sys-whonix does not yet function was Qubes FirewallVM

[Patrick]

Continuing the discussion from Whonix with firewall rules?:

How to add a ProxyVM between anon-whonix and sys-whonix? (whonix-ws-email -> sys-fw-whonix -> whonix-gw -> sys-firewall -> sys-net)

Changing the NetVM of a TemplateVM from sys-firewall (clearnet) to a Whonix-Gateway means that traffic is no longer restricted to the Updates Proxy. All traffic is allowed. This seems kind of dangerous, but the benefit of Torified updates probably outweighs this drawback for (careful) users. IIRC, this is a known issue.

I don’t think we have tickets / release targets for that already. This is what we have for now.

sys-whonix as Qubes FirewallVM:
https://www.whonix.org/wiki/Dev/Qubes#sys-whonix_as_Qubes_FirewallVM

At 32c3 we’ve discussed moving to an qrexec based updates proxy also. I haven’t found a ticket for this yet, but all of the above influences when and how this should be fixed.

What’s your opinion, when and how this should be implemented? Any [other] tickets the block/influence this? @marmarek

[axon]

Just to clarify, are you asking for my opinion or @marmarek’s? (I want to know @marmarek’s opinion too. )

[Patrick]

Sorry. I am interested in any option. Just highlighting @marmarek so he is getting e-mail notifications as Marek may not have the whole Whonix forums subscribed since its generating lots of traffic. And because I am not sure anymore we discussed this at 32c3 and what we concluded.

[marmarek]

Regarding firewall, the discussion outcome is here: https://github.com/QubesOS/qubes-issues/issues/1815 (actually message linked from there). The idea is to:

1. have updates proxy running over qrexec instead of TCP/IP, so template will not have its own netvm at all
2. ease integration of “qubes firewall rules” with other firewalls (like Whonix one)

So, those are two (related) things: default rules for the template, not enforced by Whonix (will be solved by “1”), and AppVM firewall rules generally when Whonix gateway is in use (“2” will ease solving it, but itself will not be enough).

[Patrick]

make sys-whonix function as Qubes FirewallVM:
https://phabricator.whonix.org/T476