On 10/24/19 10:00 PM, Eric S wrote:
I have successfully created new netVM named 'sys-vpn' based on
fedora-30, installed VPN functionality using qubes-vpn-support
<https://github.com/tasket/Qubes-vpn-support> script, and have
successfully connected to Internet with VPN's IP address, verified using
browser in sys-vpn. My network connections look like this:
sys-vpn --> sys-firewall --> sys-net --> Internet
However, when I try to use another client VM with sys-vpn as netVM, the
client is not able to connect to the Internet. Example network connection:
fedora-30 --> sys-vpn --> sys-firewall --> sys-net --> Internet
(fedora-30 cannot access Internet).
I suspect this might be firewall rules, but am pretty noobish on how to
troubleshoot and configure (all rules are default or configured as per
qubes-vpn-support script). I have read the Firewall and VPN docs on
qubes.org (firewall docs are a bit over my head), and scoured firewall
and VPN threads on a number of discussion sites (reddit, qubes-users,
stack overflow, etc.) to understand how to troubleshoot, I am simply at
a loss for figuring out how to resolve.
I have attached graphic to illustrate problem. Any guidance and support
greatly appreciated, thanks for assistance.
'fedora-30' would be the name of a template VM, not a regular app VM.
Templates are blocked from regular Internet access in Qubes.
If all you want fedora-30 to do is update or install software, it can be
done if an update proxy is added to the system (the existing update
proxy in sys-net can no longer see the template's requests bc its
traffic is encrypted by sys-vpn). This could be done by enabling the
Qubes service 'qubes-updates-proxy' for your sys-firewall-vpn VM.
Alternately, you could make the templates update directly by adding
'updates-proxy-setup' to their Qubes services tab and then un-checking
it (this has the effect of disabling the updates-proxy client).
A note about the firewall in qubes-vpn-support: If its configured
correctly with the example settings (using the 'vpn-handler-openvpn'
Qubes service) then you should not be able to browse Internet sites from
inside sys-vpn. Also, you should see a popup notification stating that
the VPN link is 'UP' when sys-vpn starts.
You can check on the VPN status in sys-vpn with 'sudo journalctl -u
qubes-vpn-handler'. You can also check firewall settings with 'sudo
iptables -L -v -t nat' and the 'Chain PR-QBS' should have ip addresses
pointing to your VPN provider's DNS server in the rightmost column
(traffic can appear to be blocked if this doesn't get set).
--
Chris Laprise, [email protected]
https://github.com/tasket
https://twitter.com/ttaskett
PGP: BEE2 20C5 356E 764A 73EB 4AB3 1DC4 D106 F07F 1886
--
You received this message because you are subscribed to the Google Groups
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/qubes-users/e28534bd-e73b-87d7-7d2b-3281361c2114%40posteo.net.
