On 03/28/2017 04:33 AM, Nemo wrote:
On Tuesday, March 28, 2017 at 4:32:12 AM UTC-4, Nemo wrote:
I have a set of chained VMs set up like this
Net <- Firewall <- VPN <- Firewall-VPN <- TemplateVMs/AppVMs
While my AppVMs have perfect internet connection, I cannot get the
Updates Proxy to work for my TemplateVMs.
Skipping the VPN does work fine:
Net <- Firewall <- TemplateVMs
The Net, Firewall, and VPN VMs are all based on fedora-24-minimal
with the packages required for NetVMs (including those blocked by
qubes-template-minimal-stub).
I've tried enabling the qubes-updates-proxy service on the VPN and
the Firewall-VPN VMs without success. When I enable the service on
the VPN dnf times out, and when I enable it on Firewall-VPN it
immediately errors out.
The TemplateVM has "Allow Connections to Updates Proxy" checked.
VPN has blocked all traffic in the firewall except for traffic to
my VPN ports.
Checking "Allow Connections to Updates Proxy" in VPN and
Firewall-VPN doesn't have any effect.
What am I missing? How can I make this work?
I should clarify - technically this is not dnf *over* VPN, I just
want to enable dnf to connect around by VPN using
qubes-updates-proxy.
If you set up the VPN as in the Qubes VPN doc... you could easily tweak
your config to do updates *through* the VPN by disabling the updates
proxy in the VPN and enabling it for firewall-VPN. But that's assuming
your VPN is configured to allow that kind of traffic (general Internet
access).
Going *around* it would have the updates proxy enabled for the VPN
(instead of firewall-VPN) with some modification to allow tinyproxy to
access the external network. For example, having the tinyproxy process
run as group "qvpn", which is the group that has access when using the
doc iptables configuration.
Also keep in mind the Fedora-minimal template has a small problem with
tinyproxy; Installation is normally blocked for some reason. That can
make it seem like the updates proxy refuses to work.
--
Chris Laprise, [email protected]
https://twitter.com/ttaskett
PGP: BEE2 20C5 356E 764A 73EB 4AB3 1DC4 D106 F07F 1886
--
You received this message because you are subscribed to the Google Groups
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/qubes-users/f7a441f5-0138-80e4-db04-ba5f848c1a66%40openmailbox.org.
For more options, visit https://groups.google.com/d/optout.
