Please help debug qubes.connectTCP policy (R 4.3.1)

User Support General
, ,
1

Hello everyone,

I’m trying to follow the official documentation to enable networking between two qubes. The intention is to allow ssh from my dev to dev-srv domain, then dynamic forward (SOCKS5 proxy) other ports as needed.

So, I save the following policy in /etc/qubes/policy.d/40-dev-networking.policy:

qubes.connectTCP     +22   dev    dev-srv   allow

and start qvm-connect-tcp 22:dev-srv:22 on dev. Then, when I try to connect:

[user@dev ~]$ nc 127.0.0.1 22
Request refused
2026/06/18 14:35:14 socat[213050] W waitpid(): child 213051 exited with status 126

And I see a corresponding journal entry in dom0:

qrexec: qubes.ConnectTCP+22: dev -> dev-srv: denied: denied by policy /etc/qubes/policy.d/90-default.policy:22

Even when I change my policy to very liberal

qubes.connectTCP  *  @anyvm  @anyvm  ask

I get the same error; my rule is clearly not being loaded.

What can I do to debug?

1 Like
2

Seems like you saved it to a wrong directory

1 Like
3

Thanks for catching this!

I did save it in the proper directory /etc/qubes/policy.d, which I then misspelled when posting here (no easy copy-paste from dom0).

In fact, I created the policy with the policy editor tool, which forces the correct directory and also does some syntax checks.

Sorry for the confusion.

1 Like
4

It should be qubes.ConnectTCP, with a capital C at the beginning of the word Connect.

3 Likes