Hello,
for a while now I have problems connecting qubes to the internet.
The internet works fine in sys-net and sys-firewall. I checked this via ping 8.8.8.8 and ping www.google.de.
When I connect any qube to sys-firewall, I don’t have internet access.
However my VPN-gateway which is derived from (GitHub - QubesOS-contrib/qubes-tunnel: Integration of vpn tunnels for Qubes OS) connects and when I route the traffic like sys-net->sys-firewall->vpn-gateway->personal then I can connect to the internet. But it seems to be very slow which happens rarely for this vpn provider.
With this setup:
sys-net->sys-firewall->personal
If you ping 8.8.8.8 or ping www.google.de in personal qube terminal then neither will work?
What if you ping in personal qube your VPN server from sys-gateway VPN config instead?
Do you have the same template for your sys-* qubes and personal qube?
Did you change any firewall rules?
What template are you using for sys-net and sys-firewall ?
If you’re using fedora, you could consider trying debian to see if it’s a template-related issue.
Also what does /etc/resolv.conf look like for sys-net and sys-firewall? If it contains ISP IPs, please do NOT include them here.
Maybe there is something wrong with sys-firewall config.
Create new AppVM sys-firewall2 based on fedora-34 template, Networking set to sys-net and check the “Provides network access to other qubes” option.
Then set sys-firewall2 as personal qube net VM and check if network will work.
@deeplow You just changed the name of the topic. I would not say that it’s about routing issues with VPN. I have problems connecting to the internet and for some reason the vpn qube still provides network (allthoug very slow). So it’s a more general problem.
[user@dom0 Desktop]$ diff -y <(qvm-prefs sys-net) <(qvm-prefs sys-firewall-2)
audiovm D dom0 audiovm D dom0
autostart - True | autostart D False
backup_timestamp U backup_timestamp U
debug D False debug D False
default_dispvm D None default_dispvm D None
default_user D user default_user D user
dns D 10.139.1.1 10.139.1.2 dns D 10.139.1.1 10.139.1.2
gateway D 10.137.0.5 | gateway D 10.137.0.31
gateway6 D gateway6 D
guivm D dom0 guivm D dom0
icon D servicevm-red | icon D servicevm-green
include_in_backups D True include_in_backups D True
installed_by_rpm D False installed_by_rpm D False
ip D 10.137.0.5 | ip D 10.137.0.31
ip6 D ip6 D
kernel D 5.10.104-3.fc32 kernel D 5.10.104-3.fc32
kernelopts D kernelopts D
keyboard_layout D de+neo+ keyboard_layout D de+neo+
klass D AppVM klass D AppVM
label - red | label - green
mac D 00:16:3e:5e:6c:00 mac D 00:16:3e:5e:6c:00
management_dispvm D default-mgmt-dvm management_dispvm D default-mgmt-dvm
maxmem - 0 | maxmem D 4000
memory - 400 | memory D 400
name - sys-net | name - sys-firewall-2
netvm - None | netvm - sys-net
provides_network - True provides_network - True
qid - 5 | qid - 31
qrexec_timeout D 60 qrexec_timeout D 60
shutdown_timeout D 60 shutdown_timeout D 60
start_time D 1655281229.0 | start_time D 1655288676.96
stubdom_mem U stubdom_mem U
stubdom_xid D 4 | stubdom_xid D -1
template - fedora-34 template - fedora-34
template_for_dispvms D False template_for_dispvms D False
updateable D False updateable D False
uuid - b4cd7707-fb65-4424-8ddf-76d68762beaa | uuid - b5219a64-d7d2-40fc-8d12-0c22dade1c14
vcpus D 2 vcpus D 2
virt_mode - hvm | virt_mode D pvh
visible_gateway D | visible_gateway D 10.137.0.5
visible_gateway6 D visible_gateway6 D
visible_ip D 10.137.0.5 | visible_ip D 10.137.0.31
visible_ip6 D visible_ip6 D
visible_netmask D | visible_netmask D 255.255.255.255
xid D 3 | xid D 16
With this setup:
sys-net->sys-firewall->personal
What’s the output of ip a and ip r commands in sys-firewall and personal qubes?
Can you ping sys-firewall IP from personal qube?