Tried that too.
[quote=“Patrick, post:56, topic:374”]because when /usr/bin/whonix_firewall does not exit 0, network will not come up. The shortest possible /usr/bin/whonix_firewall would be
#!/bin/bash
exit 0[/quote]
Good to know. Just tired that too.
On Whonix-Gateway DHCP does not seem to work under any condition, either with whonix_firewall enabled or disabled.
Maybe this could have something to do with it?..
Even though we do have a small DHCP server (that runs inside HVM untrusted stub domain) to make the manual network configuration not necessary for many VMs, this won't work for most modern Linux distributions which contain Xen networking PV drivers built in (but not Qubes tools) and which bypass the stub-domain networking (their net frontends connect directly to the net backend in the netvm), and so our DHCP server is not useful.
https://qubes-os.org/wiki/HvmCreate
But DHCP does work successfully in my baseline plain Debian Wheezy HVM.
When attempting DHCPDISCOVER is says:
DHCPDISCOVER on eth0 to 255.255.255.255 port 67 interval 7
Maybe this call to “255.255.255.255 port 67” is an issue for Whonix in Qubes HVM?
Interesting result…
With Static networking on the Whonix-Gateway eth0, and opening up iptables in the firewallvm, I did some “curl” calls to test Apache webservers I installed in other HVMs on the Qubes system.
My Whonix-Gateway had the following Static IP configuration in “/etc/network/interfaces”:
auto eth0
iface eth0 inet static
address 10.137.2.16
netmask 255.255.255.0
gateway 10.137.2.1
broadcast 10.137.2.255
When I make a “curl” call to another plain Debian Wheezy HVM (IP: 10.137.2.19) running Apache webserver, it does not work from the Whonix-Gateway, even though it works from other HVMs, with iptables adjusted in firewallvm.
curl.whonix-orig 10.137.2.19
However, the interesting part happens when I do the same “curl” call to the Whonix-Workstation HVM (IP: 192.168.0.11) from the statically configured Whonix-Gateway eth0 (IP: 10.137.2.16), it actually goes through and successfully downloads the test Apache webserver page “It works!”.
curl.whonix-orig 192.168.0.11
So this test suggests to me that Static networking on Whonix-Gateway (eth0) is seemingly working, at least partially, since it was able to go fetch a webpage from another HVM on port 80.
During this test, the Whonix-Gateway whonix_firewall was disabled, and there was no eth1 adapter present on the system.
But for whatever reason, the Whonix-Gateway is unable to reach the internet or other 10.137.2.X IP addresses. Yet with Static (10.137.2.X) networking it successfully accessed an Apache webserver at the Whonix-Workstation HVM (192.168.0.11) though.
[quote=“Patrick, post:56, topic:374”]If not, you can isolate the offending package by starting with a plain Debian VM and then installing Whonix network related settings packages one by one or maybe also by starting with a Whonix-Gateway VM and uninstalling network related packages one by one. Alternative to uninstalling you could also look what the package is actually doing and manually undo it to have the same effect.
…[/quote]
Thanks Patrick. I may have to get into this networking package isolation approach next.
