anondist-orig against the 10.152.152.10:9153 gateway successfully retrieved Tor exit node information, suggesting the issue may be application-specific or related to specific configuration methods.
• Isolation Mechanism: The reported failure involves the inability to utilize ports that lack the IsolateDestAddr and IsolateDestPort flags to achieve distinct circuit paths.

Why it matters

For users relying on Whonix for high-anonymity workflows, the failure of stream isolation could lead to unintended fingerprinting or correlation if users revert to the single standard port. This highlights the importance of consistent behavior in specialized networking subsystems within privacy-focused operating systems.