How to use different essids for different qubes?

Hey folks,

my company installed their own internet and switch in my home. So, I was wondering if is possible:

  1. My personal qube connect to my home-wifi using pci-wifi-card of laptop;
  2. And my work qube connect to work-wifi using an usb-wifi;
  3. All other qubes must connect to home-wifi.

If so, anyone has a receipt make it possible?

Of course it is possible. Just create 2 sys-net qubes, for example: sys-net-home and sys-net-work, attach respective device to each, and set correspondent netVM to personal and work qube.
This is all what Qubes exactly is for.

Note that you will have to make sure each qube has the correct network qube set, individually.

Watch out, though, for updates. Without the correct settings, if there’s no qube named sys-net or sys-firewall, they will be automatically re-created when you do an update. The new sys-net qube will probably try to take control of all of your network devices, causing a lot of problems.

For several months I did as tempmail suggested, but had to leave my home wifi qubes named sys-net and sys-firewall so that this wouldn’t happen. Then I changed something to fix that. I tried to figure out how I set this not to happen, but couldn’t make sense out of what I saw on my system.

I am not aware of any automatic sys-net or sys-usb recreating. It is true that in Global settings and in 90-default.policy and other correspondent RPC policies, entries should be updated following qubes name change.

As I can see, my personal qube uses sys-firewall as NetVM; sys-firewall uses sys-net as NetVM. If a create a new sys-net do I must create a new sys-firewall?

And what about anon-whonix qube? It uses sys-whonix as NetVM, that uses sys-firewall that uses sys-net.

Do you have a step by step or a doc?

I have cloned sys-firewall, sys-net and called them sys-firewall-usb and sys-net.

I put anon-whonix with sys-net-usb NetVM and ran well, but I have to shutdown sys-net and sys-firewall.

As I tested, sys-net/sys-net-usb and sys-firewall/sys-firewall-usb can’t tun together.

sys-net and sys-net-usb cannot use the same devices. You’ll have to go into the settings for both and make sure they use different devices.

The firewall qubes shouldn’t have an issue with this, they can use different network qubes or the same one.

Yeap! That was clear for me after the test that I did.
But I’m still looking for the right configs to do. A step-by-step would be nice if you know where I can find one.

Found this but it’s from 2011 The Invisible Things Lab's blog: Playing with Qubes Networking for Fun and Profit

How can I delete PCI wifi card from sys-net-usb and replace for usb?
Device tab in Settings is not allowed


I don’t know why your Devices tab is grayed out. Maybe related issue:

1 Like

Start failed: Requested operation is not valid: PCI device 0000:00:14.3 is in use by driver xenlight, domain sys-net, see /var/log/libvirt/libxl/
libxl-driver.log for details

I interpret that error message as: the qube you’re trying to start (presumably sys-net-usb?) cannot be started because you’ve assigned PCI device 0000:00:14.3 to it, and that PCI device is currently in use by sys-net.

I’d try shutting down sys-net and trying again.

As you figured out and @SteveC said:

That means that you need to make sure the qubes are stopped until you’re done re-assiging PCI devices.

1 Like

Yes, @gonzalo-bulnes ! You are right about the interpretation of the erro message. Everything proposed by you works, except the fact that sys-net and sys-net-usb can’t Start and keep running at same time.
On sys-net-usb I must remove (dettach) PCI device 0000:00:14.3 (that is my PCI Wifi Card) and add (attach) USB Wifi Dongle.
But I couldn’t run this test yet, because of errors below:

Then i tries:

[root@dom0 lstavares84]# qvm-pci d sys-net-usb dom0:00:14.3
Traceback (most recent call last):
  File "/usr/bin/qvm-pci", line 5, in <module>
  File "/usr/lib/python3.8/site-packages/qubesadmin/tools/", line 291, in main
    args = parser.parse_args(args, app=app)
  File "/usr/lib/python3.8/site-packages/qubesadmin/tools/", line 411, in parse_args
    subaction.parse_qubes_app(self, namespace)
  File "/usr/lib/python3.8/site-packages/qubesadmin/tools/", line 200, in parse_qubes_app
    dev = vm.devices[devclass][device_id]
  File "/usr/lib/python3.8/site-packages/qubesadmin/", line 282, in __getitem__
    for dev in self.available():
  File "/usr/lib/python3.8/site-packages/qubesadmin/", line 235, in available
  File "/usr/lib/python3.8/site-packages/qubesadmin/", line 76, in qubesd_call
    return, method, arg, payload,
  File "/usr/lib/python3.8/site-packages/qubesadmin/", line 765, in qubesd_call
    return self._parse_qubesd_response(return_data)
  File "/usr/lib/python3.8/site-packages/qubesadmin/", line 89, in _parse_qubesd_response
    raise qubesadmin.exc.QubesDaemonAccessError(
qubesadmin.exc.QubesDaemonAccessError: Got empty response from qubesd. See journalctl in dom0 for details.

Same issue as the one above:

You can try to disable Intel Volume Management Device (VMD) in BIOS.

1 Like
qvm-pci d sys-net-usb 00:14.3
qvm-pci: error: no backend vm '00'
qvm-pci d sys-net-usb 0000:00:14.3
qvm-pci: error: no backend vm '0000'

Sadly I have no idea how PCI device are named, and don’t know what the BACKEND is supposed to look like in this case. I would have tried the same things you’ve tried. :confused: I take note that dom0:00:14.3 seems to progress further! :bulb:

@disp6252’s suggestion is a lot more promising than anything I can think of at this point. It seems like the issue linked in their post does indeed match closely the error printed by:

qvm-pci d sys-net-usb dom0:00:14.3
1 Like

It works, mate!
Now devices is unlock.

  1. Go to BIOS
  2. Look for Storage menu or search for “VMD”
  3. Change for other option without VMD and that do not need reinstall QOS.

Now I will try others commands to split network here.

Once I read “Experimentation is the arduous task of discovering how simple it is!” :rofl:

Problem solved! Piece of chocolate cake! Thanks @disp6252 and @gonzalo-bulnes


Here the step-by-step:

  1. Go to Start Menu → Qubes Tools -< Qube Manager
  2. Clone “sys-net” AND “sys-firewall” and give them the name that you want like “sys-net-clone”;
  3. Open the Settings of “sys-net-clone” and go to Devices TAB*
    *If Device Tab is disable (aka GRAY OUT or GRAYED OUT), shutdown your notebook, go to BIOS and check if VMD is enable (check image below). Change this config for another one that do not to reinstall QOS
  4. Remove Wifi PCI Card from “sys-net-clone”
  5. In Qube Manager change the Network of sys-firewall-clone from sys-net to sys-net-clone;
  6. Change the Network of qubes (VMs) that you and to use the USB Wifi from sys-firewall to sys-firewall-clone

1 Like