How can you enforce that an Browser can only access specific Domains in an AppQube?

[hardhead350]

Hi,

how can I enforce that I can only visit certain domains in an Browser in an AppQube? I know that i can whitelist IPs, but that would take too much time.
I assume that I have to create an extra NetVM for the AppQube, but I don’t have an idea on how to create this.

Are there any tutorials out there that can help me, or do you have any tips on which things I can look into which could help me?

In the end, I want to achieve that I can only visit certain websites, e.g. example.com, but only the sites I have explicitly whitelisted.

[moonscape]

You might have a look at this guide:

Restricting a qube to selected websites

A common requirement seems to be the ability to restrict a qube’s access to a certain subset of websites; something that is difficult to achieve using the firewall rules due to multi-hosted websites/CDN’s etc. The following is a description of one way to setup a qube with restricted website access using only software that is already installed in Qubes OS. Create a qube based on template:fedora-32 or fedora-33, lets call it my-proxy. Set its networking to sys-firewall. [Screenshot_2021-03-12_1…

As alternative install host-based application firewall OpenSnitch, if you want something GUI-based and no extra proxy qube. OpenSnitch might as well be installed in a proxy and can control all connections of qubes, which have this proxy as netvm.

[apparatus]

You can specify the domain name in the firewall rules but it’s allowing/blocking the IP addresses in the end so it’s not the best solution for allowing/blocking domain names:

Note that if you specify a rule by DNS name it will be resolved to IP(s) at the moment of applying the rules, and not on the fly for each new connection. This means it will not work for servers using load balancing, and traffic to complex web sites which draw from many servers will be difficult to control.

Firewall