Purpose and usage of visible_ip?

User Support General
1

Hi,

The man page of qvm-prefs says:

       This   list   is   non-exhaustive.   For   authoritative  listing,  see
       --help-properties and documentation of the source code.

Neither --help-properties, nor the dev doc explain the purpose and possible usage of visible_* network properties.

Where can I find info about that?

2

Strange coincidenceā€¦ I was wondering the same last weekā€¦ and found this on the same doc page that you linked:

set_mapped_ip_info_for_vm(*vm* )

Set configuration to possibly hide real IP from the VM. This needs to be done before executing ā€˜scriptā€™ (/etc/xen/scripts/vif-route-qubes) in network providing VM

[source]

1 Like
3

@barto

Thanks for the feedback.
I wonder what is the assumed goal of hiding real IP address from the VM.

4

This way you can have several VMs that think they have the same IP (for example generic 192.168.1.1), but networking still works without conflicts.

5

@marmarek

Is it just for conflict prevention? Any other supposed usage?

Just trying to figure possibilities.

6

Also allows you to hide true internal IP in case of compromise.

I never presume to speak for the Qubes team.
When I comment in the Forum I speak for myself.

7

@unman

Also allows you to hide true internal IP in case of compromise.

Yeah, I thought about it already, but in that case wouldnā€™t it make sense that all VMs hide it by default?

8

By default, to what?
All qubes? To what benefit?
As a security measure, the only benefit I see is hiding the 10.137 and
10.138 giveaway but this is very minor - so many other Qubes tells.

I never presume to speak for the Qubes team.
When I comment in the Forum I speak for myself.

1 Like
9

@unman

By default, to what?

10.0.0.1, or 192.168.0.1, or whatever safe value in regards to a case of potential compromise.

All qubes? To what benefit?

Not ā€œallā€ as in ā€œallā€ but as in ā€œall by defaultā€.
Benefit - the same one you mentioned.

10

Also seemsā€¦ difficult to even use it:

user@dom0 ~ % qvm-prefs test visible_ip 192.168.1.1
qvm-prefs: error: property 'visible_ip' on AppVM instance cannot be set

test is a ProxyVM here. Also did not work when it was NOT a ProxyVM.

11

@Atrate

Have you opened an issue?

12

No, as I assume Iā€™m just using it incorrectly. The complete lack of documentation does not help in using it the way itā€™s intended, though :slight_smile:

13

The right way to change this value is with qvm-features like so:

# Example with 192.168.0.100
qvm-features <qube> net.fake-ip 192.168.0.100

Which returns:

qvm-prefs <qube> visible_ip 
192.168.0.100

Doc: qvm-features ā€“ manage domainā€™s features ā€” Qubes Admin client mm_9c733d84-2-ga5ea121 documentation

2 Likes
14

Nice, this seems to work, thank you!

1 Like