Skiff 2
$ 7 /month
- vCPU
- 1 × shared
- RAM
- 2 GB
- Storage
- 40 GB NVMe SSD
- Transfer
- 3 TB
- IPv4 / IPv6
- 1 / /64 routed
Operating system
Whonix Gateway on a VPS — full KVM isolation
17Min 1024 MBRecommended 2 GBWhonix Project
Short answer
Whonix Gateway forces every connection from an attached workstation through Tor at the network layer, so a compromised application cannot leak the real address — it has no route to one. On a VPS it is deployed as a gateway instance that other instances route through, via custom ISO upload.
Strengths
- Fail-closed Tor routing
- Leak protection at the network layer
- Stream isolation
Trade-offs
- Higher latency
- Requires a two-instance topology
Best suited to
ResearchSource protectionHigh-risk browsing infrastructure
Whonix Gateway on a KVM virtual server
Running a Whonix Gateway on a KVM virtual server is a deliberate overkill for most use cases. True KVM virtualisation, unlike a container-based VPS, gives you a dedicated kernel and full control over the network stack — a prerequisite for the fail-closed routing that Whonix depends on. Container hosts share the host kernel, making leak protection or custom kernels impossible. Before choosing this path, expect the operational cost of managing two instances and the inherent latency of forced Tor routing.
People run Whonix Gateway here for research and source protection, where the fail-closed routing justifies the latency cost. The two-instance topology is a real weakness, but KVM allows the gateway and workstation to be separate VPS instances on the same subnet. Stream isolation keeps separate browsing contexts from cross-contaminating, a feature that loses value on a single shared container.
How much machine Whonix Gateway actually needs
Start with 2 GB of RAM and 20 GB of disk, the comfortable floor. The operating system itself occupies about 1 GB of RAM before your application starts. At 1024 MB it boots but leaves little for the Tor process and your own traffic. Disk is cheaper to expand than RAM, so buy storage generously for logs.
Plans that suit Whonix Gateway
Skiff 4
$ 12 /month
- vCPU
- 2 × shared
- RAM
- 4 GB
- Storage
- 60 GB NVMe SSD
- Transfer
- 4 TB
- IPv4 / IPv6
- 1 / /64 routed
Cutter 4
$ 19 /month
- vCPU
- 2 × dedicated
- RAM
- 4 GB
- Storage
- 80 GB NVMe SSD
- Transfer
- 6 TB
- IPv4 / IPv6
- 1 / /64 routed
Frequently asked questions
How much RAM does Whonix Gateway need?
Whonix Gateway boots in 1024 MB and is comfortable with 2 GB. Add whatever your application needs on top of that — the operating system baseline is a floor, not a budget.
Can I run Whonix Gateway on a VPS?
Yes, on true KVM virtualisation, which is what every OnionVPS instance runs. It is available as a ready template and can also be installed from your own ISO.
How long is Whonix Gateway supported?
Tied to the Debian base
How do I deploy the Whonix Gateway ISO?
Download the Whonix Gateway ISO and upload it via our custom ISO upload feature, then boot the instance from that image. The same feature works for workstation images. Because it is true KVM, you can replace the base OS entirely.
Can a compromised application leak my real IP?
Whonix Gateway forces all traffic through Tor at the network layer, so the application has no route to the host's real address. As long as the gateway instance itself is not compromised and the VPS kernel is not shared, leak protection holds.