On Thu, Mar 09, 2017 at 06:13:54AM -0800, Grzesiek Chodzicki wrote: > W dniu czwartek, 9 marca 2017 07:04:59 UTC+1 użytkownik JW napisał: > > I have two physical NICs on my machine. I'd like most AppVMs to only > > connect to one of the networks, but other VMs to connect to both. Is this > > possible? > > > > The NICs are attached to different networks (one 192.168.*, the other 10.*) > > > > Thanks for any tips! > > > > -J > > Create another sys-net VM (set it as NetVM not AppVM), attach the second NIC > to it, then create another sys-firewall set it to use the sys-net2 as its > NetVM and then set chosen appVMs to use sys-firewall2 as their NetVM. >
That isn't what is wanted, because the wish is to have some qubes using BOTH interfaces. This set-up simply has two separate routes through two sys-nets. There are many different ways to do this: the simplest way would be to have two separate firewalls attached to one sys-net. By default, all traffic going though a firewall uses Masquerade, so that sys-net would only see traffic from 2 IP addresses. Say the "restricted" firewall has IP address 10.137.100.10. Then you can add a custom iptables rule on sys-net to restrict traffic from that address. There are simple mechanisms to do this: www.qubes-os.org/doc/firewall is helpful. On sys-net you can use an entry in /rw/config/rc.local to set up the new firewall restriction: something like iptables -I FORWARD -s 10.137.100.10 -j DROP iptables -I FORWARD -s 10.137.100.10 -j 10.0.0.0/8 -j ACCEPT The advantage of this method is it's trivial for you to switch qubes between the permissive and restricted routes, just by changing firewall. Note that I've taken you at your word, that you want to connect to those networks. If you actually want to be able to use gateways on those networks then you would need to add a rule restricting the "restricted" traffic to one interface on the sys-net. That's also straight forward. Hope this helps unman -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/20170309151853.GC8947%40thirdeyesecurity.org. For more options, visit https://groups.google.com/d/optout.
