No network connection via debian 12 templates after update to 4.2-rc4

scallyob · October 17, 2023, 2:57pm

I’ve been updating from 4.1 to 4.2-rc4 last few days. One issue I had was my sys-net and sys-firewall stopped working during the upgrade process (I’m not sure when). I eventually discovered changing the templates from debian-12 to fedora-38 fixed this. Both were newly installed templates.

Can’t find any other mentions of this. I can post on github issues, but wanted to check here first if no one else has this issue.

For now using fedora is fine with me.

Note: I had tried removing sys-firewall and recreating with:
sudo qubesctl state.apply qvm.sys-firewall

That created a new disposable VM based on debian, and still did not work. Switching the disposable template to Fedora did work.

ToeiRei · October 17, 2023, 10:33pm

out of curiosity, do you have iptables installed on that template? I remember having to fix something like that before

scallyob · October 17, 2023, 10:52pm

The debian12 was a new template, don’t think I altered it at all.

$which iptables

returns nothing

ToeiRei · October 17, 2023, 11:05pm

guess that’s your problem then. Firewalling is done using iptables. I remember seeing a bug that states that debian 12 templates are missing iptables.

scallyob · October 17, 2023, 11:18pm

ok, that makes sense

found this:

github.com/QubesOS/qubes-issues

iptables →nftables

opened 05:57PM - 11 May 19 UTC

closed 06:46PM - 22 Jul 23 UTC

DemiMarie

T: enhancement C: core release notes P: default pr submitted C: networking

**The problem you're addressing (if any)** QubesOS uses the legacy xtables stac…k via iptables **Describe the solution you'd like** QubesOS should use the modern nf_tables kernel subsystem exclusively **Where is the value to a user, and who might that user be?** This is likely to be of greatest value to advanced users, but could also improve firewall throughput for those with very fast connections. **Describe alternatives you've considered** QubesOS could switch to BPF-based firewalling, but that is more complicated. **Additional context** Debian 10 uses iptables-nft by default, which implements iptables on top of nf_tables. Furthermore, `nf_tables` has features like vmaps and sets, which can provide a performance improvement. **Relevant [documentation](https://www.qubes-os.org/doc/) you've consulted** <https://wiki.nftables.org/wiki-nftables> **Related, [non-duplicate](https://www.qubes-os.org/doc/reporting-bugs/#new-issues-should-not-be-duplicates-of-existing-issues) issues** #4991

Seems like something they’re still trying to figure out even though this issue is closed? Seems bad if someone has debian set to their default that sys-firewall just doesn’t work as happened to me.

ToeiRei · October 17, 2023, 11:43pm

try installing iptables and you should be good again.

scallyob · October 17, 2023, 11:45pm

I’m fine using Fedora. At this point have many much bigger issues with my upgrade I need to attend to!

adw · October 18, 2023, 12:07pm

I’m reminded of this issue, but it appears to be about only dom0 updates, whereas yours seems to be about network connectivity in general:

github.com/QubesOS/qubes-issues

Dom0 updates fail when update qube is based on Debian 12

opened 11:05PM - 03 Sep 23 UTC

UndeadDevel

T: bug P: critical C: Debian/Ubuntu needs diagnosis C: updates affects-4.1

### Qubes OS release 4.1.2 ### Brief summary Since about Saturday, th…e second September, dom0 updates stopped working normally for me. Running `sudo qubes-dom0-update --clean --console --show-output` (no Tor, firewall qube is updateVM) results in several errors: First three errors like the following: `Unable to detect release version (use '--releasever' to specify release version)` And after the fetching of Fedora and Fedora Updates: `Status code: 404 for https://yum.qubes-os.org/r$releasever/current/dom0/fc32/repodata/repomd.xml.metalink Error: Failed to download metadata for repo 'qubes-dom0-current': Cannot prepare internal mirrorlist: Status code: 404 for https://yum.qubes-os.org/r$releasever/current/dom0/fc32/repodata/repomd.xml.metalink` And it fails. If I instead run `sudo qubes-dom0-update --clean --console --show-output --releasever=4.1` then it will only throw two instead of three errors about release version and correctly complete without further errors. I also noticed that running `echo $releasever` gives no result, neither in dom0 nor in the updateVM. ### Steps to reproduce Run above command: `sudo qubes-dom0-update --clean --console --show-output` ### Expected behavior No errors and successful update. ### Actual behavior Lots of errors and successful update only with workaround. ### Related issues #6867 #7229

scallyob · October 18, 2023, 1:53pm

That’s correct, nothing was updating. I actually seemed to have no network connectivity via sys-net or sys-firewall at all at first. Using sys-whonix was not a workaround (that was already my default). Had to set to change sys-net to fedora-38 first. Then I set sys-whonix to connect to sys-net directly. Before I eventually switched sys-firewall to fedora-38 as well.

( I could fairly easily test this to see if debian-12 is still not working at all for network if there’s anything you want me to check. But I’m also dealing with some bigger upgrade problems first.)