How to clone firewall settings to another qube?

User Support General
1

Hi,

I figured that firewall settings for qube XYZ are stored in /var/lib/qubes/appvms/XYZ/firewall.xml, so I copy my desired firewal.xml from another qube to the destination - the newly created XYZ qube.

Then, I run qvm-firewall --raw XYZ and it tells me action=accept, i.e. not what the firewall.xml states. I found that rebooting Qubes results in correct qvm-firewall output. I still wonder:

Is there a way to have the correct firewall result without rebooting?

Also, is my overall approach correct, or is there a better way to clone the firewall of one qube into another?

1 Like
2

You could systemctl restart qubesd, followed by qvm-firewall --reload VMNAME if the VM is already running.

But the proper approach would be:

#!/usr/bin/python3

import qubesadmin

app = qubesadmin.Qubes()
src_vm = app.domains["foo"]
dst_vm = app.domains["bar"]

dst_vm.firewall.save_rules(src_vm.firewall.rules)
4 Likes
3

Thanks!

I am trying to make this as a part of a bash script. Is there a way to avoid Python?

1 Like
4 
qvm-firewall --raw -- "$src_vm" |
qubesd-query --fail -- dom0 admin.vm.firewall.Set "$dst_vm" >/dev/null
1 Like
5

This doesn’t give guarantees it worked by looking at the exit code I assume?

1 Like
6

You could make the python script a one liner in your shell script?

1 Like
7

With --fail an admin.vm.firewall.Set API error would result in a non-zero exit code.

This could also be rewritten to ensure that we successfully got the full original ruleset before attempting to clone it:

rules=$(qvm-firewall --raw -- "$src_vm") &&
qubesd-query --fail -- dom0 admin.vm.firewall.Set "$dst_vm" <<<"$rules" >/dev/null
3 Likes
8

Great. Thank you!