Re: [qubes-users] Allow connections to update proxy not being respected!
On Mon, Jan 09, 2017 at 07:09:41PM +, 5xe89r+1y7rhqhfisytc via qubes-users wrote: > Got it now! :D > > I set this up by myself because I want to force all the traffic to go through > the vpn (that is installed on the sys-fw). I've created a custom iptables > rule white-listing all traffic originated from the templateVMs on dport 8082 > and now it works as expected! > Many thanks for the valuable help Unman! > > Btw, strangely when the vpn is first set via the networkmanager that INPUT > rule that white-lists everything to the dport 8082 is created. However when > after that another AppVM is started the rule is trashed. > Any idea why this is happening? > > Many thanks! > You've hit the effect of the qubes-firewall service. This updates iptables following the addition of a downstream qube. To work around this you need tom out your custom rules in to /rw/config/qubes-firewall-user-script, and make it executable. This is in the docs at www.qubes-os.org/doc/firewall If you have a consistent setup then you could save the rules as you want them, load them from rc.local and /rw/config/qubes-firewall-user-script and disable the qubes-firewall service. -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/20170109201850.GA8696%40thirdeyesecurity.org. For more options, visit https://groups.google.com/d/optout.
Re: [qubes-users] Allow connections to update proxy not being respected!
On Mon, Jan 09, 2017 at 03:31:10PM +, 5xb562+7dpfa via qubes-users wrote: > Oh, well spotted! Thx :) > > So what is the option "Allow connections to update proxy" doing if the INPUT > chain allows all traffic destined to 10.137.255.254 ? > Isn't this a flaw? Is there a way to avoid this? > Well, it's there to cover the case where the firewall is between your qube and the updates proxy. In this case you are running the proxy service on the firewall, and you have the qube configured to use the updates proxy, so it is performing as expected. The standard proxy is only there to provide some level of filtering: less now than it used to. If you don't want to use the updates proxy, either stop it running on the firewall, or remove the Proxy setting on the qube/template. If you dont want to do either you will have to introduce a custom rule in the chain to make sure that there isnt any translation for your source IP. -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/20170109161751.GA7346%40thirdeyesecurity.org. For more options, visit https://groups.google.com/d/optout.
