Qubes sys-whonix does not do its job as Qubes FirewallVM

[phabricator-migrator]

Information

ID: 466
PHID: PHID-TASK-gak2fvp3cfkuw6uwj2o3
Author: Patrick
Status at Migration Time: open
Priority at Migration Time: Normal

Description

TODO:

make sys-whonix function as Qubes FirewallVM

---

Blocker:

Waiting for Qubes ticket Implement new firewall dom0->VM interface to be implemented.

---

Forum discussion:
https://forums.whonix.org/t/sys-whonix-does-not-yet-function-was-qubes-firewallvm

---

A sys-whonix currently does it’s job as a ProxyVM, but not as a FirewallVM. It currently ignores QubesDB qubes-iptables entries.

• Therefore, for example, any TemplateVM using sys-whonix as its NetVM does not block the TemplateVM from using the open (torified) internet. (T372) (That will be solved once set NetVM of TemplateVMs to none by default / make TemplateVMs non-networked by default gets implemented.)
• Additional firewall rules in 'Firewall rules’ tab are ignored.

Any suggestion on how to implement it without re-inventing qubes-core-agent-linux/network/qubes-firewall? Or refactoring the Qubes code so Whonix can just call the required portion of it?

---

Related:

• mechanism to hide Qubes VM Manager ‘Firewall rules’ tab

Comments

---

marmarek

2016-01-19 02:07:51 UTC

Related to: [[ mechanism to hide Qubes VM Manager 'Firewall rules' tab · Issue #1323 · QubesOS/qubes-issues · GitHub | mechanism to hide Qubes VM Manager ‘Firewall rules’ tab ]]

Not sure if worth it. But if it does, lets finish [[ https://groups.google.com/d/msgid/qubes-devel/20160114163808.GW4892%40mail-itl | Qubes firewall dom0->VM interface ]] and [[ Qubes Firewall - Add rules to QBS-prefixed chain · Issue #974 · QubesOS/qubes-issues · GitHub | Qubes Firewall - Add rules to QBS-prefixed chain ]] first. It would be much easier to integrate qubes-firewall with some other firewall scripts.

---

Patrick

2016-10-05 21:38:57 UTC

! In T466#8003, @marmarek wrote:
Related to: [[ mechanism to hide Qubes VM Manager 'Firewall rules' tab · Issue #1323 · QubesOS/qubes-issues · GitHub | mechanism to hide Qubes VM Manager ‘Firewall rules’ tab ]]

Not sure if worth it. But if it does, lets finish [[ https://groups.google.com/d/msgid/qubes-devel/20160114163808.GW4892%40mail-itl | Qubes firewall dom0->VM interface ]] and [[ Qubes Firewall - Add rules to QBS-prefixed chain · Issue #974 · QubesOS/qubes-issues · GitHub | Qubes Firewall - Add rules to QBS-prefixed chain ]] first. It would be much easier to integrate qubes-firewall with some other firewall scripts.

Just noticed Qubes firewall dom0->VM interface is done. Qubes Firewall - Add rules to QBS-prefixed chain not yet. I guess the latter will come soon?

So this feature could still make it into Whonix 14.

---

marmarek

2016-10-05 23:18:29 UTC

Actually the later is also done (slightly differently - see my comment there).
Default static firewall (blocking INPUT etc) still uses iptables, but it doesn’t matter on Whonix, since it uses its own version. Dynamic part (qubes-firewall service) use nftables (when installed) and should not interfere with other firewall rules.

---

Patrick

2016-10-08 17:22:13 UTC

For tracking purposes… This still has to wait until Qubes 4.0 since
[Qubes firewall dom0->VM interface](Qubes firewall dom0->VM interface)
will come in Qubes 4.0?