Ideally Tor users should use something like the Whonix approach: two VMs are set up, a gateway for connecting to the internet and a workstation the user browses

Ideally Tor users should use something like the Whonix approach: two VMs are set up, a gateway for connecting to the internet and a workstation the user browses from. The gateway sets up the Tor connection, and the workstation is on a restricted virtual network that can only connect to the gateway.