Qubes-mirage-firewall RC-like update

General Discussion
1

Dear community,
I plan to push Ocaml 5+ ecosystem for Qubes-mirage-firewall soon, before continuing development. We don’t have RC releases with Qubes-mirage-firewall, but if you want to try and help find bugs before the next release, you can test:

For both repositories, you can run:

sudo dnf install podman -y && \
git clone <the chosen repository> && \
cd qubes-mirage-firewall && \
./build-with.sh podman

This will build dist/qubes-firewall.xen which you can copy into dom0 as a regular update.
Any help and/or feedback will be greatly appreciated :slight_smile:

Based on lastest feedbacks, and after the next release I’ll start to work on:

  • IPv6 support
  • port redirection support
7 Likes
2

Hello,

Thank you for your work! I’m all set to test the mirage-firewall and will let you know if I encounter any issues. I will also test ProtonVPN to see if I run into the same problems I had with MullvadVPN, as I have a subscription.

Thanks!

1 Like
3

@palainp Does mirageos-firewall store data on the drive, or is it only in RAM?

4

There is no persistance nor configuration from the disk. The only mutable things are the connected clients configuration and their firewall rules. Those are read from QubesDB dynamically at runtime and everything is in RAM.

2 Likes
5

Can confirm, protonvpn is working without any issues.

6

@palainp , is there any chance of release ocaml 5 soon, like before 4.3?

7

Dear @alsa1 , sure I can, I’m just holding back because I haven’t received any feedback on the PRs, and since I don’t want to rule a release decision solely on “it works for me”, I prefer to leave some time for anyone who want to test between releases :slight_smile:

So my plan is to merge a fix today for hvm clients (e.g., Windows and OpenBSD), which should now work better, especially when shut down. And also to switch to OCaml 5.3.
For those who are interested, you should be able to compile and test the unikernel before it is released, and if there are no issues detected, that can be released :slight_smile:

8

Thanks but I’m so lost…

I’ve followed instructions from Proton website and got Proton VPN working fine and using it in this configuration:
Qube(s)-firewall-ProtonVPN-firewall-net-wan

Appreciated if i can get help to setup the mirageFirewall,step-by-step.

9

In your setup, your should be able to replace both firewall with two mirage-fw VMs. The easiest way to do so would be either:

In your case you’ll need to create two different firewall VMs because they have different netvm, but you can use the same unikernel for both (so only need to copy the unikernel once), the unikernel is loaded in memory for each VM and is not shared :slight_smile:

1 Like
10

Now both PRs are merged in the main repository (see GitHub - mirage/qubes-mirage-firewall: A Mirage firewall VM for QubesOS), test from anyone will be appreciated (command list in OP), and probably a new release can be cut soon :slight_smile:

2 Likes