On Mon, Jan 09, 2017 at 03:31:10PM +0000, 5xb562+7dpfa via qubes-users wrote: > Oh, well spotted! Thx :) > > So what is the option "Allow connections to update proxy" doing if the INPUT > chain allows all traffic destined to 10.137.255.254 ? > Isn't this a flaw? Is there a way to avoid this? >
Well, it's there to cover the case where the firewall is between your qube and the updates proxy. In this case you are running the proxy service on the firewall, and you have the qube configured to use the updates proxy, so it is performing as expected. The standard proxy is only there to provide some level of filtering: less now than it used to. If you don't want to use the updates proxy, either stop it running on the firewall, or remove the Proxy setting on the qube/template. If you dont want to do either you will have to introduce a custom rule in the chain to make sure that there isnt any translation for your source IP. -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/20170109161751.GA7346%40thirdeyesecurity.org. For more options, visit https://groups.google.com/d/optout.
