Anyone whos configure sys-net and sys-firewall to be autostart false (qvm-prefs sys-net/sys-firewall autostart false) should realized this by now that it does not work after dispvm autostart features.
Dont get me wrong, that features is great.
But i also like a features that dispvm arent gonna start sys-firewall automatically.
Sometimes, i boot up this laptop just to watch pre-downloaded movies.
but when dispvm starts, sys-firewall and sys-net starts.
At the moment heres my fix.
- setting up my sys-firewall as proxy server
- dispvm templates (untrusted AppVM in my case) to automatically configure whole network as proxy.
1. for sys-firewall templates (since i use disposable sys-net and sys-firewall based of sys-dispvm AppVM) i add this to /rw/config/rc.local
(my actual config with unrelated removed)
#!/bin/sh
# This script will be executed at every VM startup, you can place your own
# custom commands here. This includes overriding some configuration in /etc,
# starting services etc.
# Example for overriding the whole CUPS configuration:
# rm -rf /etc/cups
# ln -s /rw/config/cups /etc/cups
# systemctl --no-block restart cups
#
if [ $HOSTNAME == sys-usb ]; then
# snipped since unrelated
elif [ $HOSTNAME == sys-firewall ]; then
ncat -l -k 8052 --proxy-type http & # < this is the important stuff
elif [ $HOSTNAME == sys-net ]; then
# snipped since unrelated
elif [ $HOSTNAME == sys-proxy ]; then
# snipped since unrelated
fi
2. for untrusted AppVM, i have this in my /rw/config/rc.local
#!/bin/sh
# This script will be executed at every VM startup, you can place your own
# custom commands here. This includes overriding some configuration in /etc,
# starting services etc.
# Example for overriding the whole CUPS configuration:
# rm -rf /etc/cups
# ln -s /rw/config/cups /etc/cups
# systemctl --no-block restart cups
#
sleep 5
qvm-connect-tcp 8052:sys-firewall:8052
cat << EOF > /tmp/redsocks_final.conf
base {
log_debug = off;
log_info = off;
log = "stderr";
daemon = on;
redirector = iptables;
}
redsocks {
local_ip = 127.0.0.1;
local_port = 12345;
ip = 127.0.0.1;
port = 8052;
type = http-connect;
}
EOF
cat << EOF > /etc/resolv.conf
# this script was made by HexorCatZ (mostly Gemini) for untrusted AppVM
# script generated from /rw/config/rc.local
options use-vc
nameserver 8.8.8.8
nameserver 1.1.1.1
EOF
killall redsocks
redsocks -c /tmp/redsocks_final.conf
modprobe dummy
ip link del proxy0
ip link add proxy0 type dummy
ip link set dev proxy0 up
ip addr add 10.0.0.2/24 dev proxy0
ip route del default
ip route add default via 10.0.0.1 dev proxy0
nft flush ruleset
nft add table ip nat
nft add chain ip nat output '{ type nat hook output priority filter ; policy accept ; }'
nft add rule ip nat output oifname "lo" accept
nft add rule ip nat output tcp dport 8052 accept
nft add rule ip nat output ip daddr 127.0.0.0/8 accept
nft add rule ip nat output meta l4proto tcp redirect to :12345
Pros :
- sys-net and sys-firewall wont get launch when dispvm startup and sleep.
- sys-net and sys-firewall will start if i open firefox or run any command that needs internet.
Cons :
- redsocks DNS warmup phase takes nearly a minutes for the first time before you get a response from the internet after vm boots up
- if both sys-net and sys-firewall does not start up at first, it will launch it but add another delay on top of the already slow redsocks DNS warmup phase.
Dependencies :
redsocks and ncat.
i used nmap sometimes to monitor my network so i already have ncat.
redsocks is something new i just discover when dealing with google gemini.
(its a lot of argument and reset chat before i successfully make partial of that code)
for me the slow internet at startup is worthed when Qubes OS does not connect to the internet when it does not need to.
add a little bit of security i think.
personal, and other AppVM works as usual which turned on the sys-net and sys-firewall.
If Qubes OS developer reading this, can you make something similar to this but better?
also if anyone can improve my code or that nearly 1 minutes warmup times or remove dependencies and only uses the pre-installed qubes tools, feel free to improvise.