Yes, I did follow the official documentation to create the proxy. The only thing I've borrowed from the Rudd-O version is having Firewall downstream from VPN, and setting the VPN's firewall settings to block all traffic except that on my VPN's port.
Doing updates through the VPN would be perfect if possible. Adding qubes-updates-proxy service to Firewall-VPN (and installing tinyproxy via tinyproxy.x86_64) causes an immediate connection error from dnf. Is that caused by the firewall rules I've added to VPN? Are they necessary, given a setup via the official documentation? On Mar 28, 2017 7:37 AM, "Chris Laprise" <[email protected]> wrote: On 03/28/2017 04:33 AM, Nemo wrote: > On Tuesday, March 28, 2017 at 4:32:12 AM UTC-4, Nemo wrote: > >> I have a set of chained VMs set up like this >> >> Net <- Firewall <- VPN <- Firewall-VPN <- TemplateVMs/AppVMs >> >> While my AppVMs have perfect internet connection, I cannot get the >> Updates Proxy to work for my TemplateVMs. >> >> Skipping the VPN does work fine: >> >> Net <- Firewall <- TemplateVMs >> >> The Net, Firewall, and VPN VMs are all based on fedora-24-minimal >> with the packages required for NetVMs (including those blocked by >> qubes-template-minimal-stub). >> >> I've tried enabling the qubes-updates-proxy service on the VPN and >> the Firewall-VPN VMs without success. When I enable the service on >> the VPN dnf times out, and when I enable it on Firewall-VPN it >> immediately errors out. >> >> The TemplateVM has "Allow Connections to Updates Proxy" checked. >> >> VPN has blocked all traffic in the firewall except for traffic to >> my VPN ports. >> >> Checking "Allow Connections to Updates Proxy" in VPN and >> Firewall-VPN doesn't have any effect. >> >> What am I missing? How can I make this work? >> > > I should clarify - technically this is not dnf *over* VPN, I just > want to enable dnf to connect around by VPN using > qubes-updates-proxy. > > If you set up the VPN as in the Qubes VPN doc... you could easily tweak your config to do updates *through* the VPN by disabling the updates proxy in the VPN and enabling it for firewall-VPN. But that's assuming your VPN is configured to allow that kind of traffic (general Internet access). Going *around* it would have the updates proxy enabled for the VPN (instead of firewall-VPN) with some modification to allow tinyproxy to access the external network. For example, having the tinyproxy process run as group "qvpn", which is the group that has access when using the doc iptables configuration. Also keep in mind the Fedora-minimal template has a small problem with tinyproxy; Installation is normally blocked for some reason. That can make it seem like the updates proxy refuses to work. -- Chris Laprise, [email protected] https://twitter.com/ttaskett PGP: BEE2 20C5 356E 764A 73EB 4AB3 1DC4 D106 F07F 1886 -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/CAEHqQqTd4jfTymQGMP-Q0_6t7cFkj863_s3LTFQCQmbuF_nERg%40mail.gmail.com. For more options, visit https://groups.google.com/d/optout.
