DNS is not blocked by qvm-firewall. Why?

[apparatus]

@yuri.r

Not sure, how this could be beneficial for consistency. Firewall rules of sys-firewall-lan-only are already enforced by upstream netvm sys-net (the one with LAN controller) in my case.

Do We Need Firewall-qube After Sys-VPN? (Qubes-vpn-support)

Let’s think it through: sys-net is a HVM with direct access to PCI devices (e.g. WiFi) and naturally an internet connection. It will see all traffic. It can also enforce firewall rules like any other proxy qube that has qubes-core-agent-networking installed. Your sys-vpn’s job is to create an encrypted tunnel to a specific server and route all traffic through that tunnel… so now ideally sys-net only sees encrypted traffic to your VPN provider and nothing else. To make sure your sys-vpn d…