Field Report: Simultaneous Network Configurations

General Discussion
1

I ran into an niche use case for my Qubes setup, didn’t readily find any threads discussing my particular issue. Now that Ive resolved it, I can document the process for public memory

Background: I maintain a handful of IoT devices on a secondary VLAN, isolated from the main network on which my computer & other trusted devices operate. I strictly limit the WLAN internet connections that can be made from this VLAN via router firewall. I have two network interfaces: a USB WiFi adapter, and an ethernet adapter

Problem:

  • I need to interface with these IoT devices over WiFi, for updates & day-to-day operation.
  • I must maintain access to WLAN internet from Qubes through my primary network over ethernet, while simultaneously connecting to IoT devices over the VLAN with WiFi
  • I should be able to quickly boot up a program & interface with any particular IoT device
  • At rest, my desktop should not establish or maintain a connection to the VLAN

Solution

  1. Create a qube, from which you will run whatever programs you will need. I have one or two rather complex programs requiring persistent home & root, so I opted for a standalonevm. But a simpler setup could use a disposable or appvm. I named mine ‘iot’
  2. Clone sys-firewall. I renamed my clone ‘sys-firewall-iot’. Under ‘iot’ settings, change the network vm to this new qube
  3. Clone sys-net. I renamed my clone ‘sys-net-iot’. Under ‘sys-firewall-iot’ settings, change the network vm to this new qube. You will also need to remove the default network adapter from Devices, or you will encounter an error as the qube attempts to attach a device already belonging to sys-net
  4. Start the ‘iot’ qube. If you configured the prior steps properly, sys-firewall-iot and sys-net-iot should also start
  5. You’ll now need to attach your secondary network adapter to the new sys-net-iot qube, and set this to happen automatically upon qube boot. If it’s a USB adapter like mine, this should be easily accessible through the sys-usb icon on your primary display’s panel tray
  6. Kill all three qubes (iot, sys-firewall-iot, sys-net-iot)
  7. Optional: use qube firewall to limit network connections through this new interface. I have a small number of IPs, and will only be using SSH & SFTP, so I limited connections to only these protocols from the iot qube
  8. Restart iot. Once again, sys-firewall-iot and sys-net-iot should start
  9. Under your panel tray, you should see a new network manager icon. So long as your system has the necessary drivers to run this network controller, it should populate with network options. If using WiFi, select your network & save credentials
  10. Optional: I did not want the IoT network config to run by default, so I disabled start on boot across all three qubes

End Result: by default, my system only connects to my main network via ethernet adapter through sys-net. But when I need to work on my IoT devices, I can launch the IoT cube: sys-net-iot automatically connects to my IoT VLAN, and I can begin work immediately. I maintain connection to my main network throughout, allowing me to assess other sites or cloud services if needed. When finished, I manually kill the three IoT cubes to disconnect from the network

Limitations: A given network adapter cannot simultaneously be assigned to two qubes. In this example, I maintain primary internet access through an ethernet adapter on sys-net, and IoT WiFi connection through a separate USB dongle on sys-net-IoT. You will be unable to configure this with a single physical network interface. USB Wifi dongles can be picked up from your local retailer for pretty cheap

1 Like
2

You could do the same on a regular OS, I’m not sure Qubes OS allows anything special here :slight_smile: Or did I miss something?

3

Not especially, no. Nothing too complex here. Just making an effort to document a config that may be useful to non-technical Qubes users in the future

Of course, I get to run these IoT connections and auxiliary programs in a Qube, adding a layer of isolation from untrusted IoT devices & third-party programs that I wouldnt get to enjoy on a vanilla OS

I can avoid future posts like this if we feel it’s straying too far from the forum MO. I thought I was being helpful, lol

4

No problem, always interesting to read about real world usage, and I’m not a moderator :smile:

1 Like
5

I’m always slpit my default ‘sys-net’ to ‘WiFi’ and ‘Ethernet’ qubes on my laptop…
This way I can use them in parallel - for whatever use case you can imagine :slight_smile: Yours is one good example.

However the idea is not new, as it was shared by Joanna in the very early ages of Qubes OS:

Where the actual instructions might be outdated, but the main idea is still the same. - Would be worth ‘translating’ it to the latest version of Qubes for sure.

2 Likes
6

I think these kinds of posts are helpful and appropriate to the forum. :+1: I want to know how other users approach and overcome situations I’m likely to encounter.