Can someone please help me set up network routing?

I swear I can’t figure this crap out. All of the tutorials are different, most of them I get stuck halfway through because of a missing command… it’s infuriating. There just isn’t anything Qubes specific. Even Debian specific stuff doesn’t work right in a Debian qube…

I had bigger plans, but right now I would be immensely happy if I got just basic routing working. I just want to give a specific qube some physical ethernet ports, and whatever connects to those ethernet ports (with crossed cables of course) should connect to the internet through whatever netvm I assigned to the qube. That’s the simplest iteration of what I want… and I can’t even get that working.

The furthest I got was with this tutorial: Setting up a Linux gateway/router, a guide for non network admins

Everything seemed to go well until it asks me to ping 192.168.1.1. Up until that point I had been mapping IP’s in my head (from his format to qubes format, eg. 192.168.10.x to 10.137.0.x) but then he mentions 192.168.1.1 and 192.168.0.1, neither of which were mentioned before in the tutorial… not sure if that’s a typo or if he’s talking about his router or what.

Please tell me I’m not the only Qubes user that’s ever needed a router… I just can’t be, I refuse to believe it… Not with the unmatched potential of being able to chain and tunnel different networks any way you want from one single easy to use GUI… Name another OS that lets you do that… come on I know you’re out there…

edit: Yes I set it to HVM mode with no memory balancing and did add the nic’s, which are named ens7, ens8, and ens9 from the qube’s point of view

I was a little confused about what you were trying to do at first, is this right?

External non-qubes device → physical NIC connected to a StandaloneVM → sys-firewall → sys-net → local gateway → internet

The tutorial is assuming that 192.168.0.1 is your local gateway to the internet. 192.168.1.1 was used once in error (these are the most common default subnets for home routers). To test that the external device and the StandaloneVM are routing correctly, ping the 10.137.0.x address of your VM’s eth0. To test the full path through Qubes you will want to ping the IP of your local router to the internet. It will be the default gateway of sys-net.

When testing and troubleshooting, “ip route show” can be used on your external linux device, the StandaloneVM, sys-firewall and sys-net to see where the next hop of traffic will go. The line beginning with “default via…” should be your path to the internet.

192.168.10.x addresses in the tutorial refer to the network between your external device and your StandaloneVM. You probably do not need to change that and it can cause issues if the subnet you use here overlaps with the internal qubes address spaces of 10.13x.0.x or the subnet of your local network.

This is where things can get difficult. If you are using the Qubes Debian 11 template there are quite a few things already in place. Qubes networking is set up by a couple scripts, /etc/xen/scripts/vif-route-qubes and /usr/lib/qubes/qubes_setup_dnat_to_ns. The new iptables rules from the tutorial might need to be reordered to work.

For testing and learning purposes, it may be easier to use install media to install Debian into a HVM rather than starting from the Qubes template. You might need to manually configure eth0 and DNS in that case, but it would match what tutorials are expecting better.

Thank you so much!! Getting Debian right now. I’ll let you know how it goes but it looks promising now that you clarified it for me :grin: