comment whonix-firewall-plugin iptables rules

phabricator-migrator · February 19, 2024, 5:49pm

Information

ID: 345
PHID: PHID-TASK-tsenbzrv4db3vjmjicy5
Author: Patrick
Status at Migration Time: resolved
Priority at Migration Time: Normal

Description

Please add comments on top of these iptables rules to document what those are good for.

github.com

nrgaway/qubes-whonix/blob/eb9b63e34e385b5d8d3e1c7876b04b11974f1efe/usr/lib/qubes-whonix/init/whonix-firewall-plugin#L16-22


      
          
          source /usr/lib/qubes-whonix/utility_functions.sh
          
          # Start Whonix Firewall
          if [ -e /var/run/qubes-service/whonix-gateway ]; then
              ip=$(${QUBESDB}-read ${PREFIX}qubes-netvm-gateway 2> /dev/null)
          
              export INT_IF="vif+"
              export INT_TIF="vif+"
          
              iptables -t nat -N PR-QBS-SERVICES
              iptables -A INPUT -i vif+ -p tcp -m tcp --dport 8082 -j ACCEPT
              iptables -A OUTPUT -o vif+ -p tcp -m tcp --sport 8082 -j ACCEPT
              iptables -t nat -A PREROUTING -j PR-QBS-SERVICES
              iptables -t nat -A PR-QBS-SERVICES -d 10.137.255.254/32 -i vif+ -p tcp -m tcp --dport 8082 -j REDIRECT
              iptables -t nat -A OUTPUT -p udp -m owner --uid-owner tinyproxy -m conntrack --ctstate NEW -j DNAT --to ${ip}:53
              iptables -t nat -A OUTPUT -p tcp -m owner --uid-owner tinyproxy -m conntrack --ctstate NEW -j DNAT --to ${ip}:9040
          
              # Route any traffic FROM netvm TO netvm BACK-TO localhost \\
              # Allows localhost access to tor network \\
              #iptables -t nat -A OUTPUT -s ${ip} -d ${ip} -j DNAT --to-destination 127.0.0.1 \\

Comments

nrgaway

2015-06-06 16:07:20 UTC