On 11/2/19 6:06 PM, Chris Laprise wrote:
On 10/29/19 5:36 PM, Eric S wrote:
Great point. Initially I was having connection problems on sys-vpn. I
was only able to get the popup notification and Internet access after
I added 'vpn-handler-egress' service (I had already added
'vpn-handler-openvpn' when I created the VM).
You can check on the VPN status in sys-vpn with 'sudo journalctl -u
qubes-vpn-handler'. You can also check firewall settings with 'sudo
iptables -L -v -t nat' and the 'Chain PR-QBS' should have ip
addresses
pointing to your VPN provider's DNS server in the rightmost column
(traffic can appear to be blocked if this doesn't get set).
I did use 'sudo journalctl -u qubes-vpn-handler' to troubleshoot
problems when I first tried to install qubes-vpn-suport. On my first
go-around I cloned sys-net and then installed the scripts as
instructed. I had failures reported in journalctl (sorry, I cannot
remember what the errors were), so I ended up deleting that VM and
instead of cloning off sys-net, I created a new VM based on fedora-30,
added the 'vpn-handler-openvpn' service, and installed
qubes-vpn-support. This time no failures reported from journalctl.
I verified that my VPN provider's DNS servers are listed correctly in
iptables.
Open to additional suggestions or insights, will perform any commands
you request for details. Thanks for your help
Two red flags here are that you needed to use '-egress'... normally only
needed for a kernenl-based protocol like Wireguard. Are you using openvpn?
Also, I don't know how copying sys-net got into it... this can cause
conflicts that would block net access for some dependent VMs. There
shouldn't be any sys-net clones unless you know precisely what you're
doing.
I just signed up with Mullvad bc I hadn't seen it tested recently. Its
working fine on my end with openvpn and using plain fedora-20 for
sys-vpn and the appvm. The arrangement is appvm->sys-vpn->sys-net.
Correction, that is supposed to be fedora-30. :)
--
Chris Laprise, [email protected]
https://github.com/tasket
https://twitter.com/ttaskett
PGP: BEE2 20C5 356E 764A 73EB 4AB3 1DC4 D106 F07F 1886
--
You received this message because you are subscribed to the Google Groups
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/qubes-users/7e3b3fff-2fee-112e-95c4-86b2f94d43da%40posteo.net.
