On Thu, Mar 09, 2017 at 03:18:53PM +0000, Unman wrote: > On Thu, Mar 09, 2017 at 06:13:54AM -0800, Grzesiek Chodzicki wrote: > > W dniu czwartek, 9 marca 2017 07:04:59 UTC+1 użytkownik JW napisał: > > > I have two physical NICs on my machine. I'd like most AppVMs to only > > > connect to one of the networks, but other VMs to connect to both. Is this > > > possible? > > > > > > The NICs are attached to different networks (one 192.168.*, the other > > > 10.*) > > > > > > Thanks for any tips! > > > > > > -J > > > > Create another sys-net VM (set it as NetVM not AppVM), attach the second > > NIC to it, then create another sys-firewall set it to use the sys-net2 as > > its NetVM and then set chosen appVMs to use sys-firewall2 as their NetVM. > > > > That isn't what is wanted, because the wish is to have some qubes using > BOTH interfaces. This set-up simply has two separate routes through two > sys-nets. > > There are many different ways to do this: the simplest way would be to have > two > separate firewalls attached to one sys-net. > By default, all traffic going though a firewall uses Masquerade, so that > sys-net would only see traffic from 2 IP addresses. > Say the "restricted" firewall has IP address 10.137.100.10. Then you can > add a custom iptables rule on sys-net to restrict traffic from that > address. > > There are simple mechanisms to do this: > www.qubes-os.org/doc/firewall is helpful. > On sys-net you can use an entry in /rw/config/rc.local to set up the new > firewall restriction: something like > iptables -I FORWARD -s 10.137.100.10 -j DROP > iptables -I FORWARD -s 10.137.100.10 -j 10.0.0.0/8 -j ACCEPT
That's a typo: iptables -I FORWARD -s 10.137.100.10 -d 10.0.0.0/8 -j ACCEPT > > The advantage of this method is it's trivial for you to switch qubes > between the permissive and restricted routes, just by changing > firewall. > > Note that I've taken you at your word, that you want to connect to those > networks. If you actually want to be able to use gateways on those > networks then you would need to add a rule restricting the > "restricted" traffic to one interface on the sys-net. > That's also straight forward. > > Hope this helps > > unman -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/20170309160543.GA9954%40thirdeyesecurity.org. For more options, visit https://groups.google.com/d/optout.
