Prevent Qubes OS clearnet leaks

de_dust2 · February 3, 2026, 9:11pm

There should be a simple interface with hooks into sys-net that should be opened and presented to a user at first login. Until a user explicitly allows, sys-net should not emit any IPv6/IPv4 packets at all.

This mechanism should be an option in the installer.

barto · February 4, 2026, 8:44am

On the other hand, the user can easily leave the Ethernet cable unplugged and/or not type in the WiFi credentials, and achieve the same goal without any changes to the install process!

solene · February 4, 2026, 10:16am

It still require you to know you need to disable update checking for all qubes which is on by default.

barto · February 4, 2026, 12:14pm

Definitely. But this is a different topic and maybe the automatic updates should be disabled after install, until the user confirms that it is ok to update using the default config, or change the default config.

magazinst · May 31, 2026, 8:05pm

solene:

Disable network done by sys-usb / sys-firewall / sys-net

Add this to the file /rw/config/rc.local in the template named default-dvm:
if [ "$(qubesdb-read /name)" = "sys-firewall" ] || [ "$(qubesdb-read /name)" = "sys-net" ] || [ "$(qubesdb-read /name)" = "sys-usb" ]
then
    sudo nft add chain ip qubes output '{type filter hook output priority 0; policy drop; }'
    sudo nft add chain ip6 qubes output '{type filter hook output priority 0; policy drop; }'
fi
Restart the qubes.

Does this have any security benefits? Let’s say that malware got inside sys-net or sys-usb, it scanned the firmware inside those qubes and then tried to connect to a remote server to download a payload which would infect your firmware but since network has been disabled inside these qubes it can’t establish the connection to the remote server. Is this plausible scenario?

west · June 24, 2026, 10:42pm

solene:

if [ "$(qubesdb-read /name)" = "sys-firewall" ] || [ "$(qubesdb-read /name)" = "sys-net" ] || [ "$(qubesdb-read /name)" = "sys-usb" ]
then
    sudo nft add chain ip qubes output '{type filter hook output priority 0; policy drop; }'
    sudo nft add chain ip6 qubes output '{type filter hook output priority 0; policy drop; }'
fi

Adding the nft rules considerably slowed down opening xfce4-terminal in debian-13-xfce based sys-net and in Qubes OS 4.3.1. The sys-net is a DispVM.

It took around 9 seconds to open terminal before adding the nft rules. After adding the nft rules the time ballooned up to 4 mins 39 seconds.

Before

$ time qvm-run -q -a --service -- sys-net qubes.StartApp+xfce4-terminal

real    0m9.255s
user    0m0.086s
sys     0m0.044s

After

$ time qvm-run -q -a --service -- sys-net qubes.StartApp+xfce4-terminal

real    4m39.632s
user    0m0.068s
sys     0m0.034s

A service named org.a11y.Bus seems to be the problem. Per below error message the system waited for 2 mins for the service to come up before giving up. After giving up it took additional two+ mins to open the terminal.

Jun 24 12:23:05 sys-net dbus-daemon[845]: [session uid=1000 pid=845 pidfd=5] Failed to activate service 'org.a11y.Bus': timed out (service_start_timeout=120000ms)
Jun 24 12:25:35 sys-net qrexec-agent[819]: pam_unix(qrexec:session): session closed for user user
Jun 24 12:25:35 sys-net qrexec-agent[817]: 2026-06-24 12:25:35.376 qrexec-agent[817]: qrexec-agent-data.c:309:handle_new_process_common: pid 819 exited with 0

Anyone else encounter similar problem? Suggestion on how to modify the nft rules to fix this problem is appreciated.

marcos-morar · June 25, 2026, 12:08am

solene:

Disable network done by sys-usb / sys-firewall / sys-net

Add this to the file /rw/config/rc.local in the template named default-dvm:

if [ "$(qubesdb-read /name)" = "sys-firewall" ] || [ "$(qubesdb-read /name)" = "sys-net" ] || [ "$(qubesdb-read /name)" = "sys-usb" ]
then
    sudo nft add chain ip qubes output '{type filter hook output priority 0; policy drop; }'
    sudo nft add chain ip6 qubes output '{type filter hook output priority 0; policy drop; }'
fi

What if the sys-net qube name isn’t just sys-net, but instead something like sys-net-home, sys-net-office, or sys-net-cafe? What would the script look like in that case? Would ["$(qubesdb-read /name)" == sys-net*] work?

barto · June 25, 2026, 2:48pm

Most probably, yes.
Also this Bash construct works to the same effect:

[[ "$(qubesdb-read /name)" =~ "sys-net" ]]

(note the double square brackets, and the “=~” operator which I read as “contains”, as in “the string on the left-hand side contains the string on the right-hand side”)