Page MenuHomePhabricator

Qubes sys-whonix does not do its job as Qubes FirewallVM
Open, NormalPublic

Description

TODO:

make sys-whonix function as Qubes FirewallVM


Blocker:

Waiting for Qubes ticket Implement new firewall dom0->VM interface to be implemented.


Forum discussion:
https://forums.whonix.org/t/sys-whonix-does-not-yet-function-was-qubes-firewallvm


A sys-whonix currently does it's job as a ProxyVM, but not as a FirewallVM. It currently ignores QubesDB qubes-iptables entries.

Any suggestion on how to implement it without re-inventing qubes-core-agent-linux/network/qubes-firewall? Or refactoring the Qubes code so Whonix can just call the required portion of it?


Related:

Details

Impact
Normal

Event Timeline

Patrick created this task.Jan 19 2016, 2:22 AM
Patrick updated the task description. (Show Details)
Patrick raised the priority of this task from to Normal.
Patrick set Impact to Normal.
Patrick added subscribers: Patrick, marmarek, nrgaway and 2 others.

Related to: mechanism to hide Qubes VM Manager 'Firewall rules' tab

Not sure if worth it. But if it does, lets finish Qubes firewall dom0->VM interface and Qubes Firewall - Add rules to QBS-prefixed chain first. It would be much easier to integrate qubes-firewall with some other firewall scripts.

In T466#8003, @marmarek wrote:

Related to: mechanism to hide Qubes VM Manager 'Firewall rules' tab

Not sure if worth it. But if it does, lets finish Qubes firewall dom0->VM interface and Qubes Firewall - Add rules to QBS-prefixed chain first. It would be much easier to integrate qubes-firewall with some other firewall scripts.

Just noticed Qubes firewall dom0->VM interface is done. Qubes Firewall - Add rules to QBS-prefixed chain not yet. I guess the latter will come soon?

So this feature could still make it into Whonix 14.

Actually the later is also done (slightly differently - see my comment there).
Default static firewall (blocking INPUT etc) still uses iptables, but it doesn't matter on Whonix, since it uses its own version. Dynamic part (qubes-firewall service) use nftables (when installed) and should not interfere with other firewall rules.

For tracking purposes... This still has to wait until Qubes 4.0 since
[Qubes firewall dom0->VM interface](Qubes firewall dom0->VM interface)
will come in Qubes 4.0?

Patrick edited projects, added Whonix 15; removed Whonix 14.Mar 14 2017, 9:25 PM
Patrick updated the task description. (Show Details)Mon, Feb 18, 9:30 AM