Since you need to edit Qubes-related DNS rules, you can no longer use iptables on Qubes 4.2, as it has been completely switched to nftables. Also, if I’m not mistaken, iptables is still available by default, at least in Fedora.
Thank you for the suggestion.
At this point, with provided nft instructions everything seem to work fine, so I am afraid to experiment it further with iptables. Now, I am focused on VPN solutions, but it seems it is the same story with nftables in v4.2…
This works with 4.2:
2 Likes
I just install Qubes-4.2 and migrate my sys-dns and sys-wall from 4.1 (with also fedora-38-minimal) and all is good with iptables.
I also check for iptables and it’s always install in fedora-38-xfce.
Fedora replaces iptables with iptables-nft, which converts rules to nftables on the fly:
lrwxrwxrwx. 1 root root 26 Nov 17 15:02 /usr/sbin/iptables -> /etc/alternatives/iptables
lrwxrwxrwx. 1 root root 22 Nov 17 15:02 /etc/alternatives/iptables -> /usr/sbin/iptables-nft
I’m not sure how you got it to work unless you have some iptables leftovers. The PR-QBS chain is not present in Qubes 4.2 since it has been replaced by dnat-dns. Also, FORWARD and INPUT are not accepted by nftables because it’s case sensitive.
Related issue: Some R4.1 firewall scripts do not work after upgrading to R4.2 · Issue #8487 · QubesOS/qubes-issues · GitHub
@DVM I just check on dnsleaktest.com and all is ok.
I use sys-net ← sys-firewall ← sys-dns ← sys-wall ← Appvm
sys-net and sys-firewall have fedora-xfce as template and, sys-dns and sys-wall have fedora-minimal as template…
On minimal i don’t have iptables-nft neither ip6tables-nft. fedora-xfce have it.
NB: i install a clean version of 4.2 and NOT an upgrade, then backup fedora-minimal of 4.1, so i don’t have iptables-net (normal! lol) .
I guess your templates are still running on r4.1 packages then? You will need to manually upgrade them to match the way r4.2 works. This would explain why you can still use these iptables rules.
I’ll try it this night or tomorrow 
do you think it could be a problem for now?
I don’t think this is a problem for now, but upgrade them to 4.2 as soon as possible using this script. When your templates switch to the 4.2 repos, you won’t be able to use iptables as before, and you’ll have to switch to nftables instead.
i launch it in my minimal templates, right?
Yes. Any Templates/Standalone you have restored from a Qubes 4.1 backup will need to be switched to 4.2 repos using the script.
Clone them first, just in case something goes wrong.
For sure! thank you, i’ll do it and tell you if it’s ok.
This script have a topic? If not, that would be a good thing…
I don’t think there is one and I don’t think even the official “how to upgrade” guide for clean installations mentions it.
Since you need to edit Qubes-related DNS rules, you can no longer use iptables on Qubes 4.2, as it has been completely switched to nftables. Also, if I’m not mistaken, iptables is still available by default, at least in Fedora.
I don’t know what “switched” means and whether iptables has been deprecated in a way making any use of it impossible. I question the later, as it would render the very existence of the package in the repo meaningless.
So, I don’t see a reason why iptables rules should not work if the proper iptables package is installed in sys-wall and sys-dns. The fact that Qubes OS uses nftables is not new. In 4.1.2 all firewall rules created through the UI or through qvm-firewall are translated to nft rules. So, if 4.2 does the same (I still don’t know as I still have not upgraded), it is not directly obvious (to me) why that should conflict iptables rules running in parallel.
Of course, getting rid of iptables is the way forward. Just sharing thoughts.
It’s correct for the GUI/CLI firewall because it uses a dedicated nftables table (qubes-firewall), but not for the firewall rules inside all qubes, including the communication between them (e.g. DNS). Some chains related to Qubes have been removed from iptables and moved to nftables (e.g. PR-QBS → dnat-dns). So, for example, the two scripts provided in your post won’t work because the DNS side won’t be applied, the same for the others when used with iptables-nft because nftables uses different table and chain names.
I see.
So, whenever I find time, I will have to re-investigate and update this whole thing.
Is there any existing issue suggesting to have dnscrypt as default DNS provider in Qubes OS? Perhaps that should be the right thing to do, long term.
I tested the setup you provided, replaced the scripts with the ones I converted to nftables in one of my previous posts here, and it worked fine on 4.2.
Related:
I think the current thinking is to forward DNS until it hits a custom service en route or the router’s DNS in sys-net as a last resort.
I upgrade my minimal template with the script, all is good!
But the iptables-nft wasn’t installed during the upgrade and dnscrypt didn’t work. Once the package is installed, everything is back to normal
I don’t think iptables-nft automatically replaces iptables when you install it. Can you confirm that a “PR-QBS” chain is listed when you run this command?
sudo iptables -t nat -L
Thanks for the links. I skimmed through.