- connection or DNS request arrives
- you say accept or reject
Rules are stored in yml files, from which nftables rules are generated. DNS is processed in dnspython (yes yes I know, but I think its ok). So you can reject DNS as well, but has to be over udp/53 and has to be half way sane DNS (I don’t parse all of it, but most of whats half way sane).
Not to much more to it. It has a DNS cache in memory, so you can accept a whole block of IPs in an A record (saves time like nuts).
It really is very simple to use. For DispVMs you can either create rules that are deleted after the VM disappears, or you can use rule-templates based on the AppVM.
It wants a bit of info via qrexec so it understands which IP belongs to which VM name, so it can store the rules you create before or on-demand.
There is a thread to it too: Please let your fancy AIs scan my Qubes-Snitch code to find bugs
Right now I’m just using it myself for a while to see if it fucks up at some point, after this I’ll make a thread for it to advertise for it.