On Tue, Mar 28, 2017 at 05:24:00PM -0700, Nemo wrote:
> > 
> > To help me understand how qubes-updates-proxy is working, is this more or 
> > less accurate?:
> > 
> > The proxy gives the TemplateVM's network connection permission to break 
> > through it's own firewall's "Deny All" setting, for the purpose of updates 
> > only.
> > 
> > The proxy should be applied on a FirewallVM before hitting a VPN/NetVM. The 
> > FirewallVM will block all traffic, but proxy the repo request, which it 
> > receives  via tinyproxy at 10.137.255.254:8082. The request will pass 
> > through the FirewallVM and arrive in the VPN/NetVM as a normal repo request.
> > 
> > Is that right?
> > 
> > ------------------------------------------
> > 
> > To (maybe?) confuse things further:
> > 
> > I just realized that the TemplateVMs will not update via Firewall-VPN even 
> > if they are set to allow all traffic. Although they will still update via 
> > the Net < Firewall < TemplateVM chain either directly or through the proxy 
> > without issue.
> 
> Hmmm, actually I missed running `iptables -L -nv`
> 
> [user@sys-firewall-vpn ~]$ sudo iptables -L -nv
> Chain INPUT (policy DROP 0 packets, 0 bytes)
>  pkts bytes target     prot opt in     out     source               
> destination         
>     0     0 DROP       udp  --  vif+   *       0.0.0.0/0            0.0.0.0/0 
>            udp dpt:68
>     0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0 
>            ctstate RELATED,ESTABLISHED
>     0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0 
>           
>     0     0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0 
>           
>     0     0 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0 
>            reject-with icmp-host-prohibited
> 
> Seems I'm filtering all this traffic, which would cause problems...
> 
> I tried recreating Firewall-VPN from scratch, and ran `iptables -L -nv` 
> immediately after adding qubes-updates-proxy
> 
> [user@sys-firewall-vpn2 ~]$ sudo iptables -L -nv
> Chain INPUT (policy DROP 0 packets, 0 bytes)
>  pkts bytes target     prot opt in     out     source               
> destination         
>     0     0 DROP       udp  --  vif+   *       0.0.0.0/0            0.0.0.0/0 
>            udp dpt:68
>     0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0 
>            ctstate RELATED,ESTABLISHED
>     0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0 
>           
>     0     0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0 
>           
>     1    52 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0 
>            reject-with icmp-host-prohibited
> 
> Doesn't seem like 8082 is automatically added. How can I add the record?
> 

You can add the rule like this:
'sudo iptables -I INPUT -p tcp --dport 8082 -j ACCEPT'

'-I INPUT' Inserts the rule at the top of the INPUT chain (You can
specify a number here, like '-I INPUT 2' to specify position.)

-p tcp = specifies Protocol is tcp
--dport = Destination PORT

Try that and see if it works for you.
If this is the solution, (and I think it is), the you can add this line
in /rw/config/qubes-user-firewall-script - look at the docs on the Qubes
firewall to help here.

This is a known issue in proxyVMS - in fact I've fixed it and that code
is merged but, I guess, you havent yet got it.

Make sure you clean up any other changes you may have made getting to
this point.

unman

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/20170329012000.GA9921%40thirdeyesecurity.org.
For more options, visit https://groups.google.com/d/optout.

Reply via email to