KVM Networking DHCP, Internal, Host Firewall

heavyhitter · March 17, 2021, 10:43pm

Hello,

I have 3 questions about Whonix related KVM networking.

I have tried to hook up a Vfirewall behind the gateway with a plain internal (bridged) network and an internal (bridged) network with a DHCP Server for the gateway. Both failed. Can anyone give me a hint how I can build an internal network that supports communication between the gateway WAN and another VM?
Does anyone have a DHCP server running in gateway lan to make it more flexible for custom workstations? Ive read about the caveats with dhcp in gateway, so Ive had an idea for a KVM internal network that provides a DHCP server for LAN and routes everything to the gateway. Ive had no luck in building this. Please share your experiences.

Not directly Whonix related:

Does anyone have an idea for a HOST firewall that blocks any traffic except from libvirt/KVM group? Or is it possible to use e.g. a macvtap device to route everything through an Ethernet port directly, so you can block host networking completely?

Thanks in advance

Patrick · March 18, 2021, 10:55am

github.com

Whonix/whonix-libvirt/blob/master/usr/share/whonix-libvirt/xml/Whonix-External.xml

<network>
  <name>Whonix-External</name>
  <forward mode='nat'/>
  <bridge name='virbr1' stp='on' delay='0'/>
  <ip address='10.0.2.2' netmask='255.255.255.0'/>
</network>

github.com

Whonix/whonix-gw-network-conf/blob/master/etc/network/interfaces.d/30_non-qubes-whonix#L48


## https://phabricator.whonix.org/T559
#auto eth0
#iface eth0 inet dhcp
## NAT interface to communicate with VirtualBox.
## IP HARDCODED
auto eth0
iface eth0 inet static
        address 10.0.2.15
        netmask 255.255.255.0
        gateway 10.0.2.2
        ## broadcast required?
        #broadcast 10.0.2.255
## When using Virtual Machines (not Physical Isolation),
## - eth1 is an internal, isolated, virtual network,
## - provided and only visible inside Virtual Machines
## - solely used to communicate with the Workstation.
## - it has has no access to the host
## - Thus, the following IP address can NOT cause conflicts
##   with your LAN network or router.

github.com

Whonix/whonix-gw-network-conf/blob/master/etc/resolv.conf.whonix

## Copyright (C) 2012 - 2021 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.

#### meta start
#### project Whonix
#### category networking
#### gateway_only yes
#### installed_by_default yes
#### description
## No DNS configuration.
## Only comments.
## Whonix-Gateway by default does not have system default DNS.
## See https://www.whonix.org/wiki/Whonix-Gateway_Own_Traffic_Transparent_Proxy
## and footnotes.
#### meta end

## Gateway own DNS torified setting.
## Torified DNS server for Gateway's own traffic.
#nameserver 127.0.0.1

This file has been truncated. show original

Most likely, no.

Whonix-Host Firewall

HulaHoop · April 9, 2021, 8:09pm

You probably need to adjust Vfirewall rules to route traffic across it’s interfaces and direct it to the GW. Using a Vfirewall is unnecessary because Libvirt supports custom traffic filtering rules and preset clean traffic ones for some basic protection against spoofing or DoS. I don’t bother with the though because there isn’t much a WS can do and because it can theoretically increase attack surface.

Look at our documentation for DHCP support. Libvirt supports this feature in a minimalist and safer way than installing a full fledged DHCP server on the GW.

This is something we will implement for Whonix Host, but nothing is in code yet.