I am trying to set up a second sys-net behind sys-firewall like below
sys-net-2 --> sys-firewall --> sys-net --> Internet
Not able to reach internet from sys-net-2. Running ping www.duck.com
command from sys-net-2
along with tcpdump
shows that sys-firewall
is returning a response to eth0
but the response is not sent to the application. Below is the tcpdump output from sys-net-2.
eth0 Out IP 10.137.0.11.51727 > 10.139.1.1.domain: 576+ A? www.duck.com. (30)
eth0 Out IP 10.137.0.11.51727 > 10.139.1.1.domain: 63325+ AAAA? www.duck.com. (30)
eth0 Out IP 10.137.0.11.40421 > 10.139.1.1.domain: 10107+ PTR? 1.1.139.10.in-addr.arpa. (41)
eth0 P IP 10.139.1.1.domain > 10.137.0.11.40421: 10107 ServFail 0/0/0 (41)
eth0 P IP 10.139.1.1.domain > 10.137.0.11.51727: 576 2/0/0 CNAME duck.com., A 40.89.244.232 (60)
eth0 P IP 10.139.1.1.domain > 10.137.0.11.51727: 63325 1/1/0 CNAME duck.com. (109)
eth0 Out IP 10.137.0.11.59122 > 10.139.1.2.domain: 576+ A? www.duck.com. (30)
eth0 Out IP 10.137.0.11.59122 > 10.139.1.2.domain: 63325+ AAAA? www.duck.com. (30)
eth0 P IP 10.139.1.2.domain > 10.137.0.11.59122: 576 2/0/0 CNAME duck.com., A 40.89.244.232 (60)
eth0 P IP 10.139.1.2.domain > 10.137.0.11.59122: 63325 1/1/0 CNAME duck.com. (109)
eth0 Out IP 10.137.0.11.53663 > 10.139.1.2.domain: 10107+ PTR? 1.1.139.10.in-addr.arpa. (41)
eth0 P IP 10.139.1.2.domain > 10.137.0.11.53663: 10107 ServFail 0/0/0 (41)
Below is the response for the ping command
$ ping www.duck.com
ping: www.duck.com: Temporary failure in name resolution
I have multipart question
-
Is this a nftables firewall issue? I see
ServFail
in tcpdump output and not sure if it has anything to do with the ping not working. -
How to access nftables logs? The qubes docs states that the firewall logs can be accessed using the command
journalctl -u qubes-firewall.service
. But they seem to be for the qubes firewall service and not for nftables.