whonix: Lockdown network if not connected to a tor-newvm

scripts_debian/wheezy+whonix-gateway/files/usr/lib/whonix/messages.yaml

@@ -7,6 +7,3 @@ update:
       <p><B>Tor netvm required for updates!</B></p>
       <p>Please ensure your template vm has a Whonix gateway as it's VM.</p>
       <p>No updates are possible without an active (running) Whonix gateway VM.</p>
-      <p/>
-      <p><b>Template will now power off</b></p>
-

scripts_debian/wheezy+whonix-gateway/files/usr/lib/whonix/qubes-whonixsetup

@@ -41,6 +41,19 @@ elif [ "${WHONIX}" == "workstation" ]; then
     fi
 
 elif [ "${WHONIX}" == "template" -a "${PROXY_SECURE}" == "0" ]; then
+    # Set secure defaults.
+    iptables -P INPUT DROP
+    iptables -P FORWARD DROP
+    iptables -P OUTPUT DROP
+
+    # Flush old rules.
+    iptables -F
+    iptables -X
+    iptables -t nat -F
+    iptables -t nat -X
+    iptables -t mangle -F
+    iptables -t mangle -X
+
+    # Display warning that netvm is not connected to a torvm
     /usr/lib/whonix/alert update /usr/lib/whonix/messages.yaml
-    #sudo /sbin/poweroff 
 fi

scripts_debian/wheezy+whonix-workstation/files/usr/lib/whonix/messages.yaml

@@ -7,6 +7,3 @@ update:
       <p><B>Tor netvm required for updates!</B></p>
       <p>Please ensure your template vm has a Whonix gateway as it's VM.</p>
       <p>No updates are possible without an active (running) Whonix gateway VM.</p>
-      <p/>
-      <p><b>Template will now power off</b></p>
-

scripts_debian/wheezy+whonix-workstation/files/usr/lib/whonix/qubes-whonixsetup

@@ -41,6 +41,19 @@ elif [ "${WHONIX}" == "workstation" ]; then
     fi
 
 elif [ "${WHONIX}" == "template" -a "${PROXY_SECURE}" == "0" ]; then
+    # Set secure defaults.
+    iptables -P INPUT DROP
+    iptables -P FORWARD DROP
+    iptables -P OUTPUT DROP
+
+    # Flush old rules.
+    iptables -F
+    iptables -X
+    iptables -t nat -F
+    iptables -t nat -X
+    iptables -t mangle -F
+    iptables -t mangle -X
+
+    # Display warning that netvm is not connected to a torvm
     /usr/lib/whonix/alert update /usr/lib/whonix/messages.yaml
-    #sudo /sbin/poweroff 
 fi