Corridor Setup Question

[Patrick]

I guess the advantage of corridor is that is makes violations known in logs while using Qubes firewall simply blocks it if it ever was to happen.

@whonix8573

@Patrick

Where did you read that this is required?

It is considered by many to be best practice to delete all firewall rules before writing new rules (same way in Debian you do “ufw --force reset”). Not required, but helpful.

I would be careful about this in context of Qubes. → Verify Changed Firewall Rules

@whonix8573

qvm-firewall sys-firewall del --rule-no 0

If this is really useful, that seems at least like a usability issue. Please check that this has been reported anywhere and if not I suggest a to write a report to make sure you’re on the right track here.

@whonix8573

Yes, only one (see above). I named the VM sys-firewall but you can name it whatever you want (e.g., sys-whonix-firewall). The thing is to put a firewall VM (clone or create a new one) before sys-whonix and configure the above firewall rules in that firewall VM.

Ok. So no corridor involved here.

@whonix8573

otherwise DNS / ICMP would still be generally allowed.

How about blocking all UDP?

What about IPv6?

related: add IPv6 support