Monroe coin bounty: how to make other VMs disconnect when the vpn software inside the VM disconnects?

[Felicia]

Sorry, the vpn software I’m using doesn’t have this feature, I need to implement it manually, otherwise I wouldn’t have come here asking for it.

[apparatus]

What is your VPN software?

[Felicia]

A vpn software that is not open source, paid but very fast.

[apparatus]

I don’t know how your VPN software works, but in general VPN is creating a tunnel interface and you can add forward rules to your firewall in VPN qube to allow connections to this tunnel interface from qubes connected to VPN qube and reject all other connections.

[Felicia]

Is it convenient to contact via element? I would like you to give me a specific instruction to solve the problem.

[apparatus]

If your VPN is connecting to static IP:port then you can limit VPN qube connections to this IP:port like this:

Wireguard VPN setup

Good news, with fedora-38 the network manager supports Wireguard out of the box! The only thing required are extra firewall rules in the VPN qube, as explained in the community documentation about VPN. What you’ll need This guide assumes you are using a VPN service that has wireguard support. For example, ProtonVPN and Mullvad VPN do support it. But you can also follow this guide to add any other (even your own). Create a new qube providing network Make sure fedora-38 t…

And you can block forward traffic outside of the VPN like this:

Wireguard VPN setup

Good news, with fedora-38 the network manager supports Wireguard out of the box! The only thing required are extra firewall rules in the VPN qube, as explained in the community documentation about VPN. What you’ll need This guide assumes you are using a VPN service that has wireguard support. For example, ProtonVPN and Mullvad VPN do support it. But you can also follow this guide to add any other (even your own). Create a new qube providing network Make sure fedora-38 t…

[Felicia]

iptables -I FORWARD -o eth0 -j DROP
iptables -I FORWARD -i eth0 -j DROP
ip6tables -I FORWARD -o eth0 -j DROP
ip6tables -I FORWARD -i eth0 -j DROP

Do I just need to disable all eth0 traffic? Set it inside the vpn qube or inside another qube?

[apparatus]

You need to disable eth0 forward traffic and you also need to redirect all DNS traffic from qubes connected to your sys-vpn to your VPN DNS server or it’ll go to Qubes OS default DNS server in sys-net or some other qube before sys-vpn.

@Felicia

Set it inside the vpn qube or inside another qube?

You need to set it inside vpn qube.

Also note that this guide works for Qubes OS 4.1 and older but won’t work for Qubes OS 4.2 because iptables was replaced with nftables and you’ll need to change the firewall commands for nftables.

[balko]

@Felicia

I have two VMs, one VM is running vpn software and the second VM has the first VM set as a gateway, the second VM can access the internet through the vpn inside the first VM. But there is a problem, if the vpn software in the first virtual machine manually disconnects, the second virtual machine will directly access the internet using the real IP. I want to make the first VM’s vpn disconnected so that all the other VM’s can’t access the internet.

You should simply:

• connect vpn VM to some new qube (e.g. sys-vpn-only) that you can make by cloning sys-firewall or creating manually.
• And this sys-vpn-only you should connect to sys-firewall or even sys-net (to lower CPU usage).

This way you will have the same situation as you have now, but then you can add firewall rules for the qube, like that (In dom0):

qvm-firewall sys-vpn-only add accept 1.2.3.4 tcp 443
qvm-firewall sys-vpn-only drop

where instead of 1.2.3.4 you should provide IP of you vpn server, tcp/udp - protocall you are using and 443 should be replaced with the port of vpn server. You can provide multiple lines for various IPs and ports.
To check configuration, use qvm-firewall sys-vpn-only list

This way you will have access only to this vpn server. If your vpn software dies or exits, all qubes connected to your vpn VM will not have internet access.

After all the configuration that you will get:
your-user-qube → your-vpn-qube → sys-vpn-only → sys-firewall → sys-net
or
your-user-qube → your-vpn-qube → sys-vpn-only → sys-net

---

You can also apply qvm-firewall rules directly to the vpn qube, but it is a bit less reliable as I understand and less flexible.

[Felicia]

Failed, my vpn provides dynamic ip, so I can’t restrict outbound by setting public ip, is there any other way?

[apparatus]

You can use this guide to block forward traffic and redirect DNS:

Wireguard VPN setup

Good news, with fedora-38 the network manager supports Wireguard out of the box! The only thing required are extra firewall rules in the VPN qube, as explained in the community documentation about VPN. What you’ll need This guide assumes you are using a VPN service that has wireguard support. For example, ProtonVPN and Mullvad VPN do support it. But you can also follow this guide to add any other (even your own). Create a new qube providing network Make sure fedora-38 t…

[balko]

@Felicia

Failed, my vpn provides dynamic ip, so I can’t restrict outbound by setting public ip, is there any other way?

Please, next time ask for support providing more relevant details on your problem.

[Felicia]

I want to kill the switch function by setting 0.0.0.0 and adding firewall rules for vpn ports, is it possible?

[apparatus]

Yes, it’s possible, just use 0.0.0.0/0 address.

[Felicia]

The problem has been solved, from a private message from a forum user. The solution was to ask the vpn provider for all the public ips and then set them to firewall out, thanks to everyone involved!

[balko]

So, that what you were told: block requests with qvm-firewall using whitelist.
And it is not a solution, you just changed the task conditions again.

[gonzalo-bulnes]

@Felicia

The solution was to ask the vpn provider for all the public ips and then set them to firewall out, thanks to everyone involved!

Is that any different from what @apparatus suggested a few posts ago @Felicia ?

[Felicia]

It varies, if I set 0.0.0.0 in the firewall plus the port for the vpn, the VM will just not be able to access the network.

[apparatus]

Note that if you only configured your firewall rules using GUI then ICMP and DNS are not blocked by default as noted at the bottom of the Firewall rules tab. You need to use qvm-firewall in dom0 terminal to block ICMP and DNS.

[Felicia]

Thanks, can you tell me which command to enter to block dns?