Failed to setup Firewall on VPN Proxy VM (operation not permitted)

nospace · April 27, 2021, 5:45pm

hello,
I followed this guide

Qubes-Community/Contents/blob/master/docs/configuration/vpn.md


How To make a VPN Gateway in Qubes
==================================

<div class="alert alert-info" role="alert">
  <i class="fa fa-info-circle"></i>
  <b>Note:</b> If you seek to enhance your privacy, you may also wish to consider <a href="/doc/whonix/">Whonix</a>.
  You should also be aware of <a href="https://www.whonix.org/wiki/Tunnels/Introduction">the potential risks of VPNs</a>.
</div>

Although setting up a VPN connection is not by itself Qubes specific, Qubes includes a number of tools that can make the client-side setup of your VPN more versatile and secure. This document is a Qubes-specific outline for choosing the type of VM to use, and shows how to prepare a ProxyVM for either NetworkManager or a set of fail-safe VPN scripts.

Please refer to your guest OS and VPN service documentation when considering the specific steps and parameters for your connection(s); The relevant documentation for the Qubes default guest OS (Fedora) is [Establishing a VPN Connection.](https://docs.fedoraproject.org/en-US/Fedora/23/html/Networking_Guide/sec-Establishing_a_VPN_Connection.html)

### NetVM

The simplest case is to set up a VPN connection using the NetworkManager service inside your NetVM. Because the NetworkManager service is already started, you are ready to set up your VPN connection. However this has some disadvantages:

- You have to place (and probably save) your VPN credentials inside the NetVM, which is directly connected to the outside world
- All your AppVMs which are connected to the NetVM will be connected to the VPN (by default)

This file has been truncated. show original

on How To make a VPN Gateway in Qubes.
It works for me with this

Set up a ProxyVM as a VPN gateway using iptables and CLI scripts

but this line on the firewall script returns with operation not permitted when I run the vpn. And it would not work.

#    Block non-VPN traffic to clearnet
iptables -I OUTPUT -o eth0 -j DROP

I would not know how to block non-VPN traffic to clearnet.

deeplow · April 27, 2021, 6:22pm

Made the title a bit more descriptive of the problem. Feel free to tweak it.

icequbes1 · May 3, 2021, 9:01pm

For setting up VPN qubes, using qubes-tunnel has been effortless with OpenVPN, and with minor changes, with WireGuard.