Firewall blocks *everything* including whitelisted sites all of a sudden

User Support General
1

I cannot access lastpass.com anymore

I’ve been using restrictive firewall VMs just fine for quite a while now, but the past day or two they block everything

Running qvm-firewall --reload sys-firewall-lastpass from dom0 does nothing

lastpass_vm_settings
lastpass_vm_settings840×689 52.1 KB

I can access lastpass through a VM that uses sys-firewall though

But if I create a new sys-firewall-test, give it the qubes-firewall service, and allow only www.reddit.com with https port then I have the same issue

Same issue with test firewall when using either fedora or debian templates, and both have qubes-core-agent-networking installed, as well as iproute

I’m on latest QubesOS in terms of updates

2

First question that comes to mind is: do you have DNS resolution in that vm? i.e., opening a terminal and typing “host www.lastpass.com” returns some (IPv4) addresses?

3 Likes
3

Well, I installed bind-utils to be able to do that, restarted both firewall and lastpass VMs, and now it works :no_mouth:

Thanks :laughing: I guess that was it?

1 Like
4

lastpass uses load balancers, so their IP addresses are likely to change regularly.

Using the DNS resolution in the firewall is not great in this situation as the IPs are resolved upon qube starts, so if the IP behind the domain changes, the rule is obsolete.

2 Likes
5

Thanks!

Yeah, lastpass definitely has changed their IPs a few times. Running qvm-firewall --reload <vm> in theory should reload the table, and usually it has helped in the past

Still trying to track down my issue here and what caused it. I changed a couple things

6

Without digging into the inner works of the Qubes firewall, you can add a cron job in dom0 to run something like:

qube="YOUR_QUBE_NAME"; qvm-ls --running --raw-list | grep -q "^${qube}$" && qvm-firewall --reload ${qube} >/dev/null 2>&1

which will check if YOUR_QUBE_NAME is running, and if yes, it reloads its firewall rules.
It’s not very resource-intensive, so you can run it every 2-3 minutes… or 5. I don’t know how often the lastpass IP changes and how often you use it.

1 Like