Did some reading on the Whonix site, yet I'm still left with a few questions. Forgive my ignorance...
So I Imported the Whonix gateway and have another VM Distro already in VirtualBox. My thinking is:
Overview: VM Distro<-------------->Whonix Gate<---------------------->Host<-------------------->Router/Modem<--->Tor
Network settings: Internal Adapter<------->[Internal <--->Nat]<---->VirtualBox Host only adapter<---->Router/Modem<--->Tor
Is my thinking here sound? Your settings above... gateway/netmask/ip/dns... I'm assuming those are what the VM distro must have, correct? Not the Internal Adapter or VB Host Only Adapter.
Right, I forgot to mention that when you create the Lubutu (or whatever) VM that will be the Workstation, change the networking to internal bridge and select Whonix, which should be a drop down option after you import the Gateway. Then when you boot Lubuntu or whatever live distro, go to the ethernet network settings and enter that info. Should work instantly.
You don't have to mess with anything on the Gateway.
To use, I just start the Whonix Gate VM, let it sit there, take no action, input nothing? Just wait for it to connect to Tor?
Yes, start the Gateway and 20-30 seconds later, start the Workstation.
And if I understand this correctly, using the VM distro behind the Whonix Gate only protects me from malware I may possibly download, correct? But I was always under the impression that the act of downloading itself would unmask my modem's external IP anyhow?... rendering all this moot. No?
No, the applications or malware running inside the VM see a virtual machine with fake serial numbers for the virtual hardware.
That is why they recommend running the Workstation in a VM even if you use physical isolation, ie running the Gateway on a separate computer.
Watching my firewall I noticed VBoxNetFlt.sys connecting to some place in Romania 109.163.234.39 (even when VBox wasn't running) ... I got curious and blocked it. When I do that, it blocks me from accessing even non-tor/TBB/Whonix internet connections... why does it automatically have to route ALL my traffic through this one place in Romania??? Going to my host's network adapter, I unchecked "VirtualBox Bridged Networking Driver". It cost me a BSOD losing this very post I was in the midst of writing... but now with that done, I'm able to surf the clearweb etc. without having to go through that place in Romaina. This makes no sense to me why it's VirtualBox's default. Seems dangerous to me.
That's a Tor relay: http://torstatus.blutmagie.de/router_detail.php?FP=6225fcfd48db3ddc78405f2e6af4cb15b056d846
It also has the entry guard flag, so it was most likely one of your Tor Gateway's entry guards. Are you absolutely SURE the Gateway wasn't running, because whenever people tell me they are 100% sure of something, it turns out that 95% of the time they are wrong.
Any other settings I'm missing here? Suggestions? (besides get rid of windows)
You are well protected even if you run JavaScript, Java and Flash, but you should still disable them anyway unless you really need them.
It's also a good idea to add NoScript and HTTP Everywhere to the browser, and change the user agent to the same thing as TBB so you don't stick out from the crowd.
I feel like I'm flying blind using this... if I miss one setting I can be totally fucking myself. (Romanian IP?) I think this ignorance/lack of familiarity with Linux is what keeps people away.
Change your start page to check.torproject.org or wtfismyip.com. That way you can always check that it's working, but if it's configured properly, you won't be able to connect to anything except through Tor. Late you might consider using the stream isolation feature for different apps.