KVM Networking DHCP, Internal, Host Firewall

heavyhitter · March 17, 2021, 10:43pm

Hello,

I have 3 questions about Whonix related KVM networking.

I have tried to hook up a Vfirewall behind the gateway with a plain internal (bridged) network and an internal (bridged) network with a DHCP Server for the gateway. Both failed. Can anyone give me a hint how I can build an internal network that supports communication between the gateway WAN and another VM?
Does anyone have a DHCP server running in gateway lan to make it more flexible for custom workstations? Ive read about the caveats with dhcp in gateway, so Ive had an idea for a KVM internal network that provides a DHCP server for LAN and routes everything to the gateway. Ive had no luck in building this. Please share your experiences.

Not directly Whonix related:

Does anyone have an idea for a HOST firewall that blocks any traffic except from libvirt/KVM group? Or is it possible to use e.g. a macvtap device to route everything through an Ethernet port directly, so you can block host networking completely?

Thanks in advance

Patrick · March 18, 2021, 10:55am

https://github.com/Whonix/whonix-libvirt/blob/master/usr/share/whonix-libvirt/xml/Whonix-External.xml

github.com

Whonix/whonix-gw-network-conf/blob/master/etc/network/interfaces.d/30_non-qubes-whonix#L48


      
          ## https://phabricator.whonix.org/T559
          #auto eth0
          #iface eth0 inet dhcp
          
          ## NAT interface to communicate with VirtualBox.
          ## IP HARDCODED
          auto eth0
          iface eth0 inet static
                  address 10.0.2.15
                  netmask 255.255.255.0
                  gateway 10.0.2.2
                  ## broadcast required?
                  #broadcast 10.0.2.255
          
          ## When using Virtual Machines (not Physical Isolation),
          ## - eth1 is an internal, isolated, virtual network,
          ## - provided and only visible inside Virtual Machines
          ## - solely used to communicate with the Workstation.
          ## - it has has no access to the host
          ## - Thus, the following IP address can NOT cause conflicts
          ##   with your LAN network or router.

github.com

Whonix/whonix-gw-network-conf/blob/master/etc/resolv.conf.whonix

## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.

#### meta start
#### project Whonix
#### category networking
#### gateway_only yes
#### installed_by_default yes
#### description
## No DNS configuration.
## Only comments.
## Whonix-Gateway by default does not have system default DNS.
## See https://www.whonix.org/wiki/Whonix-Gateway_Own_Traffic_Transparent_Proxy
## and footnotes.
#### meta end

## Gateway own DNS torified setting.
## Torified DNS server for Gateway's own traffic.
#nameserver 127.0.0.1

This file has been truncated. show original

Most likely, no.

Whonix-Host KVM Firewall

HulaHoop · April 9, 2021, 8:09pm

You probably need to adjust Vfirewall rules to route traffic across it’s interfaces and direct it to the GW. Using a Vfirewall is unnecessary because Libvirt supports custom traffic filtering rules and preset clean traffic ones for some basic protection against spoofing or DoS. I don’t bother with the though because there isn’t much a WS can do and because it can theoretically increase attack surface.

Look at our documentation for DHCP support. Libvirt supports this feature in a minimalist and safer way than installing a full fledged DHCP server on the GW.

This is something we will implement for Whonix Host, but nothing is in code yet.