Qubes OS 4.2 nftables / nft firewall guide

Community Guides
81

Yes, but you cannot allow traffic between qubes using the settings
manager - you have to do that explicitly with nftables in the upstream qube.

I never presume to speak for the Qubes team.
When I comment in the Forum I speak for myself.

82

  1. When the same ISO is installed on bare metal no restrictions are observed for my ssh port, so wouldn’t expect there would be when installed as a standalone qube.

  2. Dest ISO qube op sys is MX Linux, based on debian 12 (bookworm)

  3. When installed in Qubes, nft list rules produces 410 lines. Looking over those rules I don’t see anything obvious that would account for an incoming blockage, but I am not familiar with nft so might not have recognized such rules if they’re there. Looking for the ssh port # finds a total of 4 rules, 2 for ipv4, 2 for ipv6 (1 for udp 1 for tcp). Here’s one set for ipv4:

chain ufw-user-input {
    tcp dport aaaa counter packets 0 bytes 0 accept
    tcp dport 22 counter packets 0 bytes 0 drop       <-- std ssh
    tcp dport 80 counter packets 0 bytes 0 accept
    udp dport 80 counter packets 0 bytes 0 accept
    tcp dport xxxxx counter packets 0 bytes 0 accept  <--ssh port
    udp dport xxxxx counter packets 0 bytes 0 accept  <--ssh port
}

I thought I understood when Selene said:

Basically, the firewall rules done through the Qube settings manager in the firewall tab are applied on the netvm of that qube, so as long as this netvm is using an official template the rules will be applied.

but aren’t those settings only for outgoing rules? I do see the note at bottom (“This tab provides only a very basic firewall configuration”) so maybe not. Besides, the dest qube does NOT use a std qubes template, so I figure I need to apply the script in the sys-firewall, not dest qube.

I messed up last night as the src qube’s networking was set to sys-whonix, but today sys-firewall. Still can’t ping dest qube.

sven suggested I set dest qube’s internal net manager’s manual setup to use src qube’s IP as gateway for dest, set src qube’s “provides network” checked, dest net qube setting as src qube. I left the dest IP (in net manager’s manual config) as it was assigned by qubes on basic tab of settings. No ping to dest qube worked from src using that approach either.

Just for completeness note that the ISO dest qube is able to connect to outside Internet when its’ internal net manager’s manual settings are setup as per IP/gateway info on basic tab of its’ settings.

83

I think it’d be better if you try to enable networking between two qubes based on a template by following the guide and when you’ll make it work then you can try the same for your your standalone destination qube.
This way you can make sure that your firewall configuration in the net qube (sys-firewall) is correct.

84

I’ve already taken too much time fiddling with this. My workaround is using a system on local network as intermediary. Requires 2 hops (src VM to intermediary, ISO qube to intermediary) but it works.

I believe issue is setting correct sys-fiewall nft rules.

Examples for template based qube don’t apply to my standalone ISO based qube so I don’t see how your suggestion would help. Never-the-less, thx for the suggestion!