Page MenuHomePhabricator
Create Task
Maniphest T466

Qubes sys-whonix does not do its job as Qubes FirewallVM
Open, NormalPublic
Actions

Description

TODO:

make sys-whonix function as Qubes FirewallVM

Blocker:

Waiting for Qubes ticket Implement new firewall dom0->VM interface to be implemented.

Forum discussion:
https://forums.whonix.org/t/sys-whonix-does-not-yet-function-was-qubes-firewallvm

A sys-whonix currently does it's job as a ProxyVM, but not as a FirewallVM. It currently ignores QubesDB qubes-iptables entries.

Any suggestion on how to implement it without re-inventing qubes-core-agent-linux/network/qubes-firewall? Or refactoring the Qubes code so Whonix can just call the required portion of it?

Related:

Details

Impact
Normal

Related Objects

Event Timeline

Patrick created this task.Jan 19 2016, 1:22 AM
Patrick raised the priority of this task from to Normal.
Patrick updated the task description. (Show Details)
Patrick added projects: Qubes, Whonix 14, whonix-gw-firewall.
Patrick set Impact to Normal.
Patrick added subscribers: Patrick, marmarek, nrgaway and 2 others.
Herald added a project: Whonix. · View Herald TranscriptJan 19 2016, 1:22 AM
Herald added a subscriber: • WhonixQubes. · View Herald Transcript
marmarek added a comment.Jan 19 2016, 2:07 AM

Related to: mechanism to hide Qubes VM Manager 'Firewall rules' tab

Not sure if worth it. But if it does, lets finish Qubes firewall dom0->VM interface and Qubes Firewall - Add rules to QBS-prefixed chain first. It would be much easier to integrate qubes-firewall with some other firewall scripts.

Patrick updated the task description. (Show Details)Aug 15 2016, 10:37 PM
Patrick mentioned this in T372: Qubes-Whonix Whonix-Workstation TemplateVMs block access to (torified) open internet.
Patrick updated the task description. (Show Details)Aug 19 2016, 12:03 AM
Patrick mentioned this in T476: make sys-whonix function as Qubes FirewallVM .
Patrick added a comment.Oct 5 2016, 9:38 PM
In T466#8003, @marmarek wrote:

Related to: mechanism to hide Qubes VM Manager 'Firewall rules' tab

Not sure if worth it. But if it does, lets finish Qubes firewall dom0->VM interface and Qubes Firewall - Add rules to QBS-prefixed chain first. It would be much easier to integrate qubes-firewall with some other firewall scripts.

Just noticed Qubes firewall dom0->VM interface is done. Qubes Firewall - Add rules to QBS-prefixed chain not yet. I guess the latter will come soon?

So this feature could still make it into Whonix 14.

marmarek added a comment.Oct 5 2016, 11:18 PM

Actually the later is also done (slightly differently - see my comment there).
Default static firewall (blocking INPUT etc) still uses iptables, but it doesn't matter on Whonix, since it uses its own version. Dynamic part (qubes-firewall service) use nftables (when installed) and should not interfere with other firewall rules.

Patrick added a comment.Oct 8 2016, 5:22 PM

For tracking purposes... This still has to wait until Qubes 4.0 since
[Qubes firewall dom0->VM interface](Qubes firewall dom0->VM interface)
will come in Qubes 4.0?

Patrick added a project: iptables.Feb 5 2017, 2:34 PM
Patrick edited projects, added Whonix 15; removed Whonix 14.Mar 14 2017, 8:25 PM
Patrick removed a project: Whonix 15.Dec 7 2018, 11:04 AM
Patrick updated the task description. (Show Details)Feb 18 2019, 8:30 AM
Whonix OLD Issue Tracker · PLEASE DO NOT POST NEW TICKETS HERE · OLD Issue Tracker - Unread Notifications · OLD Issue Tracker - Feed · OLD Issue Tracker - Open Issues · NEW Issue Tracker · Homepage · Blog · Forum · Legal · Imprint · Privacy Policy · Terms of Use · Disclaimer