On Wed, Nov 09, 2016 at 03:00:13AM -0800, SEC Tester wrote: > Hey Drew, Cheers for the reply. > > It wasn't possible to 100% follow your instructions; > > In "Global settings" it doesn't seem possible to set the default "netVM" to > "none". It only lists choices of netVM or ProxyVMs. I left it set to > "sys-firewall". > > I followed the rest of your instructions. Deleted the sys-net VM, created a > new one. > > re-assigned the network adapter with qvm-pci -a <vmname> <bfd> > > when setting sys-net as default netVM, the templates can ping the Internet. > BUT shouldnt i keep everything proxied through sys-firewall? > > Or is there some reason the templates cant go through the sys-firewall? and > must go through sys-net? > > It seems more clear at this point the sys-firewall is responsible for > stopping the templates internet. But i dont know why? > > I could set the template netVM to sys-net, but would prefer to solve this if > possible? > > Look forward to your reply. >
I think that you should look at the docs - in particular this page: https://www.qubes-os.org/doc/software-update-vm/ and check the sections on "allowing networking for software update" and "Updates proxy". By default templates are prohibited from accessing the internet except via the update proxy. This is a security measure. If a template is compromised then all qubes based on it will be compromised. The default setup is a small step toward providing some protection. It restricts access from a template to the update proxy service running on the upstream proxyVM, in your case sys-firewall. Drew's advice addresses another issue - not yours. I don't believe that the templates would ever have had internet access. You say that you need internet access to install software: you can either temporarily allow access as detailed on the above page - not advisable because of a bug that doesn't then reset the firewall rules, so "temporarily" is a complete misnomer - OR access the software source in a qube and then copy it across to the template. Perhaps I've misunderstood your problem. If so, apologies. unman -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/20161109113650.GA27762%40thirdeyesecurity.org. For more options, visit https://groups.google.com/d/optout.
