How To make an OpenVPN Gateway in Qubes (4.2, 4.3)

[whoami]

Thanks @longTimeQubesUser @qubesfirewallbug !

I am using only the anti-leak firewall rules in dom0 since it is must simpler than the nftables.

Do we need

@longTimeQubesUser

Create the nftables anti-leak rules script

when doing

@longTimeQubesUser

Anti-leak dom0 firewall rules

?

Which leak cases will be covered by nftables which are not blocked by dom0 firewall approach?

Reference:

@solene

Block all traffic outside VPN using command line Qubes OS Firewall

To configure killswitch + (DNS) leak protection + ICMP/ping blocking + protection in case of sys-vpn compromise, you can alternatively execute a three-liner in dom0, no nft/iptables needed:

qvm-firewall sys-vpn reset # (1)
qvm-firewall sys-vpn add accept dsthost=1.2.3.4 # (2)
qvm-firewall sys-vpn del --rule-no 0 # (3)

(1) resets firewall to one single rule accepting everything
(2) whitelists specific VPN gateway IP
(3) removes rule (1), so there is just one whitelisted IP from (2) left

Everything else is blocked safely outside sys-vpn

Edit: cross-post: Wireguard VPN setup (4.2 and 4.3) - #536 by whoami