Qubes-Whonix eth1 static networking

[phabricator-migrator]

Information

ID: 947
PHID: PHID-TASK-wzfrhrz5qiodswyxbwoo
Author: Patrick
Status at Migration Time: open
Priority at Migration Time: Normal

Description

That could abolish need for qubes-whonix/usr/lib/qubes-whonix/replace-ips at master · Whonix/qubes-whonix · GitHub and related dpkg triggers hack.

Test this in dom0:

qvm-prefs sys-whonix ip 10.152.152.10

Related:

• https://github.com/Whonix/qubes-whonix/blob/master/lib/systemd/system/qubes-whonix-network.service
• qubes-whonix/usr/lib/qubes-whonix/init/network-proxy-setup at master · Whonix/qubes-whonix · GitHub

Comments

---

Patrick

2020-04-03 18:44:52 UTC

How can I undo qvm-prefs sys-whonix ip 10.152.152.10 back to default?

---

marmarek

2020-04-03 19:46:21 UTC

qvm-prefs -D sys-whonix ip

---

Patrick

2020-04-03 20:15:49 UTC

qvm-prefs sys-whonix ip 10.152.152.10 works great so far. Will test more. And call for testers.

But we couldn’t just set that IP inside sys-whonix without touching dom0?

I am asking, because I am wondering how would we port existing and new users to be using this? Changing something for everyone in dom0 might be harder than if just a Whonix package upgrade could make the change.

---

marmarek

2020-04-03 20:23:39 UTC

! In T947#19761, @Patrick wrote:
But we couldn’t just set that IP inside sys-whonix without touching dom0?

No, qubes specifically enforce anti-spoofing firewall rules and VM is constrained to IP set in this property. Allowing VM to freely modify it would defeat the purpose.

I am asking, because I am wondering how would we port existing and new users to be using this? Changing something for everyone in dom0 might be harder than if just a Whonix package upgrade could make the change.

There is GitHub - QubesOS/qubes-core-admin-addon-whonix that can be used to set the IP.

Have you checked how it behaves with multiple Whonix Gateways? Isn’t same IP a problem there?

---

Patrick

2020-04-07 21:27:57 UTC

marmarek (Marek Marczykowski-Górecki):

Have you checked how it behaves with multiple Whonix Gateways?

Aren’t these separated at the virtualizer level? Separate internal networks?

Isn’t same IP a problem there?

That would for sure be a problem. At worst non-functional or traffic
processed by the wrong gateway.