Firewalling from in or outside of qubes?

General Discussion
1

Why would i fiddle with firewall rules inside a qube when one could do it from dom0 qvm-firewall as also automate it easily?

2

Only needed if you want to change advanced stuff like the QubesOS DNS “magic”™, or alter the default forwarding behavior of “provide network” qubes, or accept incoming connections without using the built-in qvm-connect-tcp and so on.

2 Likes
3

hi barto, thanks for responding, “only needed” is a bit vague. I assume net qube dvm is compromised, so an attacker would have full access to the qube (non root available), if i set the firewall rules via qvm-firewall with strict network routes, dns, allow only certain ports for outside communication etc. it would be quiet hard to exit the boundaries from inside the qube or is that assumption wrong?

4

Hi Frogger,

“Only needed” i.e., you only ever need to edit the nftables firewall rules directly if you want to do one of those things barto mentioned.

Aside from that, sys-net is assumed to be easily compromised. That’s why Qubes OS installs with a sys-firewall qube by default. There is nothing special about qvm-firewall and its GUI equivalent. They just share the desired firewall configuration of a qube with that qube’s network qube. Qubes OS tooling inside of the network qube then interprets the qvm-firewall rules, and translates them into nftables rules.

So yes, if you set up nftables rules for a qube inside that qube, then obviously, a program inside that qube can modify and bypass those rules. However, if you set up nftables rules inside that qube’s network qube, then there is (theoretically, at least) nothing that qube can do about it.

It is still, of course, recommended to stick to using qvm-firewall rules, where possible, because it’s easier to mess things up when working with nftables directly.

Hope this helps :slight_smile:

2 Likes
5

Also, of course, qvm-firewall only provides basic control over outgoing
connections. For anything more you will want to use nft, either in the
qube or in the netvm.

I never presume to speak for the Qubes team.
When I comment in the Forum I speak for myself.

3 Likes