Disabling sys-net and sys-firewall autostart issues and personal fix

Anyone whos configure sys-net and sys-firewall to be autostart false (qvm-prefs sys-net/sys-firewall autostart false) should realized this by now that it does not work after dispvm autostart features.

Dont get me wrong, that features is great.
But i also like a features that dispvm arent gonna start sys-firewall automatically.
Sometimes, i boot up this laptop just to watch pre-downloaded movies.
but when dispvm starts, sys-firewall and sys-net starts.

At the moment heres my fix.

  1. setting up my sys-firewall as proxy server
  2. dispvm templates (untrusted AppVM in my case) to automatically configure whole network as proxy.

1. for sys-firewall templates (since i use disposable sys-net and sys-firewall based of sys-dispvm AppVM) i add this to /rw/config/rc.local
(my actual config with unrelated removed)

#!/bin/sh

# This script will be executed at every VM startup, you can place your own
# custom commands here. This includes overriding some configuration in /etc,
# starting services etc.

# Example for overriding the whole CUPS configuration:
# rm -rf /etc/cups
# ln -s /rw/config/cups /etc/cups
# systemctl --no-block restart cups
#

if [ $HOSTNAME == sys-usb ]; then
    # snipped since unrelated
elif [ $HOSTNAME == sys-firewall ]; then
    ncat -l -k 8052 --proxy-type http & # < this is the important stuff
elif [ $HOSTNAME == sys-net ]; then
    # snipped since unrelated
elif [ $HOSTNAME == sys-proxy ]; then
    # snipped since unrelated
fi

2. for untrusted AppVM, i have this in my /rw/config/rc.local

#!/bin/sh

# This script will be executed at every VM startup, you can place your own
# custom commands here. This includes overriding some configuration in /etc,
# starting services etc.

# Example for overriding the whole CUPS configuration:
#  rm -rf /etc/cups
#  ln -s /rw/config/cups /etc/cups
#  systemctl --no-block restart cups
#

sleep 5

qvm-connect-tcp 8052:sys-firewall:8052

cat << EOF > /tmp/redsocks_final.conf
base {
    log_debug = off;
    log_info = off;
    log = "stderr";
    daemon = on;
    redirector = iptables;
}
redsocks {
    local_ip = 127.0.0.1;
    local_port = 12345;
    ip = 127.0.0.1;
    port = 8052;
    type = http-connect;
}
EOF

cat << EOF > /etc/resolv.conf
# this script was made by HexorCatZ (mostly Gemini) for untrusted AppVM
# script generated from /rw/config/rc.local
options use-vc
nameserver 8.8.8.8
nameserver 1.1.1.1
EOF

killall redsocks
redsocks -c /tmp/redsocks_final.conf
modprobe dummy
ip link del proxy0
ip link add proxy0 type dummy
ip link set dev proxy0 up
ip addr add 10.0.0.2/24 dev proxy0
ip route del default
ip route add default via 10.0.0.1 dev proxy0

nft flush ruleset
nft add table ip nat
nft add chain ip nat output '{ type nat hook output priority filter ; policy accept ; }'
nft add rule ip nat output oifname "lo" accept
nft add rule ip nat output tcp dport 8052 accept
nft add rule ip nat output ip daddr 127.0.0.0/8 accept
nft add rule ip nat output meta l4proto tcp redirect to :12345

Pros :

  • sys-net and sys-firewall wont get launch when dispvm startup and sleep.
  • sys-net and sys-firewall will start if i open firefox or run any command that needs internet.

Cons :

  • redsocks DNS warmup phase takes nearly a minutes for the first time before you get a response from the internet after vm boots up
  • if both sys-net and sys-firewall does not start up at first, it will launch it but add another delay on top of the already slow redsocks DNS warmup phase.

Dependencies :
redsocks and ncat.
i used nmap sometimes to monitor my network so i already have ncat.
redsocks is something new i just discover when dealing with google gemini.
(its a lot of argument and reset chat before i successfully make partial of that code)

for me the slow internet at startup is worthed when Qubes OS does not connect to the internet when it does not need to.
add a little bit of security i think.

personal, and other AppVM works as usual which turned on the sys-net and sys-firewall.

If Qubes OS developer reading this, can you make something similar to this but better?
also if anyone can improve my code or that nearly 1 minutes warmup times or remove dependencies and only uses the pre-installed qubes tools, feel free to improvise.

1 Like

Firstly, welcome to the forum.

If I’m following your reasoning, which may not be the case, a simpler solution would be to set the netVM for your disposable template to ‘none’. When spawning a dispVM, it will inherit this setting and not bring sys-net and sys-firewall online.

In my setup (in case it’s helpful) I autostart sys-net and sys-firewall, but my network manager prioritizes a LAN only access point, so no WAN without a couple mouse clicks first. I store downloaded vids in an offline qube, with persistence, but which is set to play vids in a named disposable:

Hi ephile.
i forgot to mention that the setup that i do is also making the untrusted AppVM (my template for DispVM per default) to none (qvm-prefs untrusted netvm '').

but, i do use the DispVM sometimes for testing new software (through dnf or pip), ssh to my server, or downloading latest linux iso (such as arch or others) via torrent or direct links.
so i need it to connect to the internet when i need it.

sometimes, (im not sure if this is a good idea or not) i do download an iso images that is too large for dispvm and end up using another appvm for that but with qvm-run-vm --dispvm 'curl <links>' > files.iso and compare the sha256 key after finished.
as the time of this writing, my DispVM is connected to my work computer via ssh (or sftp to be exact) to download and backup files.

sorry for not explaining that previously.

i also like the qvm-open-in-dvm options that you suggest but im a terminal guy and i already replace the default file manager with vifm.
a lot of gui was replaced even default window manager (which i forgot what was it) was replaced with i3.
(sorry. used arch for too long that i think most of the software is heavy)

i could just run a qvm-open-in-dvm command manually but since theres a lot of gui software removed even in TemplateVM, it does not open the movie in video player but instead plays in firefox if not ask me where to save it.
in the end, i just type qvm-run-vm --dispvm 'cat > a.mkv && mpv a.mkv' < files.mkv from vifm shell mode when i want to watch movie.

i had an idea before to ask Qubes OS dev to add a features to something like qvm-open-in-dvm --apps mpv -- files.mkv but feels like theres a reason why they did this to act like that and i dont want to break it.
plus, a features only for me (maybe) its not worth to disturb their time on.