On Tuesday, March 28, 2017 at 12:27:52 PM UTC-4, Nemo wrote: > I'm really having a lot of trouble getting consistent results with the > updates proxy. I've managed to break it on Firewall as well, despite only > removing and then re-adding qubes-updates-proxy (as far as I can tell). > > > Could you please help me by listing the elements required for it to work? > > > Eg > > > * TemplateVM > ** Firewall page > *** Allow connections to Updates Proxy: checked > > > * ProxyVM(can be VPN or Firewall) > ** Firewall page > *** Allow access to 10.137.255.254:8082 (or just all) > ** Services page > *** qubes-updates-proxy listed and checked > *** yum-updates-proxy must not be listed > ** Packages > *** tinyproxy (tinyproxy.x86_64) must be installed > ** CLI firewall rules > *** Official VPN documentation rules are fine, other rules might cause > problems > > > * Net > ** Must have internet access > > > Is there anything else? > > > On Mar 28, 2017 8:47 AM, "Chris Laprise" <[email protected]> wrote: > On 03/28/2017 08:14 AM, Nemo wrote: > > > Yes, I did follow the official documentation to create the proxy. > > > > The only thing I've borrowed from the Rudd-O version is having Firewall > > downstream from VPN, and setting the VPN's firewall settings to block > > all traffic except that on my VPN's port. > > > > Doing updates through the VPN would be perfect if possible. > > > > Adding qubes-updates-proxy service to Firewall-VPN (and installing > > tinyproxy via tinyproxy.x86_64) causes an immediate connection error > > from dnf. Is that caused by the firewall rules I've added to VPN? Are > > they necessary, given a setup via the official documentation? > > > > > It depends on where the rules are set, but I think its probable the added > rules are blocking updates. This type of setup, with downstream proxyVM > handling the updates proxy, is working well for me. > > > > Keep in mind the firewall already has a config to prevent any output not > initiated by the VPN client (i.e. OpenVPN, etc) so restricting by port number > may not be adding anything to link security. > > > > -- > > > > Chris Laprise, [email protected] > > https://twitter.com/ttaskett > > PGP: BEE2 20C5 356E 764A 73EB 4AB3 1DC4 D106 F07F 1886 > > > > -- > > You received this message because you are subscribed to a topic in the Google > Groups "qubes-users" group. > > To unsubscribe from this topic, visit > https://groups.google.com/d/topic/qubes-users/nJ8OkyHuqCw/unsubscribe. > > To unsubscribe from this group and all its topics, send an email to > [email protected]. > > To post to this group, send email to [email protected]. > > To view this discussion on the web visit > https://groups.google.com/d/msgid/qubes-users/46271c9f-ed60-9267-1ecd-8b41e228fdd1%40openmailbox.org. > > For more options, visit https://groups.google.com/d/optout.
Here are the `--verbose` results from `dnf upgrade` in two scenarios: Net < VPN < Firewall-VPN (fedora-24 and qubes-updates-proxy) < TemplateVM [user@fedora-24-minimal-sys ~]$ sudo dnf -v upgrade cachedir: /var/cache/dnf Loaded plugins: builddep, noroot, debuginfo-install, needs-restarting, config-manager, copr, reposync, protected_packages, playground, download, qubes-hooks, generate_completion_cache, Query DNF version: 1.1.10 Cannot download 'https://mirrors.fedoraproject.org/metalink?repo=updates-released-f24&arch=x86_64': Cannot prepare internal mirrorlist: Curl error (7): Couldn't connect to server for https://mirrors.fedoraproject.org/metalink?repo=updates-released-f24&arch=x86_64 [Failed to connect to 10.137.255.254 port 8082: No route to host]. Error: Failed to synchronize cache for repo 'updates' Net < VPN (fedora-24-minimal w/ tinyproxy and qubes-updates-proxy) < Firewall-VPN < TemplateVM [user@fedora-24-minimal-sys ~]$ sudo dnf -v upgrade cachedir: /var/cache/dnf Loaded plugins: debuginfo-install, config-manager, reposync, needs-restarting, download, copr, Query, noroot, qubes-hooks, protected_packages, generate_completion_cache, playground, builddep DNF version: 1.1.10 Cannot download 'https://mirrors.fedoraproject.org/metalink?repo=fedora-24&arch=x86_64': Cannot prepare internal mirrorlist: Curl error (28): Timeout was reached for https://mirrors.fedoraproject.org/metalink?repo=fedora-24&arch=x86_64 [Connection timed out after 120002 milliseconds]. Error: Failed to synchronize cache for repo 'fedora' -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/62adcb6f-0003-4f0c-9e0f-eee4ffa37a41%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
