No internet connection in Waydroid container: Need help with Qubes firewall

User Support General
1

Dear Qubes community,

I have installed Waydroid in Fedora 38 (Qubes 4.2) to be able to use Android programs. But for Waydroid to be able to use the internet connection, something has to be done additionally. The VM is behind sys-firewall without any special firewall configurations. IPv6 is activated.

With “ip addr show” “waydroid0” also appears. I cannot use the “firewall-cmd” command recommended by Waydroid to solve the problem, because if you install the associated package, the Qubes packages will be removed. Does anyone here know what to do?

See also: Networking Issues | Waydroid

2

Configure firewall like this:

3

Thank you for this great guide. In which file should I place the firewall rules: Waydroid template

cat << 'EOF' | tee /etc/systemd/system/waydroid-firewall.service >/dev/null
[Unit]
ConditionPathExists=!/run/qubes/this-is-templatevm
PartOf=waydroid-container.service
After=waydroid-container.service
BindsTo=waydroid-container.service
Requires=qubes-iptables.service
After=qubes-iptables.service
BindsTo=qubes-iptables.service
[Service]
Type=oneshot
ExecStart=/usr/bin/bash -c "if (nft create chain ip qubes waydroid-input) &>/dev/null; then nft add rule ip qubes custom-input jump waydroid-input; fi"
ExecStart=/usr/bin/bash -c "if (nft create chain ip qubes waydroid-forward) &>/dev/null; then nft add rule ip qubes custom-forward jump waydroid-forward; fi"
ExecStart=/usr/sbin/nft add rule ip qubes waydroid-input iifname "waydroid0" meta l4proto {tcp, udp} th dport { 53, 67 } accept
ExecStart=/usr/sbin/nft add rule ip qubes waydroid-forward iifname "waydroid0" oifgroup 1 accept
ExecStart=/usr/sbin/nft add rule ip qubes waydroid-forward oifname "waydroid0" iifgroup 1 accept
ExecStop=/usr/sbin/nft flush chain ip qubes waydroid-input
ExecStop=/usr/sbin/nft flush chain ip qubes waydroid-forward
RemainAfterExit=yes
[Install]
WantedBy=waydroid-container.service
EOF
systemctl daemon-reload
systemctl enable waydroid-firewall.service
4

Just copy this code block and paste it in your waydroid template terminal to run it.

5

This part of the first command does not work:
cat << 'EOF'
So after running all commands the terminal says:

Failed to enable unit: Unit file waydroid-firewall.service does not exist.

What could be the problem here?

6

What was the error?
Did you run all this code in the root terminal?
Try this:

cat << 'EOF' | sudo tee /etc/systemd/system/waydroid-firewall.service >/dev/null
[Unit]
ConditionPathExists=!/run/qubes/this-is-templatevm
PartOf=waydroid-container.service
After=waydroid-container.service
BindsTo=waydroid-container.service
Requires=qubes-iptables.service
After=qubes-iptables.service
BindsTo=qubes-iptables.service
[Service]
Type=oneshot
ExecStart=/usr/bin/bash -c "if (nft create chain ip qubes waydroid-input) &>/dev/null; then nft add rule ip qubes custom-input jump waydroid-input; fi"
ExecStart=/usr/bin/bash -c "if (nft create chain ip qubes waydroid-forward) &>/dev/null; then nft add rule ip qubes custom-forward jump waydroid-forward; fi"
ExecStart=/usr/sbin/nft add rule ip qubes waydroid-input iifname "waydroid0" meta l4proto {tcp, udp} th dport { 53, 67 } accept
ExecStart=/usr/sbin/nft add rule ip qubes waydroid-forward iifname "waydroid0" oifgroup 1 accept
ExecStart=/usr/sbin/nft add rule ip qubes waydroid-forward oifname "waydroid0" iifgroup 1 accept
ExecStop=/usr/sbin/nft flush chain ip qubes waydroid-input
ExecStop=/usr/sbin/nft flush chain ip qubes waydroid-forward
RemainAfterExit=yes
[Install]
WantedBy=waydroid-container.service
EOF
sudo systemctl daemon-reload
sudo systemctl enable waydroid-firewall.service
7

Now it worked. Thank you!

8

I can search with Google in Waydroid now, but if I try to reach the playstore website, the browser says: Error, domain name not resolved. Hm, do you know this error?

9

I can access https://play.google.com in the browser inside Waydroid. Are you able to access other websites besides google.com?

10

Suddenly it works. But I do not find a version of Google play store on the internet which works with waydroid. The installed versions crash on startup.

11

Did you try the Waydroid image with GAPPS?

-s SYSTEM_TYPE | --system_type SYSTEM_TYPE : System type (options: VANILLA, FOSS or GAPPS; default is VANILLA)