Custom firewall rules on host

[Erich_Wettel]

Hello, everybody!

Just wondering what specific host iptable rules are absolutely necessary for the Whonix-External and Whonix-Internal networks to operate normally. Any rules beyond that added by libvirt I would like to remove for more security and control.

I’ve carefully read the libvirt iptables documentation but still remain unsure as to what I can remove or alter.

[HulaHoop]

The shipped configs are the barebones absolutely needed to get things functional. Libvirt does support extra rules for security and filtering between machines but I chose not to use them to minimize attack surface and keep things simple. To ensure guest safety/separation one is advised to simply create another isolated network based on the internal config and not bother with anything else.

[pobodysnerfect]

I believe I’ve answered this question:

Host firewalls/VPNs: a solution

Hello! ^^ So, one of the disadvantages of KVM as listed on the Wiki in Why use VirtualBox over KVM? is that it doesn’t work well with host firewalls or VPNs. The root cause of this issue lies in how Libvirt’s Virtual Networking is implemented. The relevant detail here is that libvirt inserts iptables rules to make its virtual networks work, and these tend to clash with any existing rules. Finally, after literally months of googling, learning and experimenting, I believe I’ve solved this probl…