Learn how to access your router and perform penetration testing on your internal network using Qubes OS — the right way.
Do NOT use sys-net to access your router, scan other machines, or run pentests. Loading sys-net with tools puts the heart of your Qubes network stack at risk. Instead, create a disposable VM with none netvm (as sys-net) with a USB-RJ45 adapter for isolated, secure access to your private network — keeping sys-net untouched.
Step-by-Step Guide
Step 1 — Create a Custom Template
- Open Qubes Manager
- Right-click on your base template (e.g., debian-13-xfce)
- Select “Clone”
- Name it: debian-13-usb-rj45-local
- Install the tools you need inside the template:
Basic SSH client (for router/server access)
sudo apt update
sudo apt install openssh-client
For a pentest template install pentest and network tools like:
#examples
sudo apt update && sudo apt install -y nmap netdiscover arp-scan masscan hping3 sqlmap gobuster dirb recon-ng hydra john hashcat sslscan tcpdump tshark ngrep netcat-openbsd ncat socat nbtscan snmp onesixtyone
Plus vulnerability scanners: openvas etc…
Note on Kali Linux template: As of July 28, 2026, the Kali Linux template for Qubes does not work reliably. It is recommended to build your own pentest environment manually on a Debian template. If the Kali template becomes functional after this date, simply install it and create a disposable VM using it as the template.
Step 2 — Create a Disposable Template
In Qubes Manager:
- New Qube: Disposable Template
- Name: usb-rj45-local-disp
- Template: debian-13-usb-rj45-local
- Network: No network connection
- Storage/RAM: Default
- Click: Create
Then enable NetworkManager: - Right-click usb-rj45-local-disp → Settings → Services tab
- Add: network-manager
- Apply
Without NetworkManager, the USB-RJ45 adapter will not receive a DHCP lease automatically, requiring manual configuration via ip link or other network configurations.
Step 3 — Create a Named Disposable VM
In Qubes Manager:
- New Qube → Named Disposable
- Name: usb-rj45-local
- Disposable Template: usb-rj45-local-disp
- Network: No network connection
- Storage/RAM: Default
- Click: Create
Verify that network-manager is enabled
- Right-click usb-rj45-local → Settings → Services
- If missing, add: network-manager
- Apply
Step 4 — Connect to Your Private Network
-
- Start the disposable VM: usb-rj45-local
-
- Plug the USB-RJ45 Ethernet adapter into a USB port
-
- Open Qubes Devices → locate your Ethernet adapter
-
- Attach it to: usb-rj45-local
-
- Open a terminal and browser in usb-rj45-local
-
- Verify the connection:
ip route
ip a
nmcli
5 — Access the Router
Assuming your router (e.g., OpenWrt) has IP 10.0.0.1 on network 10.0.0.0/24:
- Via SSH
ssh root@10.0.0.1
Via browser (LuCi web interface)
- Navigate to: http://10.0.0.1
The same applies to any server or PC on the network that accepts SSH:
ssh user@10.0.0.105Step
6 — Perform Pentest (if your template includes pentest tools)
- Scan the router, example with nmap
sudo nmap -sV -A -O -f 10.0.0.1
- Scan a specific device
sudo nmap -sV -A -O -f 10.0.0.105
- Scan the entire network
sudo nmap -sV -A -O -f 10.0.0.0/24
You can also use Metasploit, OpenVAS, or any other tool installed in your template.
You can now use Qubes OS to access routers, servers, and other machines on your private network securely — through a disposable VM with a USB ethernet adapter — without compromising sys-net or needing a separate device.
About usb wifi to acess devices in private network, servers, router or do pentest without use sys-net?
I have to research how to do this! I don’t know yet! Creating a hotspot in Qubes using a USB WiFi adapter is possible, there’s a forum post about it:
However, I managed to create the hotspot, but when I use the USB WiFi adapter to try accessing the router’s WiFi or any WiFi to enter the internal network and access the router, do pentest, SSH into another device, etc… it had several problems and I couldn’t.