The goal is to stream content from my camera to a single qube. The camera provides a Wi-Fi network and a usb Wi-Fi adapter will be used just for the purpose to connect to the camera Wi-Fi. The camera sends a live view via UDP. It seems incoming UDP is blocked by default and I don’t know enough about firewalling and security in Qubes OS to unblock it in a secure way.
Questions:
what’s the best way to connect to the camera Wi-Fi? Should I use a separate sys-net or sys-firewall for it?
how do I allow incoming UDP for this purpose in a secure way?
Edit:
Additional info:
The app I am using works similar to this one: GitHub - wegel/lumixcam · GitHub , i.e. connect to the camera’s Wi-Fi, then run the app.
You do not open your firewall for incoming when you watch UDP TV streams, so I don’t see why you should do it for a camera. All you likely need is to connect to the UDP stream (IP_ADDRESS:PORT), e.g. using vlc or mpv, from the qube. You can restrict connections to UDP traffic from host with IP_ADDRESS and certain PORT like this:
I am still trying to understand things and it gets confusing pretty fast. E.g. the second sentence on Firewall — Qubes OS Documentation says
By default there is one default net qube used as firewall …
I always thought that the default sys-net is a net qube (just from the name of it) and sys-firewall is a firewall qube but that doesn’t seem to be the case.
Thank you, @qubist , your answer came in while I was just writing this post. So I will stop reading for now and try your suggestion first. It seems a lot easier than the other suggestions.
And I thought it was pretty clear that I know nothing
Sorry if my questions weren’t clear. I am still trying to understand things. And I may still need your suggestions.
Do you mean “allow” instead of “restrict”? Because as it is now, the streaming from the camera to the qube is blocked by something.
action=accept as in the rule. To make it restrictive you also need to add action=drop as a last rule.
If the command line is confusing you, you can do the same through the GUI. Open the settings of the qube and go to “Firewall rules” tab, Limit outgoing connections to… press the ‘+’ button and set your config.
Hmm, I don’t want to limit any connections (for now), just trying to make it work.
Rereading that again this may be a different setup. I guess in the case of the TV both devices are connected to the same local network and you can access the UDP TV stream over this network?
In case of my camera it is the camera that provides the Wi-Fi network, and the qube that connects to it.
Now I’ll continue reading and trying to understand things …
It doesn’t matter if the address of the streaming host is 10.10.10.10 (LAN) or 55.66.77.88 (Internet). This is non-Qubes specific. As long as the IP address of the camera is not in the address set used by qubes (10.137.x.x), you should be fine.
Connect to the camera using your WiFi adapter. As noted by others, you can create a separate sys-net-2 and sys-firewall-2, so it does not interfere with your regular Internet connection. Then you set the NetVM of your client qube to sys-firewall-2 and connect to the camera using sys-net-2, then access the stream using your player of choice. The firewall setup I suggested is an additional security measure, so you can be sure that the client qube can connect only to the camera.
While I still don’t understand everything (will continue to read) I got it to work with the script from @solene and a new sys-net-2 and sys-firewall-2.
So it was indeed necessary to open the UDP port to make it work. Without it it did not work.
One problem I am still facing: the UDP port is different each time, the IP stays the same though, and no other machine on my local net has this IP. Would it be possible to adjust the script to allow the IP with any UDP port?
Doing things mechanically without understanding is dangerous (especially in dom0). I have not seen this script and I don’t know what it does, so I can’t answer your question.
